Deploy OKD4 (OpenShift) on Hetzner Cloud using Hashicorp Packer, Terraform and Ansible.

The Hetzner Cloud does not fulfill the I/O performance/latency requirements for etcd - even when using local SSDs (instead of ceph storage). This could result in different problems during the cluster bootstrap. You could check the I/O performance via etcdctl check perf.

Because of that OpenShift on hcloud is only suitable for small test environments. Please do not use it for production clusters.

The deployment defaults to a single node cluster.

• 1x Master Node (CX41)
• 1x Loadbalancer (LB11)
• 1x Bootstrap Node (CX41) - deleted after cluster bootstrap
• 1x Ignition Node (CX11) - deleted after cluster bootstrap

To ensure that the we have a proper build environment, we create a toolbox container first.

make fetch
make build

If you do not want to build the container by your own, it is also available on quay.io.

Use the following command to start the container.

make run

All the following commands will be executed inside the container.

Set a target version of use the targets latest_version and latest_coreos_version to fetch the latest available version.

export OPENSHIFT_RELEASE=$(make latest_version)
export COREOS_RELEASE=$(make latest_coreos_version)

---
apiVersion: v1
baseDomain: 'example.com'
metadata:
  name: 'okd4'
compute:
- hyperthreading: Enabled
  name: worker
  replicas: 0
controlPlane:
  hyperthreading: Enabled
  name: master
  replicas: 1
networking:
  clusterNetworks:
  - cidr: 10.128.0.0/14
    hostPrefix: 23
  networkType: OpenShiftSDN
  serviceNetwork:
  - 172.30.0.0/16
  machineCIDR:
platform:
  none: {}
pullSecret: '{"auths":{"none":{"auth": "none"}}}'
sshKey: ssh-rsa AABBCC... Some_Service_User

make generate_manifests

make generate_ignition

# terraform variables
export TF_VAR_dns_domain=okd4.example.com
export TF_VAR_dns_zone_id=14758f1afd44c09b7992073ccf00b43d

# credentials for hcloud
export HCLOUD_TOKEN=14758f1afd44c09b7992073ccf00b43d14758f1afd44c09b7992073ccf00b43d

# credentials for cloudflare
export [email protected]
export CLOUDFLARE_API_KEY=14758f1afd44c09b7992073ccf00b43d

Build a Fedora CoreOS hcloud image with Packer and embed the hcloud user data source (https://169.254.169.254/hetzner/v1/userdata).

make hcloud_image

make infrastructure BOOTSTRAP=true

make wait_bootstrap

make infrastructure

make wait_completion

CSRs of the master nodes get signed by the bootstrap node automaticaly during the cluster bootstrap. CSRs from worker nodes must be signed manually.