Scripts to install Kubernetes on Hetzner Cloud using Talos Linux

Components

• Hetzner Cloud virtual servers, loadbalancers, storage volumes
• Talos Linux secure, immutable, and minimal
• Kubernetes container orchestrator
• Rancher enterprise Kubernetes management, dashboard
• Traefik ingress controller
• Cert-Manager manage Let's Encrypt certificates
• Mayastor container attached storage (optional)

Requirements

• A local console, for example iTerm or SSH to a Linux shell
• Either:
  • macOS with Homebrew,
  • A Debian Linux variant like Ubuntu or
  • Install tools checked on the bottom of 0_tools.sh manually
• An Hetzner account
• In the Hetzner Cloud Console create a Project
• In the Project create an API token using Security (left sidebar) => API tokens
  • Description: CLI (doesn't matter)
  • Permissions: Read & Write
  • Save the token in a safe place, it will be asked later with prompt Token:

Usage

Clone project

Clone this project and go to the directory

git  clone  https://github.com/jeroenvermeulen/hetzner-talos-k8s-rancher.git
cd  hetzner-talos-k8s-rancher

Create config

Copy the example config and update it in your favorite editor

cp  CONFIG.sh.example  CONFIG.sh
nano  CONFIG.sh

Make sure you update at least RANCHER_HOSTNAME

Execute scripts one by one

Install and check required CLI tools

./0_tools.sh

Create a disk image at Hetzner containing Talos Linux

./1_hcloud_disk_image.sh

Start the Kubernetes cluster

./2_cluster.sh

Install Traefik ingress and Cert-Manager Letsencrypt

./3_services.sh

Install Rancher

./4_rancher.sh

If everything works well the last script will display the Rancher URL.

Debug Commands

Set the context for hcloud, talosctl and kubectl:

source ./env.sh

Get cluster members

talosctl get members

Check state of services:

talosctl services --nodes 111.22.33.44

Check logs of a service:

talosctl logs etcd --nodes 111.22.33.44

If the loadbalancer is not working correctly you can add --endpoint 111.22.33.44 with the node IP to connect to port 50000 (Talos API) of the node directly instead of through the loadbalancer.