Cloud providers
Connect providers, validate access, discover resources and start a clear infrastructure workflow.
Available cloud providers
| Provider | Status | Workflow |
|---|---|---|
| Hetzner Cloud | Available | Validate, discover, plan and operate. |
| IONOS Cloud | Available | Validate, discover, plan and operate. |
Provider account boundary
Provider account APIs create, update, validate, rotate, reset, and inspect provider configuration. Credentials must be represented by protected secret references. Responses, logs, audit, and support output must contain identity and posture—not raw credentials.
- ✓Use a dedicated project/subscription/account boundary where the provider supports one.
- ✓Grant the minimum permissions needed for the approved lifecycle operations.
- ✓Separate validation credentials from broad tenant administration.
- ✓Document resource naming, labels/tags, regions, networks, quotas, and cleanup ownership.
- ✓Test rotation and revocation before production approval.
Validation and discovery
Validation should prove identity, permissions, endpoint reachability, TLS, quotas, rate-limit posture, and access to the selected location/resources. Discovery is read-only and must not create provider resources.
| Result | Interpretation | Next action |
|---|---|---|
| Valid | The bounded validation contract passed. | Continue to a dry-run plan; do not assume full lifecycle approval. |
| Rate limited | Provider rejected request volume. | Honor retry guidance and reduce concurrency. |
| Permission denied | Identity lacks one or more required actions. | Correct policy; do not replace with an unrestricted owner token. |
| Resource conflict | Name, address, quota, or ownership collides. | Fix topology or clean explicitly owned residual resources. |
| Circuit open | Repeated provider failures triggered protection. | Restore provider health and wait/reset only through the approved control. |
Infrastructure versus Kubernetes
Creating networks, machines, volumes, and firewall posture is a provider operation. Preparing hosts, bootstrapping kubeadm, installing Calico, and joining nodes is a cluster-lifecycle operation. ClusterPilot links their evidence but preserves the boundary so failures and cleanup ownership remain explainable.
Review the cluster lifecycle contract →