hetzner-k3s 0.3.9 → 0.4.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9c3b95ba8775783388acc881cbffd928c3fb00d92b6e6a5369b2bbd47f163aae
-  data.tar.gz: 495ea16d040b3808cb069ef6b03cec04bd7e6dd8f3fe7e623e7e49a1e3dc6eb3
+  metadata.gz: c3e7bedd3a695b38522a25598d9d0523bee9e5120aea6e76c462ba91dc8f3f12
+  data.tar.gz: d54f24ebe59f8b0354c74fdacff6f747169b288eddb99f070456f147523a07b4
 SHA512:
-  metadata.gz: 01a31eca33e328550f1583ff036c9002f8deb784bb76e0cb1e01df0677be9d678bfae1f619354bdb538ced6ba3a95bb5f03180429536c245e822372b452e82a7
-  data.tar.gz: aa92fef9440c4e85afe30bbecb86091f44d0cd693c71b44b141432199f1c710488f6b7dfbf0dd59658d8a9d341414c5c75ea5d162cff12b10949f22cd0ef1cda
+  metadata.gz: 36c460db4001ba080ef27dec517c4c44ce853a75935fee7d0fc5e4a13d689a5e812d762ec842a22503ac07d555a24be545293db9bb838ddcb7d27cd1866d9a1e
+  data.tar.gz: 2e8f67ca3c74292b7ad3c3a2098b1a4c8d096b1cb01677e8cc94ae199ee4b0df25eb869d2400b32451da6475a7518c7265cd1b70ec6bb0090e25b76047a03e4e

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    hetzner-k3s (0.3.9)
+    hetzner-k3s (0.4.0)
       bcrypt_pbkdf
       ed25519
       http

data/README.md

@@ -25,7 +25,7 @@ All that is needed to use this tool is
 
 ## Installation
 
-Once you have the Ruby runtime up and running, you just need to install the gem:
+Once you have the Ruby runtime up and running (2.7.2 or newer in the 2.7 series is recommended at this stage), you just need to install the gem:
 
 ```bash
 gem install hetzner-k3s
@@ -38,7 +38,7 @@ This will install the `hetzner-k3s` executable in your PATH.
 Alternatively, if you don't want to set up a Ruby runtime but have Docker installed, you can use a container. Run the following from inside the directory where you have the config file for the cluster (described in the next section):
 
 ```bash
-docker run --rm -it -v ${PWD}:/cluster -v ${HOME}/.ssh:/tmp/.ssh vitobotta/hetzner-k3s:v0.3.8 create-cluster --config-file /cluster/test.yaml
+docker run --rm -it -v ${PWD}:/cluster -v ${HOME}/.ssh:/tmp/.ssh vitobotta/hetzner-k3s:v0.4.2 create-cluster --config-file /cluster/test.yaml
 ```
 
 Replace `test.yaml` with the name of your config file.
@@ -53,9 +53,13 @@ hetzner_token: <your token>
 cluster_name: test
 kubeconfig_path: "./kubeconfig"
 k3s_version: v1.21.3+k3s1
-ssh_key_path: "~/.ssh/id_rsa.pub"
+public_ssh_key_path: "~/.ssh/id_rsa.pub"
+private_ssh_key_path: "~/.ssh/id_rsa"
+ssh_allowed_networks:
+  - 0.0.0.0/0
 verify_host_key: false
 location: nbg1
+schedule_workloads_on_masters: false
 masters:
   instance_type: cpx21
   instance_count: 3
@@ -72,7 +76,9 @@ It should hopefully be self explanatory; you can run `hetzner-k3s releases` to s
 
 If you are using Docker, then set `kubeconfig_path` to `/cluster/kubeconfig` so that the kubeconfig is created in the same directory where your config file is.
 
-**Important**: The tool assignes the label `cluster` to each server it creates, with the clsuter name you specify in the config file, as the value. So please ensure you don't create unrelated servers in the same project having
+If you don't want to specify the Hetzner token in the config file (for example if you want to use the tool with CI), then you can use the `HCLOUD_TOKEN` environment variable instead, which has predecence.
+
+**Important**: The tool assignes the label `cluster` to each server it creates, with the cluster name you specify in the config file, as the value. So please ensure you don't create unrelated servers in the same project having
 the label `cluster=<cluster name>`, because otherwise they will be deleted if you delete the cluster. I recommend you create a separate Hetzner project for each cluster, see note at the end of this README for more details.
