From 30b099df80fc44f346c63bd0566d5cdc219e6d26 Mon Sep 17 00:00:00 2001
From: chris <cg@zknt.org>
Date: Sun, 29 May 2022 13:37:13 +0200
Subject: [PATCH] single node k8s

---
 .gitignore                                 |   1 +
 k8s-single-node/.terraform.lock.hcl        |  58 +++++++++++++++++++++
 k8s-single-node/README.md                  |   7 +++
 k8s-single-node/cluster.tf                 |  15 ++++++
 k8s-single-node/firewall.tf                |  33 ++++++++++++
 k8s-single-node/plan.out                   | Bin 0 -> 7315 bytes
 k8s-single-node/provider.tf                |   3 ++
 k8s-single-node/secret.auto.tfvars.example |   1 +
 k8s-single-node/server.tf                  |  32 ++++++++++++
 k8s-single-node/ssh.tf                     |   4 ++
 k8s-single-node/terraform.tf               |  18 +++++++
 k8s-single-node/user-data.yaml.tpl         |  18 +++++++
 k8s-single-node/variables.tf               |  28 ++++++++++
 13 files changed, 218 insertions(+)
 create mode 100644 k8s-single-node/.terraform.lock.hcl
 create mode 100644 k8s-single-node/README.md
 create mode 100644 k8s-single-node/cluster.tf
 create mode 100644 k8s-single-node/firewall.tf
 create mode 100644 k8s-single-node/plan.out
 create mode 100644 k8s-single-node/provider.tf
 create mode 100644 k8s-single-node/secret.auto.tfvars.example
 create mode 100644 k8s-single-node/server.tf
 create mode 100644 k8s-single-node/ssh.tf
 create mode 100644 k8s-single-node/terraform.tf
 create mode 100644 k8s-single-node/user-data.yaml.tpl
 create mode 100644 k8s-single-node/variables.tf

diff --git a/.gitignore b/.gitignore
index a0ab047..8444dc6 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,5 +1,6 @@
 .terraform/
 terraform.tfstate*
+.terraform.tfstate.lock.info
 api-token*
 ssh-terraform-hetzner*
 secret.auto.tfvars
diff --git a/k8s-single-node/.terraform.lock.hcl b/k8s-single-node/.terraform.lock.hcl
new file mode 100644
index 0000000..0abc444
--- /dev/null
+++ b/k8s-single-node/.terraform.lock.hcl
@@ -0,0 +1,58 @@
+# This file is maintained automatically by "terraform init".
+# Manual edits may be lost in future updates.
+
+provider "registry.terraform.io/hashicorp/local" {
+  version = "2.2.3"
+  hashes = [
+    "h1:aWp5iSUxBGgPv1UnV5yag9Pb0N+U1I0sZb38AXBFO8A=",
+    "zh:04f0978bb3e052707b8e82e46780c371ac1c66b689b4a23bbc2f58865ab7d5c0",
+    "zh:6484f1b3e9e3771eb7cc8e8bab8b35f939a55d550b3f4fb2ab141a24269ee6aa",
+    "zh:78a56d59a013cb0f7eb1c92815d6eb5cf07f8b5f0ae20b96d049e73db915b238",
