Providers

A template names resource types such as database.postgresql or web.frontend, never a provider. When you create an instance, each placement slot is bound to a cloud target (one account, project, team or workspace of a provider) and a region. The provider adapter behind that target turns each resource into real infrastructure.

Two kinds of providerCopy Anchor Link

Infrastructure clouds (AWS, Microsoft Azure, Google Cloud, Oracle Cloud Infrastructure, DigitalOcean, Vultr, CoreWeave and Magalu Cloud) are deployed with OpenTofu. For each resource, the worker runs an OpenTofu module in a throwaway runner container. Every resource has its own state file, kept in a bucket or container in your own account. OrkStage keeps outputs and references, not the state.

Application platforms (Vercel, Render and Supabase) are driven through their REST APIs. There is no OpenTofu, no module and no state store: the platform itself holds the state, and the adapter finds its resources again by name, so repeating a deployment converges the existing resource instead of creating a second one.

Both kinds can be mixed in one instance. See mixing providers.

Support matrixCopy Anchor Link

Each cell is the capability id you can set in a resource's implementation field. When a type has more than one capability, the first one is the default. "Not offered" means the provider has no capability for that type: place that resource on another provider.

AWS also covers container-registry (ecr), queue (sqs) and dns (route53). No other provider offers those three types yet.

Each provider page lists what every capability creates, the settings it ignores and its known limits. The plan shows the capability chosen for each resource before anything is deployed.

Enabling a providerCopy Anchor Link

Each provider has a feature flag, PROVIDER_<NAME> (for example PROVIDER_AZURE or PROVIDER_VERCEL). Only PROVIDER_AWS and PROVIDER_MOCK (simulation) are on by default. While a provider's flag is off:

• registering a target for it fails with PROVIDER_DISABLED;
• an instance whose placement slot is bound to one of its targets does not compile (create, update, preview and deploy are refused), and the worker checks again before applying;
• destroying an instance always works, so turning a provider off never strands resources;
• simulation targets can still imitate it, which is the way to try a template without an account.

For one tenant, the value comes from the first of these that is set: the tenant's own value, the platform value, the default. A tenant value therefore wins over the platform value for that tenant. The same flags also decide what templates may use: MULTI_CLOUD, MULTI_REGION, AUTOSCALING and CUSTOM_DOMAINS, all on by default.

A platform owner changes flags in the console under Settings > Feature flags, for the whole platform or for one tenant, or through the API:

# Enable Azure for one tenant only
curl -X PUT "$ORKSTAGE_API/feature-flags/PROVIDER_AZURE" \
  -H "Content-Type: application/json" -H "x-orkstage-csrf: 1" -b "$SESSION_COOKIE" \
  -d '{"enabled": true, "tenantId": "<tenant id>"}'

# Remove that override again
curl -X DELETE "$ORKSTAGE_API/feature-flags/PROVIDER_AZURE?tenantId=<tenant id>" \
  -H "x-orkstage-csrf: 1" -b "$SESSION_COOKIE"

Flag changes need a session with the platform owner role (API keys cannot change them) and are recorded in the audit log. GET /cloud/providers reports whether each provider is enabled.

Registering a cloud targetCopy Anchor Link

Platform owners and admins connect accounts in the console with Cloud targets > Connect a cloud: a wizard that turns the provider on if needed, gives the commands that prepare the account, registers the target and validates it. ork targets add does the same from a terminal, and Register target is the short form. The API call underneath is POST /api/v1/cloud/targets, with the fields each provider page lists.

POST /api/v1/cloud/targets
Content-Type: application/json

{
  "provider": "gcp",
  "name": "gcp-prod",
  "environment": "production",
  "config": { "projectId": "acme-prod-123", "stateBucket": "acme-orkstage-state" },
  "credentialRef": "aws-sm://orkstage/gcp/prod",
  "allowedRegions": ["us-central1", "southamerica-east1"],
  "defaultRegion": "us-central1"
}

config holds only identifiers that are not secret. The API rejects keys that look like secrets with 422 SECRET_IN_CONFIG. After registering, click Validate: each adapter checks the configuration, signs in and shows the identity it found. Infrastructure clouds also check that the state storage answers.

How credentials workCopy Anchor Link

OrkStage never stores provider credentials. A target carries a credentialRef, a reference to a secret that the control plane resolves when it needs it:

env://ORKSTAGE_AZURE_PROD             # environment variable of the API and worker
aws-sm://orkstage/azure/prod          # AWS Secrets Manager secret (name or ARN)

The secret holds a JSON object with the fields the provider page lists, for example { "clientSecret": "<client secret>" } for Azure. When a provider needs a single field (an API token or key), the secret can also be the bare value.

Credentials stay in memory. For infrastructure clouds they reach OpenTofu only as environment variables of one runner command; for application platforms they are sent only to the provider's API. They are not written to the configuration, the state keys, the database or the logs. See secret references for the schemes and how they resolve.

Where state livesCopy Anchor Link

OrkStage never creates the state bucket or container. Validation reports it as missing until it exists. Turn on versioning so you can recover an older state. Where the storage does not confirm conditional writes (OCI, Vultr, CoreWeave, Magalu Cloud), OpenTofu runs without a lock file; OrkStage already runs one operation per resource at a time.

TriggersCopy Anchor Link

The actions a trigger can run depend on the capability of its resource:

Each provider page lists the parameters of its actions.