 
 
@@ -235,6 +241,27 @@ I recommend that you create a separate Hetzner project for each cluster, because
 
 ## changelog
 
+- 0.4.3
+  - Fix an issue with SSH key creation
+
+- 0.4.2
+  - Update Hetzner CSI driver to v1.6.0
+  - Update System Upgrade Controller to v0.8.0
+
+- 0.4.1
+  - Allow to optionally specify the path of the private SSH key
+  - Set correct permissions for the kubeconfig file
+  - Retry fetching manifests a few times to allow for temporary network issues
+  - Allow to optionally schedule workloads on masters
+  - Allow clusters with no worker node pools if scheduling is enabled for the masters
+
+- 0.4.0
+  - Ensure the masters are removed from the API load balancer before deleting the load balancer
+  - Ensure the servers are removed from the firewall before deleting it
+  - Allow using an environment variable to specify the Hetzner token
+  - Allow restricting SSH access to the nodes to specific networks
+  - Do not open the port 6443 on the nodes if a load balancer is created for an HA cluster
+
 - 0.3.9
   - Add command "version" to print the version of the tool in use
 

data/bin/build.sh

@@ -0,0 +1,14 @@
+#!/bin/bash
+
+set -e
+
+
+
+IMAGE="vitobotta/hetzner-k3s"
+
+docker build -t ${IMAGE}:v0.4.3 \
+  --platform=linux/amd64 \
+  --cache-from ${IMAGE}:v0.4.2 \
+  --build-arg BUILDKIT_INLINE_CACHE=1 .
+
+docker push vitobotta/hetzner-k3s:v0.4.2

data/lib/hetzner/infra/firewall.rb

@@ -5,7 +5,9 @@ module Hetzner
       @cluster_name = cluster_name
     end
 
-    def create
+    def create(ha:, networks:)
+      @ha = ha
+      @networks = networks
       puts
 
       if firewall = find_firewall
@@ -16,16 +18,21 @@ module Hetzner
 
       puts "Creating firewall..."
 
-      response = hetzner_client.post("/firewalls", firewall_config).body
+      response = hetzner_client.post("/firewalls", create_firewall_config).body
       puts "...firewall created."
       puts
 
       JSON.parse(response)["firewall"]["id"]
     end
 
-    def delete
+    def delete(servers)
       if firewall = find_firewall
         puts "Deleting firewall..."
+
+        servers.each do |server|
+          hetzner_client.post("/firewalls/#{firewall["id"]}/actions/remove_from_resources", remove_targets_config(server["id"]))
+        end
+
         hetzner_client.delete("/firewalls", firewall["id"])
         puts "...firewall deleted."
       else
@@ -37,64 +44,79 @@ module Hetzner
 
     private
 
-      attr_reader :hetzner_client, :cluster_name, :firewall
+      attr_reader :hetzner_client, :cluster_name, :firewall, :ha, :networks
+
+      def create_firewall_config
+        rules = [
+          {
+            "description": "Allow port 22 (SSH)",
+            "direction": "in",
+            "protocol": "tcp",
+            "port": "22",
+            "source_ips": networks,
+            "destination_ips": []
+          },
+          {
+            "description": "Allow ICMP (ping)",
+            "direction": "in",
+            "protocol": "icmp",
+            "port": nil,
+            "source_ips": [
+              "0.0.0.0/0",
+              "::/0"
+            ],
+            "destination_ips": []
+          },
+          {
+            "description": "Allow all TCP traffic between nodes on the private network",
+            "direction": "in",
+            "protocol": "tcp",
+            "port": "any",
+            "source_ips": [
+              "10.0.0.0/16"
+            ],
+            "destination_ips": []
+          },
+          {
+            "description": "Allow all UDP traffic between nodes on the private network",
+            "direction": "in",
+            "protocol": "udp",
+            "port": "any",
+            "source_ips": [
+              "10.0.0.0/16"
+            ],
+            "destination_ips": []
+          }
+        ]
+
+        unless ha
+          rules << {
+            "description": "Allow port 6443 (Kubernetes API server)",
+            "direction": "in",
+            "protocol": "tcp",
+            "port": "6443",
+            "source_ips": [
+              "0.0.0.0/0",
+              "::/0"
+            ],
+            "destination_ips": []
+          }
+        end
 
-      def firewall_config
         {
           name: cluster_name,
-          rules: [
-            {
-              "description": "Allow port 22 (SSH)",