+    "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3",
+    "zh:8aa9950f4c4db37239bcb62e19910c49e47043f6c8587e5b0396619923657797",
+    "zh:996beea85f9084a725ff0e6473a4594deb5266727c5f56e9c1c7c62ded6addbb",
+    "zh:9a7ef7a21f48fabfd145b2e2a4240ca57517ad155017e86a30860d7c0c109de3",
+    "zh:a63e70ac052aa25120113bcddd50c1f3cfe61f681a93a50cea5595a4b2cc3e1c",
+    "zh:a6e8d46f94108e049ad85dbed60354236dc0b9b5ec8eabe01c4580280a43d3b8",
+    "zh:bb112ce7efbfcfa0e65ed97fa245ef348e0fd5bfa5a7e4ab2091a9bd469f0a9e",
+    "zh:d7bec0da5c094c6955efed100f3fe22fca8866859f87c025be1760feb174d6d9",
+    "zh:fb9f271b72094d07cef8154cd3d50e9aa818a0ea39130bc193132ad7b23076fd",
+  ]
+}
+
+provider "registry.terraform.io/hetznercloud/hcloud" {
+  version     = "1.33.2"
+  constraints = "1.33.2"
+  hashes = [
+    "h1:3Hx8p9LbcnHfBhy3nT7+unlc5rwkiSZjLt9SVQOSpB8=",
+    "zh:0a5d0f332d7dfe77fa27301094af98a185aabfb9f56d71b81936e03211e4d66f",
+    "zh:0e047859ee7296f335881933ccf8ce8c07aa47bef56d5449a81b85a2d9dac93a",
+    "zh:1d3d0896f518df9e245c3207ed231e528f5dcfe628508e7c3ceba4a2bfefaa7a",
+    "zh:1d7a31c8c490512896ce327ab220e950f1a2e30ee83cc2e58e69bbbfbbb87e72",
+    "zh:67cbb2492683cb22f6c54f26bee72aec140c8dd2d0881b2815d2ef80959fc751",
+    "zh:771062815e662979204ac2dc91c34c893f27670d67e02370e48124483d3c9838",
+    "zh:957ebb146898cd059c0cc8b4c32e574b61041d8b6a11cd854b3cc1d3baaeb3a9",
+    "zh:95dbd8634000b979213cb97b5d869cad78299ac994d0665d150c8dafc1390429",
+    "zh:a21b22b2e9d835e1b8b3b7e0b41a4d199171d62e9e9be78c444c700e96b31316",
+    "zh:aead1ba50640a51f20d574374f2c6065d9bfa4eea5ef044d1475873c33e58239",
+    "zh:cefabd0a78af40ea5cd08e1ca436c753df9b1c6496eb27281b755a2de1f167ab",
+    "zh:d98cffc5206b9a7550a23e13031a6f53566bd1ed3bf65314bc55ef12404d49ce",
+    "zh:dddaaf95b6aba701153659feff12c7bce6acc78362cb5ff8321a1a1cbf780cd9",
+    "zh:fd662b483250326a1bfbe5684c22c5083955a43e0773347eea35cd4c2cfe700e",
+  ]
+}
+
+provider "registry.terraform.io/rancher/rke" {
+  version     = "1.3.0"
+  constraints = "1.3.0"
+  hashes = [
+    "h1:8Xz+agv4LCmYZsEMp0ByP3B9FilTH81pgpoVG4CdW1Q=",
+    "zh:192d29c7fdcf9ed18f0ad4cd4b3c4458483ec695bafdb9caf5c83d843625be3a",
+    "zh:50e9c6e5fccb1e43aa87117ee029cb5a9374babdf0c35d468543785013c51895",
+    "zh:76476e9bd450d0b9c34426c066241cecf2934f41d4088e633c4a511c56206abe",
+    "zh:90c09ce14887d7a20558d5d14072139c7c33d6440c80773dc53be18689534d8b",
