Provider Accounts
Provider Accounts in the Polycrate API: named connections to IaaS and OpenAI-compatible provider APIs, their scope, api_kind and what builds on them (hosts, worker pools, assistant).
Provider Accounts
A Provider Account is the named connection to a provider API: IaaS (Hetzner Cloud, OpenStack/OTC, OVH, IONOS, Proxmox) and OpenAI-compatible endpoints. Secrets live in a Credential kind=provider-account; the account carries api_kind, scope and an optional catalog assignment.
It does not replace the External DNS model. External DNS zones continue to use a Credential kind=dns-provider plus the provider field. The planned cutover (API Spec 726) is not implemented.
Distinction
| Concept | Role |
|---|---|
| Provider (catalog) | Who — Hetzner, OTC, …; no access credentials. See PoPs & Providers |
| Provider Account | How to log in — connection + credential |
Credential dns-provider |
External DNS via Lexicon only. See Domains & DNS |
Scope
| Scope | organization |
Usage |
|---|---|---|
| Platform | empty | Managed Compute: hosts in customer workspaces |
| Organization | set | Customer-owned account (BYOC) |
| Workspace | optionally in addition | Narrower scope |
api_kind is immutable after creation (hetzner_cloud, openstack, ovhcloud, ionos, proxmox, openai_compat, …).
What Builds on It
- Hosts — IaaS provisioning only when
provider_accountis set - Worker Pools — scale hosts via the same account
- Assistant — optional
openai_compataccount per session. See Assistant
UI: Administration → Provider Accounts. API: /api/v1/provider-accounts/.
After the Deploy
Host products (kind=host) are not seeded. Create SKUs manually or via the API after the release (provider-scoped, not driver-scoped).
SSH keys for workspaces: no auto-generation on every save. Opt in via the create form (generate_ssh_keys) or locally with polycrate workspace create … --with-ssh-keys.