-              "direction": "in",
-              "protocol": "tcp",
-              "port": "22",
-              "source_ips": [
-                "0.0.0.0/0",
-                "::/0"
-              ],
-              "destination_ips": []
-            },
-            {
-              "description": "Allow ICMP (ping)",
-              "direction": "in",
-              "protocol": "icmp",
-              "port": nil,
-              "source_ips": [
-                "0.0.0.0/0",
-                "::/0"
-              ],
-              "destination_ips": []
-            },
-            {
-              "description": "Allow port 6443 (Kubernetes API server)",
-              "direction": "in",
-              "protocol": "tcp",
-              "port": "6443",
-              "source_ips": [
-                "0.0.0.0/0",
-                "::/0"
-              ],
-              "destination_ips": []
-            },
-            {
-              "description": "Allow all TCP traffic between nodes on the private network",
-              "direction": "in",
-              "protocol": "tcp",
-              "port": "any",
-              "source_ips": [
-                "10.0.0.0/16"
-              ],
-              "destination_ips": []
-            },
+          rules: rules
+        }
+      end
+
+      def remove_targets_config(server_id)
+        {
+          "remove_from": [
             {
-              "description": "Allow all UDP traffic between nodes on the private network",
-              "direction": "in",
-              "protocol": "udp",
-              "port": "any",
-              "source_ips": [
-                "10.0.0.0/16"
-              ],
-              "destination_ips": []
+              "server": {
+                "id": server_id
+              },
+              "type": "server"
             }
           ]
         }

data/lib/hetzner/infra/load_balancer.rb

@@ -19,7 +19,7 @@ module Hetzner
 
       puts "Creating API load_balancer..."
 
-      response = hetzner_client.post("/load_balancers", load_balancer_config).body
+      response = hetzner_client.post("/load_balancers", create_load_balancer_config).body
       puts "...API load balancer created."
       puts
 
@@ -29,6 +29,9 @@ module Hetzner
     def delete(ha:)
       if load_balancer = find_load_balancer
         puts "Deleting API load balancer..." unless ha
+
+        hetzner_client.post("/load_balancers/#{load_balancer["id"]}/actions/remove_target", remove_targets_config)
+
         hetzner_client.delete("/load_balancers", load_balancer["id"])
         puts "...API load balancer deleted." unless ha
       elsif ha
@@ -46,7 +49,7 @@ module Hetzner
         "#{cluster_name}-api"
       end
 
-      def load_balancer_config
+      def create_load_balancer_config
         {
           "algorithm": {
             "type": "round_robin"
@@ -76,6 +79,15 @@ module Hetzner
         }
       end
 
+      def remove_targets_config
+        {
+          "label_selector": {
+            "selector": "cluster=#{cluster_name},role=master"
+          },
+          "type": "label_selector"
+        }
+      end
+
       def find_load_balancer
         hetzner_client.get("/load_balancers")["load_balancers"].detect{ |load_balancer| load_balancer["name"] == load_balancer_name }
       end

data/lib/hetzner/infra/ssh_key.rb

@@ -5,15 +5,15 @@ module Hetzner
       @cluster_name = cluster_name
     end
 
-    def create(ssh_key_path:)
-      @ssh_key_path = ssh_key_path
+    def create(public_ssh_key_path:)
+      @public_ssh_key_path = public_ssh_key_path
 
       puts
 
-      if ssh_key = find_ssh_key
+      if (public_ssh_key = find_public_ssh_key)
         puts "SSH key already exists, skipping."
         puts
-        return ssh_key["id"]
+        return public_ssh_key["id"]
       end
 
       puts "Creating SSH key..."
@@ -26,13 +26,13 @@ module Hetzner
       JSON.parse(response)["ssh_key"]["id"]
     end
 
-    def delete(ssh_key_path:)
-      @ssh_key_path = ssh_key_path
+    def delete(public_ssh_key_path:)
+      @public_ssh_key_path = public_ssh_key_path
 
-      if ssh_key = find_ssh_key
-        if ssh_key["name"] == cluster_name
+      if (public_ssh_key = find_public_ssh_key)
+        if public_ssh_key["name"] == cluster_name
           puts "Deleting ssh_key..."