+    "zh:b5781dbdcb05636e3ffd172de7691ce684fe8a336fec0a624504d13c345bbff3",
+    "zh:f3fce785a7d1f404f928a5ccdc4a1e2736c2f05fcc1f51f2c3d187f6a1344859",
+    "zh:f4ca9a812d9ea525e6f18b7b2701c61e6b1aa85974adea161f34c97ef76b1100",
+  ]
+}
diff --git a/k8s-single-node/README.md b/k8s-single-node/README.md
new file mode 100644
index 0000000..8340739
--- /dev/null
+++ b/k8s-single-node/README.md
@@ -0,0 +1,7 @@
+# Sets up a single node all-on-one k8s cluster
+
+* Make sure you have kubectl installed, choose a version fitting to your
+  desired k8s version, as defined in `variables.tf`
+* Copy secret.auto.tfvars.example to secret.auto.tfvars
+* Set up your API key in secret.auto.tfvars
+* `terraform init` && `terraform plan` && `terraform apply`
diff --git a/k8s-single-node/cluster.tf b/k8s-single-node/cluster.tf
new file mode 100644
index 0000000..6dc3f00
--- /dev/null
+++ b/k8s-single-node/cluster.tf
@@ -0,0 +1,15 @@
+resource "rke_cluster" "cluster" {
+  kubernetes_version = var.kubernetes_version
+  nodes {
+    # no proper IP support for rke, yet
+    address = hcloud_server.k8s-single.ipv4_address
+    user    = "ansible"
+    role    = ["controlplane", "worker", "etcd"]
+    ssh_key = "${file("../ssh-terraform-hetzner")}"
+  }
+}
+
+resource "local_sensitive_file" "kube_config" {
+  filename = "${path.root}/kube_config_single.yml"
+  content  = "${rke_cluster.cluster.kube_config_yaml}"
+}
diff --git a/k8s-single-node/firewall.tf b/k8s-single-node/firewall.tf
new file mode 100644
index 0000000..e826b00
--- /dev/null
+++ b/k8s-single-node/firewall.tf
@@ -0,0 +1,33 @@
+resource "hcloud_firewall" "k8s-single" {
+  name = "k8s-single"
+  rule {
+    direction = "in"
+    protocol  = "icmp"
+    source_ips = [
+      "0.0.0.0/0",
+      "::/0"
+    ]
+  }
+
+  rule {
+    direction = "in"
+    protocol  = "tcp"
+    port      = "22"
+    source_ips = [
+      "0.0.0.0/0",
+      "::/0"
+    ]
+  }
+
+  rule {
+    direction = "in"
+    protocol  = "tcp"
+    port      = "6443"
+    source_ips = [
+      "0.0.0.0/0",
+      "::/0"
+    ]
+  }
+
+}
+
diff --git a/k8s-single-node/plan.out b/k8s-single-node/plan.out
new file mode 100644
index 0000000000000000000000000000000000000000..f3e4b5aa5e3b201a0f930d10d7ed3abdc289dcca
GIT binary patch
literal 7315
zcmb7JbyQW`w?4=r1f)|!MCm?&fV3bj91e|icbDLiymU$<UD6@lC@I|`U5ApE=E%d}
zZ#+TXy?2Z^_t;~P`N#g&TyxH~_V=v~mO%vK15mFo8=pocz%4@t+y^)s+gj>bD=Q%Z
z5JtSC^c&QsZAd%Ebf$E0p|78yj#5d&#Y&;3iie+`QbT|k(G^BLxG&YY=QDKK_&A<Q
