Connect a server provider

A provider connection lets Tenkai create servers in your account at Hetzner Cloud, DigitalOcean, Scaleway or Infomaniak Public Cloud. The provider bills you for them directly. Only team owners and admins connect a provider.

Create a token at your provider, then add the connection.

Hetzner Cloud

In the Hetzner Console, open your project, then Security → API tokens, and generate a token with Read & Write. The token reaches only this project.

DigitalOcean

In the DigitalOcean Control Panel, open Account → API and generate a token with Full Access. The token reaches the team you are in when you create it.

A custom token also works, with the account:read, droplet:create, droplet:read, image:read, regions:read, sizes:read, tag:create and tag:read scopes. Add droplet:delete so Tenkai can delete the Droplet of a server you remove.

Scaleway

1. In the Scaleway Console, open IAM and create an application.
2. Give it a policy with the InstancesFullAccess and BlockStorageFullAccess permission sets on your project.
3. Generate an API key for the application, and copy its secret key.
4. Copy the Project ID from the settings of your project.

Infomaniak Public Cloud

From the Infomaniak Manager, open the Horizon dashboard of your project. In Identity → Application Credentials, create a credential with the reader and member roles, and copy its ID and its secret.

Add the connection

1. Open Providers in the sidebar, choose Connect provider, then your provider. When you create a cluster or add a node, you can also choose Connect a provider under Source. The form keeps what you typed.
2. Enter a name, such as Production project, and paste the token or the secret key. For Scaleway, also paste the project ID. For Infomaniak Public Cloud, paste the ID of the application credential and its secret.
3. Choose Connect.

Tenkai checks the credential with the provider before it saves it. It never shows the credential again.

When Tenkai refuses the credential

The message under the field says what the provider answered.

• Rejected this token or this secret key. Copy the whole credential again. A revoked or expired one is rejected too.
• Is read-only or lacks a permission. Create a new token with the right permissions.
• Cannot reach this project. Check the Scaleway project ID, and that the rule of the policy covers that project.
• Locked this account. DigitalOcean locked the account. Solve it with DigitalOcean, then connect again.

Replace the token

When a token is revoked or expires, its connection turns Invalid. Choose Replace token… in the … menu of the connection, and paste a new token of the same project or team.

Remove a connection

Choose Remove… in the … menu of the connection. The servers it created keep running, and the provider keeps billing them. Without the connection, Tenkai can no longer delete their machines when you remove them. The credential still works at the provider, so revoke it there too.