-          hetzner_client.delete("/ssh_keys", ssh_key["id"])
+          hetzner_client.delete("/ssh_keys", public_ssh_key["id"])
           puts "...ssh_key deleted."
         else
           puts "The SSH key existed before creating the cluster, so I won't delete it."
@@ -46,24 +46,24 @@ module Hetzner
 
     private
 
-      attr_reader :hetzner_client, :cluster_name, :ssh_key_path
+      attr_reader :hetzner_client, :cluster_name, :public_ssh_key_path
 
-      def public_key
-        @public_key ||= File.read(ssh_key_path).chop
+      def public_ssh_key
+        @public_ssh_key ||= File.read(public_ssh_key_path).chop
       end
 
       def ssh_key_config
         {
           name: cluster_name,
-          public_key: public_key
+          public_key: public_ssh_key
         }
       end
 
       def fingerprint
-        @fingerprint ||= ::SSHKey.fingerprint(public_key)
+        @fingerprint ||= ::SSHKey.fingerprint(public_ssh_key)
       end
 
-      def find_ssh_key
+      def find_public_ssh_key
         key = hetzner_client.get("/ssh_keys")["ssh_keys"].detect do |ssh_key|
           ssh_key["fingerprint"] == fingerprint
         end

data/lib/hetzner/k3s/cli.rb

@@ -1,6 +1,8 @@
 require "thor"
 require "http"
 require "sshkey"
+require 'ipaddr'
+require 'open-uri'
 
 require_relative "cluster"
 require_relative "version"
@@ -23,7 +25,7 @@ module Hetzner
       def create_cluster
         validate_config_file :create
 
-        Cluster.new(hetzner_client: hetzner_client).create configuration: configuration
+        Cluster.new(hetzner_client: hetzner_client, hetzner_token: find_hetzner_token).create configuration: configuration
       end
 
       desc "delete-cluster", "Delete an existing k3s cluster in Hetzner Cloud"
@@ -31,7 +33,7 @@ module Hetzner
 
       def delete_cluster
         validate_config_file :delete
-        Cluster.new(hetzner_client: hetzner_client).delete configuration: configuration
+        Cluster.new(hetzner_client: hetzner_client, hetzner_token: find_hetzner_token).delete configuration: configuration
       end
 
       desc "upgrade-cluster", "Upgrade an existing k3s cluster in Hetzner Cloud to a new version"
@@ -41,7 +43,7 @@ module Hetzner
 
       def upgrade_cluster
         validate_config_file :upgrade
-        Cluster.new(hetzner_client: hetzner_client).upgrade configuration: configuration, new_k3s_version: options[:new_k3s_version], config_file: options[:config_file]
+        Cluster.new(hetzner_client: hetzner_client, hetzner_token: find_hetzner_token).upgrade configuration: configuration, new_k3s_version: options[:new_k3s_version], config_file: options[:config_file]
       end
 
       desc "releases", "List available k3s releases"
@@ -81,7 +83,9 @@ module Hetzner
 
           case action
           when :create
-            validate_ssh_key
+            validate_public_ssh_key
+            validate_private_ssh_key
+            validate_ssh_allowed_networks
             validate_location
             validate_k3s_version
             validate_masters
@@ -107,12 +111,26 @@ module Hetzner
           end
         end
 
+        def valid_token?
+          return @valid unless @valid.nil?
+
+          begin
+            token = find_hetzner_token
+            @hetzner_client = Hetzner::Client.new(token: token)
+            response = hetzner_client.get("/locations")
+            error_code = response.dig("error", "code")
+            @valid = if error_code and error_code.size > 0
+              false
+            else
+              true
+            end
+          rescue
+            @valid = false
+          end
+        end
+
         def validate_token
-          token = configuration.dig("hetzner_token")
-          @hetzner_client = Hetzner::Client.new(token: token)
-          hetzner_client.get("/locations")
-        rescue
-          errors << "Invalid Hetzner Cloid token"
+          errors << "Invalid Hetzner Cloud token" unless valid_token?