zX!cv07*i{F-K#Lg{gG{iSFtYRMXBdl{#NlJC-ZqJI5-2k5v4tR@26srzH=O>QBNQq
zCpCgSthblfWMJFH*k3*za43t&JJTw>Powvw9M)U!K@uiIO;^w<bfM>F7SyN6=@Ul?
z+S*c8-CW&V%}$u1b}iz!bAVQ9Br>m<44-`sJ?_Zvp|g=U9`9OmbJ#S72Fev!1e?tB
zDpNQi>14+TOe}ei<|$<)D~X}1Eoa1J@sClO`{3ZLN1}}dHVYn2r!S^Q&SNArKXlu2
z4*m2Tr#MZPoTLK<{}D+?ETYwtWOI*h@b_bqo!XRbFfcI-K4k%Uh6^+imnhm-%Tr>|
z>QdoeK<cS=+7D9JN+KSsU?eJj9aqjV71+D(nkP068VS;_EYUe1ax}`}?Jfv4|LYmy
zaEf9|l>w9;cG+XohVaC~vyc(N%W_bq;j{w=>+XpZ$+k45ejh)Yww7Ctm3omMd)k?I
z9c6PW=*n%gh<v?Hj+AbW*Vy+-D{61)1XGu9R^d)W@gCX1+;la2q$F5Xp?|K~KTs)J
zL;ztlCRs}sNyP0O!AL6({pe>HW6e?kpH`5@PRdG(u$av|7w%+?raZ@LHQDTD&MhoZ
zg5V(*!FkESPS~pbl*y{#)rBJM8A~y9Y%lDfwoHN1B0DOa=P8HEJ0@=Ju9c;B*Hrb(
znKkmS*+p*!4G8Qr_w_Y{x2+zL_7HXyX&z4@CAlu;U7~MTK2Gj|6`H_2mI7(dY^;lu
zLcQz7k<@*{qTb@$nm`W=kWUBXv9LlfzgL_cZ}@jq?@nTK2@n-3_?>-=)U)&lzNzs~
z_YPot*%qnC-_rIt2(bNwjTrO9-5epvs2O}2IZi?ZL>*oV^875||7eJ?FbX<w9DjhD
z;0Q{d{<vd~DI9_nnHZQ7F2HUgR%AEC4+_D`Tlr}ng-xW(@WEd}`e#kSH<l?htMX-A
zd|#WmDW|P{rP;7}CrnKgs$nWwueya4bh=|KV41+?!soRaTrsNf(`ss*0x<w{Uhp`_
zxSWz>MapZ4$m+&WSO)VK0cyCGJT5{7$<>PMob+rRyHGt3GZF0}B$`HdTih)lY?_jK
zHE~EwBYEZ6Kzt>)&;VR26yNHRW&OGY3U0?`hr6~<+LM8#to)fexp)cDDWnJuN|-yd
z{m<+#k0Od`-Q4payjP8o>;t%()3Ldk-r{+?eja2aIrhO4kK60+93~^tsr8aBWX}|H
zTM=$lOp0dWVpF5oWt~T;OdLh6Acx21U!EhR1gBHA$Kz6vWQ`-WK@UK96r#*zB<OFx
z1X44Um-#`8nQ|cUCG7s9No{0Yfs#~n(!9}cw({7d72~C;6}iIFqU?EHAP|x1$Mln5
z3~KS0WJS6ITBN$YV#s7*xP++V@8c(R!Uy-1?nMIa>AJF_RGyoKHYU8vnh$|6@|+1N
zE>9`9SeH}C3{Dn6gTht_JIjC})GVDZV#~DY%1>dnJYOfd_)=fdqI$FGsT(pW<Px9-
zTC(uPRw_`ef;B#(;{q9QS;Jt%;esDNFqZsy?n~*8BC}qi!$jMZ>x<R}_6dkKeSf;8
z=)uRq&v~%Mk>deNxBH3E7SB=o#R@ySp_w2e%Y*w8CHiq^Yg;qA)<b##{~{SlhgPzv
zFa1N6{QhKZxxYrBq}>2dQqBB+LT|wR*^q5YD*P6u(+f8-i*x=VqqS%DxhzJBZw-mv
zhbpALX=s>w&$T)qM=ndf1PbGCZN3})U_kRkpj8nkrkc{I?%@et-TEn9owSPV${-ot
zo3F)*@`=}y2!ce4QUk#{H5OM$%d-Ux;7&%;nU*YxV8cfbl(vgUD8Rg$LG@6iu{K26
z>@eZ9dTh^!KrSqyHd*K6fEP8a9AX*rR8P@-&<b%MS2ol~i)5{DJ|U>4FR-ZDxb!lw
zFc?I5H9$jISoL}2dWUQDM79eCrDYy>vF)UmZVQh9p9FQKbonSVCVYMB5J(qa=vz6l
z6v9w^@l)<mgrGhd-dT@-hs<<1U{5ZqY1E_JBQ0ip9OZ2cstEi3?nz~s+*zYBRFwk*
zO7O$#ovN*WL-nIK47Q`Ogs;R@N%x*KGQsObLQA&xh7|Hz<rFJW;CziZw&~`l(>TDN
z4(mks;q>yFO_0z&?c`h*CfSbSew|tsjii8A@-rAJulQa&TM`1iYn(Fk_PTvLd?05B
z>-n=9!>#x0xprm~8IJ^w;2h;S9%IPeqhm!|FwOe9nhL=JZY?@qb8Rc7i2`k_Vov%3
zr5VkyY7ZngI!2iqTpjElcg88TC%-l|qfuNP+x!-q)9A&LfIxUu`%XD0N9EkR9$Y=0
zuh}CXHk+%-Nc3=|=98OLAG2FjpPf22#{|RM_MVbyD>u+_0<D)0AdMSF-j?&QT4UMD
z-FoSTnbl4MNxVab+x|w*TsS}8xtUC6^!w!Eu$k@LrX8ex!nP8RX@V^AiPl+^;<N(r
z1`SJYV02f173FghskJ6kT(<Z#3BR%evpPg73BUca1velvy3!inBD=Ucc~_NE7LvCd
