hcloud-okd4

Deploy OKD4 (OpenShift) on Hetzner Cloud using HashiCorp Packer, Terraform, and Ansible.

Important Notice

Hetzner Cloud does not meet the I/O performance and latency requirements for etcd – even when using local SSDs (not Ceph). This may cause issues during the cluster bootstrap phase.

This setup is suitable for small test environments only. Not recommended for production clusters.

Architecture

By default, a single-node cluster is deployed with the following components:

| Component | Type / Size | |---------------|-------------| | Master Node | cpx41 | | Load Balancer | lb11 | | Bootstrap Node| cpx41 (removed after bootstrap) | | Ignition Node | cpx21 (removed after bootstrap) |

Additional worker nodes can be added by setting an environment variable before running Terraform:

export TFVARreplicas_worker=3  # Example: 3 worker nodes

Version & Deployment Options

You can set the desired release version with the OPENSHIFT_RELEASE environment variable.

Example:

export DEPLOYMENT_TYPE=okd # Options: "okd" or "ocp", default is "okd"
export OPENSHIFTRELEASE=$(make latestversion) # or a fixed version like "4.19.9"

For OCP (Red Hat OpenShift), you will also need a valid pull secret, available from cloud.redhat.com.

Quick Start

• Build and start the toolbox

make fetch
   make build
   make run

• Create install-config.yaml (see example in Configuration)
• Generate manifests

make generate_manifests

• Generate ignition configs

make generate_ignition

• Export required environment variables (see example in Configuration)
• Build Fedora/RedHat CoreOS image using Packer

make hcloud_image

• Deploy infrastructure with Terraform (including bootstrap and ignition node)

make infrastructure BOOTSTRAP=true

• Wait for bootstrap completion

make wait_bootstrap

• Remove bootstrap and ignition node

make infrastructure

• Wait for installation to finish

make wait_completion

• Approve worker CSRs (if workers are deployed)

make sign_csr
    sleep 60
    make sign_csr

Configuration

Example: install-config.yaml

apiVersion: v1
baseDomain: 'example.com'
metadata:
  name: 'okd4'
compute:
  - hyperthreading: Enabled
    name: worker
    replicas: 0
controlPlane:
  hyperthreading: Enabled
  name: master
  replicas: 1
networking:
  clusterNetworks:
    - cidr: 10.128.0.0/14
      hostPrefix: 23
  networkType: OVNKubernetes
  serviceNetwork:
    - 172.30.0.0/16
machineCIDR: platform:
  none: {}
pullSecret: '{"auths":{"none":{"auth":"none"}}}'
sshKey: ssh-rsa AAAA…<your ssh key here>

Required Environment Variables

# Terraform / DNS
export TFVARdns_domain=okd4.example.com
export TFVARdnszoneid=YOURZONEID
Hetzner Cloud credentials
export HCLOUDTOKEN=YOURHCLOUD_TOKEN
Cloudflare credentials
export CLOUDFLARE_EMAIL=user@example.com
export CLOUDFLAREAPIKEY=YOURAPIKEY

Firewall & Access

• Nodes are not directly exposed to the internet by default.
• Only the load balancer is public accessible.
• SSH access to nodes will only be possible with additional firewall configuration.

Deploying OCP (Red Hat OpenShift)

To deploy OCP instead of OKD:

export DEPLOYMENT_TYPE=ocp
export OPENSHIFT_RELEASE=4.19.9 # example version
make fetch build run

You can also choose the latest version from a specific channel:

export OCPRELEASECHANNEL=stable-4.19
export OPENSHIFTRELEASE=$(make latestversion)
make fetch build run

Limitations / Not for Production

• I/O performance and latency issues with etcd (see above).
• Components that rely on strong consistency (like etcd) may suffer under heavy load.
• No stability guarantees for large clusters or production use.

Author

slauger