         end
 
         def validate_cluster_name
@@ -130,16 +148,25 @@ module Hetzner
           errors << "Invalid path for the kubeconfig"
         end
 
-        def validate_ssh_key
-          path = File.expand_path(configuration.dig("ssh_key_path"))
+        def validate_public_ssh_key
+          path = File.expand_path(configuration.dig("public_ssh_key_path"))
           errors << "Invalid Public SSH key path" and return unless File.exists? path
 
           key = File.read(path)
-          errors << "Public SSH key is invalid" unless ::SSHKey.valid_ssh_public_key? key
+          errors << "Public SSH key is invalid" unless ::SSHKey.valid_ssh_public_key?(key)
         rescue
           errors << "Invalid Public SSH key path"
         end
 
+        def validate_private_ssh_key
+          return unless (private_ssh_key_path = configuration.dig("private_ssh_key_path"))
+
+          path = File.expand_path(private_ssh_key_path)
+          errors << "Invalid Private SSH key path" and return unless File.exists?(path)
+        rescue
+          errors << "Invalid Private SSH key path"
+        end
+
         def validate_kubeconfig_path_must_exist
           path = File.expand_path configuration.dig("kubeconfig_path")
           errors << "kubeconfig path is invalid" and return unless File.exists? path
@@ -149,6 +176,7 @@ module Hetzner
         end
 
         def server_types
+          return [] unless valid_token?
           @server_types ||= hetzner_client.get("/server_types")["server_types"].map{ |server_type| server_type["name"] }
         rescue
           @errors << "Cannot fetch server types with Hetzner API, please try again later"
@@ -156,13 +184,15 @@ module Hetzner
         end
 
         def locations
+          return [] unless valid_token?
           @locations ||= hetzner_client.get("/locations")["locations"].map{ |location| location["name"] }
         rescue
           @errors << "Cannot fetch locations with Hetzner API, please try again later"
-          false
+          []
         end
 
         def validate_location
+          return if locations.empty? && !valid_token?
           errors << "Invalid location - available locations: nbg1 (Nuremberg, Germany), fsn1 (Falkenstein, Germany), hel1 (Helsinki, Finland)" unless locations.include? configuration.dig("location")
         end
 
@@ -211,14 +241,22 @@ module Hetzner
           begin
             worker_node_pools = configuration.dig("worker_node_pools")
           rescue
-            errors << "Invalid node pools configuration"
+            unless schedule_workloads_on_masters?
+              errors << "Invalid node pools configuration"
+              return
+            end
+          end
+
+          if worker_node_pools.nil? && schedule_workloads_on_masters?
             return
           end
 
           if !worker_node_pools.is_a? Array
             errors << "Invalid node pools configuration"
           elsif worker_node_pools.size == 0
-            errors << "At least one node pool is required in order to schedule workloads"
+            unless schedule_workloads_on_masters?
+              errors << "At least one node pool is required in order to schedule workloads"
+            end
           elsif worker_node_pools.map{ |worker_node_pool| worker_node_pool["name"]}.uniq.size != worker_node_pools.size
             errors << "Each node pool must have an unique name"
           elsif server_types
@@ -228,6 +266,11 @@ module Hetzner
           end
         end
 
+        def schedule_workloads_on_masters?
+          schedule_workloads_on_masters = configuration.dig("schedule_workloads_on_masters")
+          schedule_workloads_on_masters ? !!schedule_workloads_on_masters : false
+        end
+
         def validate_new_k3s_version_must_be_more_recent
           return if options[:force] == "true"
           return unless kubernetes_client
@@ -271,7 +314,7 @@ module Hetzner
             instance_group_errors << "#{instance_group_type} is in an invalid format"
           end
 
-          unless server_types.include?(instance_group["instance_type"])
+          unless !valid_token? or server_types.include?(instance_group["instance_type"])
             instance_group_errors << "#{instance_group_type} has an invalid instance type"
           end
 
@@ -301,11 +344,58 @@ module Hetzner
           false
         end
 
-
         def validate_verify_host_key
-          return unless [true, false].include?(configuration.fetch("ssh_key_path", false))
+          return unless [true, false].include?(configuration.fetch("public_ssh_key_path", false))
           errors << "Please set the verify_host_key option to either true or false"
         end
+
+        def find_hetzner_token
+          @token = ENV["HCLOUD_TOKEN"]
+          return @token if @token
+          @token = configuration.dig("hetzner_token")
+        end
+
+        def validate_ssh_allowed_networks
+          networks ||= configuration.dig("ssh_allowed_networks")
+
+          if networks.nil? or networks.empty?