zn`xY5lcJd6nw$;Lk;$3j$49-T+KR&sI|zOUCQkB2rwUodbCgcH;)Shkgha6i-U85r
zueu&gZQ-N`{p@hQ@WjSxJ-&N94&VGwGFgC<)M->l&L%>#<?s3ut~Le(xxcZ7yQt^^
zcKh2~1>yJYb7u`!`ubvQFkLxF;HmHv@YFe#uBGr)S^zqCcD<FvJfokVzxcC0?zyS)
zu*aW!eCmg=C&BN_lCJ9aSiZg_tr4rp9X%@h(EoAd#9V3OXt|C2)#%aIh@pAuxE~<J
zvN~y9pJFcS@|3&xid!eZQ1B>OglUji^2^f)p29Lxn0q>J#@@0_avTJm9mv<EFIOUF
zqvPCPIQfn~^Z|K4DW>;nQRr@Bs>5s2H*=RlhxqNJ?1%KMOy_+43G!BI;@Th`&H)VV
z_-F5QQ&w6cZ4#cqWWs$$JnjJiS65&e6x8e^*VPMD0Kf|u0093ZZ$kMGZ*p+db2R!*
zoWw#t_xn&{`|b)NO&x~gL|k?kaK1v^wieaTR!<{ZuIFA)?>uWtn0o$r!6(T;<8$DC
z$*Om63U0Ht5MusBqj#&x$~uwli#&(YHUc=_>%NF&3Qn~=6H&+&o|F)fx^qe`^A&N9
z=bB9Zs+J5gZ5134!mHe5AR1>;?J|GO>HZr(^@#k2_qCUNegAX(7&q}V+u9pB|DHrX
z3<3r-$S^bX_YNq2g0KxC?8`ucgK$R<g6)@aK+=A0;%<J@x@SwH8NF>})Qm`oY}~XQ
ztX%8@1X-w5sX7`Eum+^iFdM9ePDm%s+|SA^Er)dfWvBg^J;LuCS7ptY>0QU?@~<%x
z{wGEQ8*5`T6ILr`Rs%~X2S+1&7DwaX(Hcgw+bpwT{N-|m_QIu=Jc6g^LG=oX<CZqQ
zx4uxPw~+#+5s~%6m3EihG$2_Lyt|B;3ha*Jq<n&CiAU3iEeb2BR~Bn^^b#}7O@6$|
zJDgxldo<u5L}!ma%afslpYYz+dvJtfBN|sGC+si77B9k;S8Lx?(xgo`KeQ-X5P(EC
z7n>=@IxU2^M=l5EoJcw7vqm{ch{km8^*$rQoLpngS&aWn6piHzSyw|DM#S)A?xHud
zfU!ADweF1h>VA|<b|)xgJDh~7*nlKl;K1ECzS)9Zy`VC`DHDCBMwdVVddy)trPmeh
zXxUnJI3dsp3b$_CiPqe)(CgpY5HZ_bV=<tUTLrYq@*V6+9GO53iMaj7lq`;L{<j^7
z7O03Q5CDLQ>-(SEf#^=Ejm_+hT=Xn0Z|AzV|8vk6Hf-bt_mm}*{`%=*W~#pg110Ir
zMs*YKN8w`)yAa_CxZ<<EpN>m7^I(r88bWp)4vRD6QDcuA;=Pw#z0a-T;pk_p?D@#V
z=Vv<sWiZDXX?!7ZGSkIH^iecBD((392!(-k+dy*5fc3H-AQ&E}qdYPYRaczf)2)qA
z;KmKwkkHqaS~bQpPb|qTGn>AW4=$9R{oPj2fO=Ia*DclY|C+0<y^XV(;h%lQK-bOM
zBP+!W0e4IGe`S580Li^x7j$0-<oXoB;8JBe8Kz;Mt~MW}TJu`K^=SWHdTg+0YtZ%h
z9RJ$Z1b1@nU}W$7=jgug*~3TKu>ZQa42m=prpgfs@OvceFZSm7%Q-`PlJ>Hq1iLWL
z<K`!PQ++9Plh*U3&HEQ*;(-b7K#n6pSUTPc!IWo0vos^VHvhxZ5dg57lC0Ur<~y<{
z;fc44gOg>ZV;!|6;JEF4caI_(xutWCzTGyZk-puL=!ZQz%L#zzeQ)hgjq$G0zM8Ls
zXO0Es1<ox)MkTR+Ysi%7_S`&9PAYa%bM#>=`_Nh4ZsFI+-(iF{TyGA`o?kpTwxZWD
zo>}mPAcj<?ish(8PK8FsIlq9DM_6?e9WL_Bccz8iI~XkLf^6>2UU7xtiGDX(x%eTq
zRiy9{J^Yi|(+<@&sDux{aP8OQw{2)Sc_(O-6Kk%XP#aS*8pWd*>mqB!PTV<kZV$cR
zRYZ@oCX*tI<9NDYlh75V?&5})w)gJA*RUdH1|UATBb)d=hwwP7RX1iN+|C#@R7189
z870eoqGQ;)=x0T`)Pa%DV@fp4NDyqNM5J%WV?zpSwa7XjntxZcsYqJc@7kkB{I}JE
zd$*zvrneUke~$>J_jNfJq4N76MlDa;1*WX%iD)&tgbk)qR~G}>%ZaOx6|h89`n+d4
zCgq^{GwiNzvPS36i~xz5Kpng+MJ`xQJ#gViw)I9Z+hdy;B9hJz>Lfp>!IP;dPW;eF
z3s-;n>z4a(6AFKk4K=^^{(WyHz7z8GzG|;$Y-4YAJ8;KA5j3Cw1TM$!>RGn=O*`9{
zhgxK7lE`UjX;vl^Ote80v9fFuuMTim<zKf7pd6qUuA2sGiP8paBy`n_#D#rZmd1DT
z!pn$7V?DIMf2y!k$}`FkAktZqUt?A?CsgH_5%(6`*-;yO{S07T>rd;)^bju}Lirfq
z?F*_*w6K0x*_TvpYd;aoP>fcda5K#=i0*X!^)x}()%oXr?d~+4_3X{`^ev4X{+MR?
