DigitalOcean

The DigitalOcean provider maps Kyku abstract resources to DigitalOcean services via the DO REST API and AWS S3 SDK for Spaces.

Credentials

# DigitalOcean API (required)
export DIGITALOCEAN_TOKEN=your-api-token

# DO Spaces (optional, for Bucket)
export DO_SPACES_REGION=nyc3
export DO_SPACES_ACCESS_KEY=your-access-key
export DO_SPACES_SECRET_KEY=your-secret-key

Service	Backend	Auth Method
Cloud API	REST at api.digitalocean.com/v2	Authorization: Bearer DIGITALOCEAN_TOKEN
Spaces	@aws-sdk/client-s3 w/ endpoint override	AWS SigV4

Supported Resources

Resource	DO Service	Status
Vpc	VPC	✅
Subnet	VPC (synthetic)	✅
Vm	Droplet	✅
SecurityGroup	Cloud Firewall	✅
LoadBalancer	Load Balancer	✅
TargetGroup	LB Target Group	✅
Database	Managed DB	✅
Identity	—	❌
Role	—	❌
SshKey	SSH Key	✅
Bucket	Spaces (S3-compat)	✅
DnsZone	Domain	✅
DnsRecord	Record	✅
Custom	wired	✅

Instance Type Mapping

Abstract	DigitalOcean
micro	s-1vcpu-1gb
small	s-1vcpu-2gb
medium	s-2vcpu-4gb
large	s-4vcpu-8gb
xlarge	s-8vcpu-16gb
2xlarge	g-8vcpu-32gb
4xlarge	g-16vcpu-64gb
8xlarge	g-32vcpu-128gb

Image Mapping

Abstract	DigitalOcean
ubuntu-22.04	ubuntu-22-04-x64
ubuntu-24.04	ubuntu-24-04-x64
debian-12	debian-12-x64

Region Mapping

Abstract	DigitalOcean
us-east	nyc3
us-west	sfo3
eu-central	fra1
eu-west	lon1
ap-southeast	sgp1
ap-south	blr1
ap-northeast	syd1
ca-east	tor1

Gotchas

Custom Config

Every resource manager accepts a customConfig object merged directly into the underlying DigitalOcean API request — see Custom Config. @kykucloud/digitalocean exports DigitaloceanVpcCustomConfig, DigitaloceanVmCustomConfig, DigitaloceanLoadBalancerCustomConfig, DigitaloceanDatabaseCustomConfig, DigitaloceanDnsRecordCustomConfig, and DigitaloceanKubernetesClusterCustomConfig, generated at build time from a vendored slice of the official digitalocean/openapi spec (bun run generate:custom-config regenerates them; bun run check:custom-config verifies the committed output is current). Fields use the spec’s own snake_case casing (ip_range, vpc_uuid, …), matching what the provider actually sends over the wire — there’s no camelCase mapping layer. SecurityGroup, SshKey, and DnsZone reduce to an empty type once Kyku-owned fields are excluded (documented rather than typed); Bucket (Spaces, separate API) and TargetGroup (synthetic) don’t have one either.

Droplet updates now route through real Droplet Actions: backups/backup_policy/ipv6/resize. IPv6 enable is one-way (DO doesn’t support disabling it again — attempting to throws); disk resize is grow-only and needs the droplet powered off first. Kernel changes are deliberately not wired — Kyku droplets use internal kernels, not the legacy externally-managed-kernel model.

Tags are Flat Strings

DigitalOcean tags are flat strings (key:value format), not key-value objects. Use the tagValue('kyku-sg', id) helper. Max tag length is 255 chars.

Firewall Ports Format

Firewall rules use a ports string field:

Port Spec	Example
Single port	"22"
Range	"80-443"
All ports	"all"
ICMP	Omit ports entirely

Kyku maps fromPort/toPort to the DO ports format automatically.

Firewall Dynamic Attachment via Tags

Droplets are tagged with kyku-sg:<id> at creation. Firewall rules reference these tags in sources.tags / tags instead of individual droplet IDs.

LB Sizing Uses size_unit

DO Load Balancers use size_unit (integer, 1–100), not named sizes. Kyku maps abstract size config to size_unit with a default of 1.

Managed DB Engine Names

DO uses different engine names than the abstract names:

Abstract	DO API
postgresql	pg
mysql	mysql
mariadb	mariadb
redis	redis

Kyku maps these in create() before POST to /v2/databases.

DB Private Networking

Managed Databases require private_network_uuid for VPC placement. Kyku resolves the VPC UUID and includes it in the create body.

VPC CIDR Must Be Private Range

DO VPCs only accept private CIDR blocks: 10.x, 172.16-31.x, or 192.168.x. Kyku validates this before creation.

Name Limit

DigitalOcean names allow up to 255 chars (not 63 like Hetzner). Use slice(0, 255) — no aggressive truncation needed.

process.env in Bun

DO provider uses (globalThis as any).process?.env?.VAR for env var access instead of @types/node.