Skip to main content
A pipeline is an operating pattern, not a separate compatibility layer. Choose one tested client or infrastructure tool, pin it, and make the Cloud Adapter endpoint explicit at the job boundary.

​
Pipeline contract

Define these inputs before writing YAML: Target runtime credentials belong to Cloud Adapter. Do not copy them into the build system.
  1. Validate: pin and print non-secret tool versions; validate configuration offline.
  2. Read-only smoke test: prove DNS, TLS, authentication, adapter routing, and one covered read.
  3. Preview: produce a plan or preview artifact for review.
  4. Approval: require a human or policy gate before mutation in shared environments.
  5. Apply: create one uniquely named resource with bounded timeouts and concurrency.
  6. Verify: check both the origin-shaped response and native target state.
  7. Expected failure: exercise one not-found or validation path and retain request identifiers.
  8. Cleanup: remove only resources carrying the run’s unique namespace.
  9. Publish evidence: versions, redacted configuration, request IDs, verification result, and cleanup result.

​
Example smoke-test job

This job is a complete origin-side lifecycle. AWS_ENDPOINT_URL_S3 routes only S3 clients in the job to Cloud Adapter; it does not redirect other AWS services. Add a target-native, read-only verification step from the matching route quickstart before cleanup when the pipeline has a target verification identity. Use the CI system’s workload identity or secret store for origin credentials. Never echo environment variables or enable shell tracing around credential and signed-request setup.

​
Retry and concurrency rules

  • Bound automatic retries. A timed-out mutation may already have reached the target.
  • Serialize tests that share a fixed resource name.
  • Prefer a unique prefix per run and exact cleanup over broad bucket deletion.
  • Make cleanup idempotent and run it after partial failure.
  • Keep verification read-only and independent from the origin client when possible.

​
Diagnostics artifact

Include operation name, timestamp, tool version, adapter endpoint hostname, adapter version, HTTP status, origin request ID, target request ID when available, and whether target state changed. Exclude authorization headers, signed URLs, credential material, request bodies, and unredacted configuration. Base the job on a concrete guide such as AWS CLI or Terraform/OpenTofu, and use Operations for change and recovery boundaries.