zkaQax_RIN00#T^7>6cIP#m$i6mGKA6cnPxJR6pw}zv$0Gh1Pm!D4zNop*)zViHkL6
zCUs4d7ghSqWwDcnp2ta?K`X5$IvvCEBdOF_Jfl|$2gzJ?MBiy!WHa~-1XG!p!AR_}
zIU^)-edE-sQ}yDx;dnUrW$SXi&{FoC#PqP*^g1nHGNv?xolh@0WEZ|dyG66rkHSbe
z9zpV+BC$VZdw+7A5LHy+k@>9p?zUNU%RZXj@<7M#@4CO{t0Mk#?IrzdLjK%*Yz&=#
z<-**-=H~b(=z633wb@<Ufn1T&CkPla>}9J33KrHBpk_h(OQTp#`1hd6*%svV*WR!D
zpR0g(-E1s39cF1`V8LQ)VEOwi9uli%L)|{)xeI3$hrL&w%P-E~G0$q$9YPoL252<B
zhz>sAJi4zv{akQPH{<feRQN^bu(-apc;d#pQ7tXF60{WR4t1RzU(Bg$Z9N{xtfu9g
zQL#RDt#h~dC_35KHv*HNUd;=Wc<s_zJ-v8rTh~x`s(UeP{b<{`fIsQ@tNe!vXNMEp
zZ<y87Zu|li7VZu5d}FO+?d|aWo!Q4*HChx~eT$2ZZ|lwx-#FE{+gV{v_}B2wHP_Ul
z*VoScgqB(DZl2oK)X!>L$8G0p4Xw6UZ6j{!x!1zs`qNe02M>ilJ=$5_JFnN#h91MV
zTux`VPYw)iU=x@g@IAgubpFegtVdU;n<FJZmgC~CPA)2RN`&rdv-#I4dQ~8_R#p(4
zq+@dq-ph2^eV$wt>0UvduhlCd-9nOIe(>UB;!6YFvw%Sew<@iAR8C+PDi5>vTyNyi
z!)n2Tx+xO#Tq*ekWXZ)+ao!Hgp!bcM`k&P{Kegn04WzV`BWKIw+hh%Z>6IBB2<7`V
z7V)*p%^bAKUG8}i5<bA|DP6`5QXWZ;N$LliKl|9SwBYzKG{^r$g@^XV9uq}Ng<I}A
zon6`#U;k8Y53xg1I_$f)5rc*Ir%)OT5hn^mrVEgk#%^Y41a+gaZpb<_W4%#bYNqAr
z!*Sa(mcy8?rJ_VT1JtO;JWL8e+i2$}gP6Sc?&%pP+YCM*1E5D3j{`|5-%A*y0gDBg
z$W>J<q-d~>s1!pQUxM}cMPq1AxJX3MT{ZHvRGldo#RU-G)+w1L5b2iEaUvN=9~|O2
zN?0mn#+Ildk7e738HHvOmJt@>>(D$4>LZn{*!T)%DOESgCDTSQ!)4<=$Inv^1O%&8
zR((-&S51(S5XNIABUj<Y>`ytwsC--eY*51I>-{I@^k@<gv{6n)B_B|t<bqdJMB?h6
zINN#mJou{SbRf0#Me@7GB7>P30a)<Xy!Jp}sSs<mOaoP&c|FC_&het-%&X(Q%TD(O
zk<_b<lSB0I>4AxYE!sM`^V?HbcRc&ci2?r!A^2hN$Xhs^Tc@$fBYU7h?|o^2Mwlko
z@dz;xHOlH0mlFG-fcUUO8l&7M(kOOt`H52)!$LZ!K>Py~Cvc~gUf(Pl8H0mDn@>9a
zBYj;^Ws({D#tdnEbXqy9NFP^08IX%OCbTqb<NZujO`hjCYLLBwMU#0#=vuCxZ~A9E
z;D>&SmsauB$d#`FMFb)-5HZG~&5_x-`mNld{&t=(jr*2b^bM6`qOO&*fJ}8HkgstS
zQ2EC^(}X#_YyzX-LTw-Ni+Ks9U8}GuPiBpdHcHIoif`+PpTfPx5rYUw%OMb1C`|`_
z=1gS0TqrOB0cVqJR2tb`LRa?4Iv|qaJHD5cwTj%c)bwFRK6b!qQ~vBXhnlQol33B{
zBtnN~x<;9d@1#`(l6W=AnT6@qup(mysYPwRxA;7nb~`!b@r`4J8(f_6yvV|RJHEbf
zGUeEHnn4m-TP{fwSs&G4OfCC!P%$VEsW*^c3<XIc@Y!=6<x!A)X?hiL_fy;owvfC|
z>~1dd%){@iR-7*%eKIj!{37^WbAp#^9L;PH`VAYwLP=8C6nbB3H$_dVsSf*7CkwqL
zMiT#WLLaDa9Df(~44{zPqghE<MNBcqtWS4D$YMdy#mR}G<8J3+UH-js8>!?zc+0P;
zA&XJM;&B@1%aA->3@Qp`aon#%`ePJ7g>1?*XFHt8b;vx5uZ+qVU7Oq9UHzo+-w1Dh
zXKFLIPn6mKpO(kEx>^-za63=b?vuyjo_|;DdIkHrb1`rlb&1f->q6WgYt^AfVxf}3
zQo7P5Fp}_6J@1%mv1-_4@;zAEXw%)ul_o{&Y)D4M*ML1?Lzql?(70wY>$7zVy7$xC
