Skip to content
Kubernetes cluster provisioning using Terraform.
HCL Shell
Branch: master
Clone or download
Fetching latest commit…
Cannot retrieve the latest commit at this time.


Type Name Latest commit message Commit time
Failed to load latest commit information.
security fix scaleway sudo quirk Sep 22, 2019

Kubernetes cluster setup automation

This is part of the Hobby Kube project. Functionality of the modules is described in the guide.

Deploy a secure Kubernetes cluster on Hetzner Cloud, Scaleway, DigitalOcean or Packet using Terraform.



The following packages are required to be installed locally:

brew install terraform kubectl jq wireguard-tools

Modules are using ssh-agent for remote operations. Add your SSH key with ssh-add -K if Terraform repeatedly fails to connect to remote hosts.


Important: Modify only in project root, comment or uncomment sections as needed. All variables in can be set either directly or from environment variable.

Export the following environment variables depending on the modules you're using:

Set number of hosts (nodes)

export TF_VAR_node_count=3

Set number of etcd members

The first N nodes will be part of the etcd cluster. 3 or 5 are good values, see here.

export TF_VAR_etcd_node_count=3

Using Hetzner Cloud as provider

export TF_VAR_hcloud_token=<token>
export TF_VAR_hcloud_ssh_keys=<keys>
export TF_VAR_hcloud_ssh_keys='["<description-key1>", "<description-key2>"]'
# Defaults:
# export TF_VAR_hcloud_location="nbg1"
# export TF_VAR_hcloud_type="cx11"
# export TF_VAR_hcloud_image="ubuntu-18.04"

SSH keys are referenced by their description. Visit the Hetzner Cloud console at<project-id>/access/sshkeys

Using Scaleway as provider

export TF_VAR_scaleway_organization=<access_key>
export TF_VAR_scaleway_token=<token>
# Defaults:
# export TF_VAR_scaleway_region="ams1"
# export TF_VAR_scaleway_type="DEV1-S"
# export TF_VAR_scaleway_image="Ubuntu Bionic"

Using DigitalOcean as provider

export TF_VAR_digitalocean_token=<token>
export TF_VAR_digitalocean_ssh_keys=<keys>
export TF_VAR_digitalocean_ssh_keys='["<id-key1>", "<id-key2>"]'
# Defaults:
# export TF_VAR_digitalocean_region="fra1"
# export TF_VAR_digitalocean_size="1gb"
# export TF_VAR_digitalocean_image="ubuntu-18-04-x64"

You can get SSH key IDs using this API.

Using Packet as provider

export TF_VAR_packet_auth_token=<token>
export TF_VAR_packet_project_id=<uuid>
# Defaults:
# export TF_VAR_packet_facility="sjc1"
# export TF_VAR_packet_plan="c1.small.x86"
# export TF_VAR_packet_operating_system="ubuntu_18_04"

Using Cloudflare for DNS entries

export TF_VAR_domain=<domain> # e.g.
export TF_VAR_cloudflare_email=<email>
export TF_VAR_cloudflare_api_token=<token>

Using Amazon Route 53 for DNS entries

export TF_VAR_domain=<domain> # e.g. shall be already added to hosted zones.
export TF_VAR_aws_access_key=<ACCESS_KEY>
export TF_VAR_aws_secret_key=<SECRET_KEY>
export TF_VAR_aws_region=<region> # e.g. eu-west-1

Install additional APT packages

Each provider takes an optional variable to install further packages during provisioning:

module "provider" {
  # ...
  apt_packages = ["ceph-common", "nfs-common"]


From the root of this project...

# fetch the required modules
$ terraform init

# see what `terraform apply` will do
$ terraform plan

# execute it
$ terraform apply

Using modules independently

Modules in this repository can be used independently:

module "kubernetes" {
  source = ""

After adding this to your plan, run terraform get to fetch the module.

You can’t perform that action at this time.