Hetzner account preparation

Hetzner has two offerings: Hetzner Robot (bare metal) and Hetzner Cloud (virtualized). Syself Autopilot supports both, so configure the connection for both Hcloud and Robot.

Step 1: Create Hetzner Project

We assume that you have an account at Hetzner⁠.

Create a new project in the Hetzner Cloud Console⁠.

Step 2: Create API Token

Create an API token inside your Hetzner project with read and write permissions. Store it somewhere safe, we'll be using it in later steps.

Step 3: Upload SSH key to Hetzner Cloud

		$ ssh-keygen -t ed25519 -C 'autopilot'
	

Step 4: Setting up a user for Hetzner Robot (bare metal)

The Robot User is needed for managing bare metal machines. You can create one like this:

1. Go to robot.hetzner.com⁠
2. Go to "Settings" (behind "👤")
3. Go to "Webservice and app settings"
4. Configure "Webservice/app user"

Step 5: Store all values in environment variables

Store all values that you gathered during the steps above in environment variables.

		$ export KUBECONFIG=/optional/path/to/your/management/cluster/kubeconfig
$ export HCLOUD_TOKEN=<your-hetzner-api-token>
$ export SSH_KEY_NAME=<ssh-key-name>
$ export HETZNER_SSH_PUB_PATH=/path/to/file/<ssh-key-name>.pub
$ export HETZNER_SSH_PRIV_PATH=/path/to/file/<ssh-key-name>
$ export HETZNER_ROBOT_USER=<robot-user>
$ export HETZNER_ROBOT_PASSWORD=<robot-password>
	

You can use "echo", for example echo $SSH_KEY_NAME, to check that the values are set correctly.

Step 6: Create Secrets in Management Cluster

To create Kubernetes clusters in your Hetzner account, you need to create secrets in the management cluster.

Secret for accessing Hetzner API

Create the secret "hetzner" in the following way:

		$ kubectl create secret generic hetzner \
--from-literal=hcloud=$HCLOUD_TOKEN \
--from-literal=robot-user=$HETZNER_ROBOT_USER \
--from-literal=robot-password=$HETZNER_ROBOT_PASSWORD \
--from-literal=hcloud-ssh-key-name=$SSH_KEY_NAME
secret/hetzner created
$ kubectl get secrets
NAME                           TYPE                                  DATA   AGE
hetzner                        Opaque                                4      5s
	

Secret for bare metal servers

Open image: Hetzner UI showing how to add Robot SSH to Management Cluster

Close

Hetzner UI showing how to add Robot SSH to Management Cluster

Bare metal servers are provisioned over SSH, so you need a second secret:

		$ export SSH_KEY_NAME=autopilot
$ export HETZNER_SSH_PUB_PATH=~/.ssh/autopilot.pub
$ export HETZNER_SSH_PRIV_PATH=~/.ssh/autopilot
$ kubectl create secret generic robot-ssh \
--from-literal=sshkey-name=$SSH_KEY_NAME \
--from-file=ssh-privatekey=$HETZNER_SSH_PRIV_PATH \
--from-file=ssh-publickey=$HETZNER_SSH_PUB_PATH
secret/robot-ssh created
$ kubectl get secrets
NAME                           TYPE                                  DATA   AGE
hetzner                        Opaque                                4      4m56s
robot-ssh                      Opaque                                3      5s
	

You should use the same SSH key as you used for setting up Hetzner Cloud.

Run kubectl get secrets to confirm both secrets exist.