z0=5S+jg2^?^lPdOhwGIStX{xWk=`PdA9KW+`jt`*#8D!Z&lO7V>r2`U_6^_}zGw+~
zp+e4E=oOIj6cpmeX#iAko;xakWa$?{WIjRPmbYfM1;QWUAj?u@)nK%%C>){{cUo08
z7lSH$9(CMHk`!Uuu}F3y304^emqpePyY}VK;E-6VS%Jf=bg`(5;op#{H`Qh%;+0df
znf<qq(pH(GXvT>0v1}08o~yWUDkk_ad+crp80^3yE@GZS!^bx~4(h?#rHu>#AY=Uc
zP9faG2i*J)xh?pA{SNul?))6N`|@qI{p(EN#(1tBN8>+F2=2apTL=GA<TrMD^Y)+m
z{4T_8efLW+-&hjbuK@m4KHmkqEuel$!W%=mPTXy<zY~ae(QeD3KhX~Fp#7Z$yNh<4
zivMCUH|Fr*&)EL2pt_57n<M`s?>F`m>kihRRQ@i|Z5H~AYu?!D9iSWfbL;rxF5GPn
z_b1#u_MdV6Es?zocblF4nX<j>^MRXk{v8dxi*<Vi{o->sW^{c}_HXPCEQ55t@&Evg
O>&y09M?E0<<^2!w4`tW@

literal 0
HcmV?d00001

diff --git a/k8s-single-node/provider.tf b/k8s-single-node/provider.tf
new file mode 100644
index 0000000..d6551da
--- /dev/null
+++ b/k8s-single-node/provider.tf
@@ -0,0 +1,3 @@
+provider "hcloud" {
+  token   = var.hcloud_token
+}
diff --git a/k8s-single-node/secret.auto.tfvars.example b/k8s-single-node/secret.auto.tfvars.example
new file mode 100644
index 0000000..476433a
--- /dev/null
+++ b/k8s-single-node/secret.auto.tfvars.example
@@ -0,0 +1 @@
+hcloud_token = "tokitoki"
diff --git a/k8s-single-node/server.tf b/k8s-single-node/server.tf
new file mode 100644
index 0000000..052ae62
--- /dev/null
+++ b/k8s-single-node/server.tf
@@ -0,0 +1,32 @@
+resource "hcloud_server" "k8s-single" {
+  name        = "k8s-single"
+  image       = var.os_type
+  server_type = var.server_type
+  location    = var.location
+  labels      = {
+    type = "single"
+  }
+  ssh_keys    = [hcloud_ssh_key.default.id]
+  user_data   = templatefile(
+    "user-data.yaml.tpl",
+    {
+      ssh_pubkey         = file("../ssh-terraform-hetzner.pub")
+      containerd_version = var.containerd_version
+      docker_version     = var.docker_version
+    }
+  )
+  firewall_ids = [hcloud_firewall.k8s-single.id]
+
+  connection {
+    type        = "ssh"
+    user        = "root"
+    host        = self.ipv6_address  # or ipv4_address if your ISP sucks
+    private_key = file("../ssh-terraform-hetzner")
+  }
+
+  provisioner "remote-exec" {
+    inline = [
+      "cloud-init status --wait"
+    ]
+  }
+}
diff --git a/k8s-single-node/ssh.tf b/k8s-single-node/ssh.tf
new file mode 100644
index 0000000..adb5056
--- /dev/null