+            errors << "At least one network/IP range must be specified for SSH access"
+            return
+          end
+
+          invalid_networks = networks.reject do |network|
+            IPAddr.new(network) rescue false
+          end
+
+          unless invalid_networks.empty?
+            invalid_networks.each do |network|
+              errors << "The network #{network} is an invalid range"
+            end
+          end
+
+          invalid_ranges = networks.reject do |network|
+            network.include? "/"
+          end
+
+          unless invalid_ranges.empty?
+            invalid_ranges.each do |network|
+              errors << "Please use the CIDR notation for the networks to avoid ambiguity"
+            end
+          end
+
+          return unless invalid_networks.empty?
+
+          current_ip = URI.open('http://whatismyip.akamai.com').read
+
+          current_ip_networks = networks.detect do |network|
+            IPAddr.new(network).include?(current_ip) rescue false
+          end
+
+          unless current_ip_networks
+            errors << "Your current IP #{current_ip} is not included into any of the networks you've specified, so we won't be able to SSH into the nodes"
+          end
+        end
+
     end
   end
 end

data/lib/hetzner/k3s/cluster.rb

@@ -16,21 +16,25 @@ require_relative "../k3s/client_patch"
 
 
 class Cluster
-  def initialize(hetzner_client:)
+  def initialize(hetzner_client:, hetzner_token:)
     @hetzner_client = hetzner_client
+    @hetzner_token = hetzner_token
   end
 
   def create(configuration:)
-    @hetzner_token = configuration.dig("hetzner_token")
+    @configuration = configuration
     @cluster_name = configuration.dig("cluster_name")
     @kubeconfig_path = File.expand_path(configuration.dig("kubeconfig_path"))
-    @ssh_key_path = File.expand_path(configuration.dig("ssh_key_path"))
+    @public_ssh_key_path = File.expand_path(configuration.dig("public_ssh_key_path"))
+    private_ssh_key_path = configuration.dig("private_ssh_key_path")
+    @private_ssh_key_path = File.expand_path(private_ssh_key_path) if private_ssh_key_path
     @k3s_version = configuration.dig("k3s_version")
     @masters_config = configuration.dig("masters")
-    @worker_node_pools = configuration.dig("worker_node_pools")
+    @worker_node_pools = find_worker_node_pools(configuration)
     @location = configuration.dig("location")
     @verify_host_key = configuration.fetch("verify_host_key", false)
     @servers = []
+    @networks = configuration.dig("ssh_allowed_networks")
 
     create_resources
 
@@ -46,7 +50,7 @@ class Cluster
   def delete(configuration:)
     @cluster_name = configuration.dig("cluster_name")
     @kubeconfig_path = File.expand_path(configuration.dig("kubeconfig_path"))
-    @ssh_key_path = File.expand_path(configuration.dig("ssh_key_path"))
+    @public_ssh_key_path = File.expand_path(configuration.dig("public_ssh_key_path"))
 
     delete_resources
   end
@@ -63,13 +67,17 @@ class Cluster
 
   private
 
+    def find_worker_node_pools(configuration)
+      configuration.fetch("worker_node_pools", [])
+    end
+
     attr_accessor :servers
 
     attr_reader :hetzner_client, :cluster_name, :kubeconfig_path, :k3s_version,
                 :masters_config, :worker_node_pools,
-                :location, :ssh_key_path, :kubernetes_client,
+                :location, :public_ssh_key_path, :kubernetes_client,
                 :hetzner_token, :tls_sans, :new_k3s_version, :configuration,
-                :config_file, :verify_host_key
+                :config_file, :verify_host_key, :networks, :private_ssh_key_path, :configuration
 
 
     def latest_k3s_version
@@ -78,10 +86,13 @@ class Cluster
     end
 
     def create_resources
+      master_instance_type = masters_config["instance_type"]
+      masters_count = masters_config["instance_count"]
+
       firewall_id = Hetzner::Firewall.new(
         hetzner_client: hetzner_client,
         cluster_name: cluster_name
-      ).create
+      ).create(ha: (masters_count > 1), networks: networks)
 
       network_id = Hetzner::Network.new(
         hetzner_client: hetzner_client,
@@ -91,13 +102,10 @@ class Cluster
       ssh_key_id = Hetzner::SSHKey.new(
         hetzner_client: hetzner_client,
         cluster_name: cluster_name
-      ).create(ssh_key_path: ssh_key_path)
+      ).create(public_ssh_key_path: public_ssh_key_path)
 
       server_configs = []
 
-      master_instance_type = masters_config["instance_type"]
-      masters_count = masters_config["instance_count"]
-
       masters_count.times do |i|
         server_configs << {
           location: location,
@@ -150,42 +158,15 @@ class Cluster
     end
 
     def delete_resources
-      # Deleting nodes defined according to Kubernetes first
-      begin
-        Timeout::timeout(5) do
-          servers = kubernetes_client.api("v1").resource("nodes").list
-
-          threads = servers.map do |node|
-            Thread.new do
-              Hetzner::Server.new(hetzner_client: hetzner_client, cluster_name: cluster_name).delete(server_name: node.metadata[:name])
-            end
-          end
-
-          threads.each(&:join) unless threads.empty?
