Hetzner account preparation

Hetzner has two offerings: Hetzner Cloud (virtualized) and Hetzner Robot (bare metal). Syself Autopilot supports both. A cluster can run cloud-only, bare-metal-only, or a hybrid of the two, and you can change that at any time. Set up both here even if you only need one today, so your account is fully provisioned — otherwise the missing piece has to be added later, when you do need it, and an out-of-sync account causes problems.

Step 1: Create Hetzner Project#

We assume that you have an account at Hetzner⁠.

Create a new project in the Hetzner Cloud Console⁠.

Step 2: Create API Token#

Create an API token inside your Hetzner project with read and write permissions. Store it somewhere safe, we'll be using it in later steps.

Step 3: Upload SSH key to Hetzner Cloud#

1. Create a new SSH key, for example by using this command:

   		$ ssh-keygen -t ed25519 -C 'autopilot'
   	

2. Upload the public key to the Hetzner project.

Step 4: Setting up a user for Hetzner Robot (bare metal)#

The Robot User is needed for managing bare metal machines. You can create one like this:

1. Go to robot.hetzner.com⁠
2. Go to "Settings" (behind "👤")
3. Go to "Webservice and app settings"
4. Configure "Webservice/app user"

Step 5: Store all values in environment variables#

Store all values that you gathered during the steps above in environment variables.

		$ export KUBECONFIG=/optional/path/to/your/management/cluster/kubeconfig
$ export HCLOUD_TOKEN=<your-hetzner-api-token>
$ export SSH_KEY_NAME=<ssh-key-name>
$ export HETZNER_SSH_PUB_PATH=/path/to/file/<ssh-key-name>.pub
$ export HETZNER_SSH_PRIV_PATH=/path/to/file/<ssh-key-name>
$ export HETZNER_ROBOT_USER=<robot-user>
$ export HETZNER_ROBOT_PASSWORD=<robot-password>
	

You can use "echo", for example echo $SSH_KEY_NAME, to check that the values are set correctly.

Step 6: Create Secrets in Management Cluster#

To create Kubernetes clusters in your Hetzner account, you need to create secrets in the management cluster.

Secret for accessing Hetzner API#

Create the secret "hetzner" in the following way:

		$ kubectl create secret generic hetzner \
--from-literal=hcloud=$HCLOUD_TOKEN \
--from-literal=robot-user=$HETZNER_ROBOT_USER \
--from-literal=robot-password=$HETZNER_ROBOT_PASSWORD \
--from-literal=hcloud-ssh-key-name=$SSH_KEY_NAME
secret/hetzner created
$ kubectl get secrets
NAME                           TYPE                                  DATA   AGE
hetzner                        Opaque                                4      5s
	

Secret for bare metal servers#

Open image: Hetzner UI showing how to add Robot SSH to Management Cluster

Close

Hetzner UI showing how to add Robot SSH to Management Cluster

Store the same SSH key you uploaded above as a second secret, robot-ssh. Syself uses this one key to provision both your cloud and bare metal servers: it boots each server into the Hetzner rescue system and uses the key to reach it while the node image is written. The key stays available afterwards if you want to log into a server, or you can turn SSH off once the cluster is up.

		$ export SSH_KEY_NAME=autopilot
$ export HETZNER_SSH_PUB_PATH=~/.ssh/autopilot.pub
$ export HETZNER_SSH_PRIV_PATH=~/.ssh/autopilot
$ kubectl create secret generic robot-ssh \
--from-literal=sshkey-name=$SSH_KEY_NAME \
--from-file=ssh-privatekey=$HETZNER_SSH_PRIV_PATH \
--from-file=ssh-publickey=$HETZNER_SSH_PUB_PATH
secret/robot-ssh created
$ kubectl get secrets
NAME                           TYPE                                  DATA   AGE
hetzner                        Opaque                                4      4m56s
robot-ssh                      Opaque                                3      5s
	

Run kubectl get secrets to confirm both secrets exist.