+++ b/k8s-single-node/ssh.tf
@@ -0,0 +1,4 @@
+resource "hcloud_ssh_key" "default" {
+  name       = "terraform"
+  public_key = file("../ssh-terraform-hetzner.pub")
+}
diff --git a/k8s-single-node/terraform.tf b/k8s-single-node/terraform.tf
new file mode 100644
index 0000000..c2d0653
--- /dev/null
+++ b/k8s-single-node/terraform.tf
@@ -0,0 +1,18 @@
+terraform {
+  required_providers {
+    hcloud = {
+      source  = "hetznercloud/hcloud"
+      version = "1.33.2"
+    }
+    rke = {
+      source  = "rancher/rke"
+      version = "1.3.0"
+    }
+    local = {
+      source  = "hashicorp/local"
+      version = "2.2.3"
+    }
+  }
+
+  required_version = ">= 1.1"
+}
diff --git a/k8s-single-node/user-data.yaml.tpl b/k8s-single-node/user-data.yaml.tpl
new file mode 100644
index 0000000..6b98fd0
--- /dev/null
+++ b/k8s-single-node/user-data.yaml.tpl
@@ -0,0 +1,18 @@
+#cloud-config
+users:
+  - name: "ansible"
+    groups: ["sudo"]
+    sudo: "ALL=(ALL) NOPASSWD:ALL"
+    shell: "/bin/bash"
+    ssh_authorized_keys:
+      - "${ssh_pubkey}"
+
+package_update: true
+package_upgrade: true
+
+runcmd:
+  - curl -LO https://download.docker.com/linux/ubuntu/dists/focal/pool/stable/amd64/containerd.io_${containerd_version}-1_amd64.deb
+  - curl -LO https://download.docker.com/linux/ubuntu/dists/focal/pool/stable/amd64/docker-ce-cli_${docker_version}~3-0~ubuntu-focal_amd64.deb
+  - curl -LO https://download.docker.com/linux/ubuntu/dists/focal/pool/stable/amd64/docker-ce_${docker_version}~3-0~ubuntu-focal_amd64.deb
+  - dpkg -i *deb
+  - usermod -a -G docker ansible
diff --git a/k8s-single-node/variables.tf b/k8s-single-node/variables.tf
new file mode 100644
index 0000000..d972d0f
--- /dev/null
+++ b/k8s-single-node/variables.tf
@@ -0,0 +1,28 @@
+variable "hcloud_token" {
+  sensitive = true
+  # default = <defined in secret.auto.tfvars>
+}
+
+variable "location" {
+  default = "nbg1"
+}
+
+variable "server_type" {
+  default = "cx21"
+}
+
+variable "os_type" {
+  default = "ubuntu-20.04"
+}
+
+variable "docker_version" {
+  default = "20.10.16"
+}
+
+variable "containerd_version" {
+  default = "1.6.4"
+}
+
+variable "kubernetes_version" {
+  default = "v1.22.4-rancher1-1"
+}