-        end
-      rescue Timeout::Error, Excon::Error::Socket
-        puts "Unable to fetch nodes from Kubernetes API. Is the cluster online?"
-      end
-
-      # Deleting nodes defined in the config file just in case there are leftovers i.e. nodes that
-      # were not part of the cluster for some reason
-
-      threads = all_servers.map do |server|
-        Thread.new do
-          Hetzner::Server.new(hetzner_client: hetzner_client, cluster_name: cluster_name).delete(server_name: server["name"])
-        end
-      end
-
-      threads.each(&:join) unless threads.empty?
-
-      puts
-
-      sleep 5 # give time for the servers to actually be deleted
+      Hetzner::LoadBalancer.new(
+        hetzner_client: hetzner_client,
+        cluster_name: cluster_name
+      ).delete(ha: (masters.size > 1))
 
       Hetzner::Firewall.new(
         hetzner_client: hetzner_client,
         cluster_name: cluster_name
-      ).delete
+      ).delete(all_servers)
 
       Hetzner::Network.new(
         hetzner_client: hetzner_client,
@@ -195,13 +176,15 @@ class Cluster
       Hetzner::SSHKey.new(
         hetzner_client: hetzner_client,
         cluster_name: cluster_name
-      ).delete(ssh_key_path: ssh_key_path)
+      ).delete(public_ssh_key_path: public_ssh_key_path)
 
-      Hetzner::LoadBalancer.new(
-        hetzner_client: hetzner_client,
-        cluster_name: cluster_name
-      ).delete(ha: (masters.size > 1))
+      threads = all_servers.map do |server|
+        Thread.new do
+          Hetzner::Server.new(hetzner_client: hetzner_client, cluster_name: cluster_name).delete(server_name: server["name"])
+        end
+      end
 
+      threads.each(&:join) unless threads.empty?
     end
 
     def upgrade_cluster
@@ -231,6 +214,8 @@ class Cluster
       server = master == first_master ? " --cluster-init " : " --server https://#{first_master_private_ip}:6443 "
       flannel_interface = find_flannel_interface(master)
 
+      taint = schedule_workloads_on_masters? ? " " : " --node-taint CriticalAddonsOnly=true:NoExecute "
+
       <<~EOF
       curl -sfL https://get.k3s.io | INSTALL_K3S_VERSION="#{k3s_version}" K3S_TOKEN="#{k3s_token}" INSTALL_K3S_EXEC="server \
         --disable-cloud-controller \
@@ -247,8 +232,9 @@ class Cluster
         --kube-proxy-arg="metrics-bind-address=0.0.0.0" \
         --kube-scheduler-arg="address=0.0.0.0" \
         --kube-scheduler-arg="bind-address=0.0.0.0" \
-        --node-taint CriticalAddonsOnly=true:NoExecute \
+        #{taint} \
         --kubelet-arg="cloud-provider=external" \
+        --advertise-address=$(hostname -I | awk '{print $2}') \
         --node-ip=$(hostname -I | awk '{print $2}') \
         --node-external-ip=$(hostname -I | awk '{print $1}') \
         --flannel-iface=#{flannel_interface} \
@@ -336,7 +322,7 @@ class Cluster
       end
 
 
-      manifest = HTTP.follow.get("https://github.com/hetznercloud/hcloud-cloud-controller-manager/releases/latest/download/ccm-networks.yaml").body
+      manifest = fetch_manifest("https://github.com/hetznercloud/hcloud-cloud-controller-manager/releases/latest/download/ccm-networks.yaml")
 
       File.write("/tmp/cloud-controller-manager.yaml", manifest)
 
@@ -361,11 +347,18 @@ class Cluster
       retry
     end
 
+    def fetch_manifest(url)
+      retries ||= 1
+      HTTP.follow.get(url).body
+    rescue
+      retry if (retries += 1) <= 10
+    end
+
     def deploy_system_upgrade_controller
       puts
       puts "Deploying k3s System Upgrade Controller..."
 
-      manifest = HTTP.follow.get("https://github.com/rancher/system-upgrade-controller/releases/download/v0.7.3/system-upgrade-controller.yaml").body
+      manifest = HTTP.follow.get("https://github.com/rancher/system-upgrade-controller/releases/download/v0.8.0/system-upgrade-controller.yaml").body
 
       File.write("/tmp/system-upgrade-controller.yaml", manifest)
 
@@ -414,7 +407,7 @@ class Cluster
       end
 
 
-      manifest = HTTP.follow.get("https://raw.githubusercontent.com/hetznercloud/csi-driver/v1.5.3/deploy/kubernetes/hcloud-csi.yml").body
+      manifest = HTTP.follow.get("https://raw.githubusercontent.com/hetznercloud/csi-driver/v1.6.0/deploy/kubernetes/hcloud-csi.yml").body
 
       File.write("/tmp/csi-driver.yaml", manifest)
 
@@ -465,7 +458,13 @@ class Cluster
       public_ip = server.dig("public_net", "ipv4", "ip")
       output = ""
 
-      Net::SSH.start(public_ip, "root", verify_host_key: (verify_host_key ? :always : :never)) do |session|
+      params = { verify_host_key: (verify_host_key ? :always : :never) }
+
+      if private_ssh_key_path
+        params[:keys] = [private_ssh_key_path]
+      end
+
+      Net::SSH.start(public_ip, "root", params) do |session|
         session.exec!(command) do |channel, stream, data|
           output << data
           puts data if print_output
@@ -476,6 +475,10 @@ class Cluster
       retry unless e.message =~ /Too many authentication failures/
     rescue Net::SSH::ConnectionTimeout, Errno::ECONNREFUSED, Errno::ENETUNREACH, Errno::EHOSTUNREACH
       retry
+    rescue Net::SSH::AuthenticationFailed
+      puts
+      puts "Cannot continue: SSH authentication failed. Please ensure that the private SSH key is correct."
+      exit 1
     rescue Net::SSH::HostKeyMismatch
       puts
       puts "Cannot continue: Unable to SSH into server with IP #{public_ip} because the existing fingerprint in the known_hosts file does not match that of the actual host key."
@@ -565,6 +568,8 @@ class Cluster
         gsub("default", cluster_name)
 
       File.write(kubeconfig_path, kubeconfig)
+
+      FileUtils.chmod "go-r", kubeconfig_path
     end
 
     def ugrade_plan_manifest_path
@@ -628,4 +633,9 @@ class Cluster
       server.dig("labels", "cluster") == cluster_name
     end
 
+    def schedule_workloads_on_masters?
+      schedule_workloads_on_masters = configuration.dig("schedule_workloads_on_masters")
+      schedule_workloads_on_masters ? !!schedule_workloads_on_masters : false
+    end
+
 end

data/lib/hetzner/k3s/version.rb

@@ -1,5 +1,5 @@
 module Hetzner
   module K3s
-    VERSION = "0.3.9"
+    VERSION = "0.4.3"
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: hetzner-k3s
 version: !ruby/object:Gem::Version
-  version: 0.3.9
+  version: 0.4.3
 platform: ruby
 authors:
 - Vito Botta
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2021-08-20 00:00:00.000000000 Z
+date: 2021-10-17 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: thor
@@ -127,6 +127,7 @@ files:
 - LICENSE.txt
 - README.md
 - Rakefile
+- bin/build.sh
 - bin/console
 - bin/setup
 - cluster_config.yaml.example