SSH Keys with Passphrase

Mon, 01 Jan 0001 00:00:00 +0000

Why use a passphrase?

An SSH key without a passphrase is like a house key without a lock on the key cabinet. If your laptop or key file is stolen, the attacker gains immediate access to your cluster.

Creating keys with a passphrase

# Control node key
ssh-keygen -t ed25519 -f ~/.ssh/k8s-cluster_control-node_key -C "k8s-control"
# Enter a strong passphrase when prompted

# Worker node key
ssh-keygen -t ed25519 -f ~/.ssh/k8s-cluster_worker-node_key -C "k8s-worker"
# Enter a passphrase when prompted

Using ssh-agent

Since Terraform and Ansible cannot directly use encrypted keys, you must use ssh-agent:

Store SSH Keys in Password Manager

Mon, 01 Jan 0001 00:00:00 +0000

Storing SSH keys in a password manager provides a secure backup that survives hardware failures and makes it easy to restore access from a new machine.

General workflow

This workflow applies to any password manager that supports secure notes or file attachments (Dashlane, 1Password, Bitwarden, etc.).

1. Create keys locally

ssh-keygen -t ed25519 -f ~/.ssh/k8s-cluster_control-node_key -C "control-node"
ssh-keygen -t ed25519 -f ~/.ssh/k8s-cluster_worker-node_key -C "worker-node"

2. Save to your password manager

Create a secure note or vault entry:

Manual Setup (Alternative)

Mon, 01 Jan 0001 00:00:00 +0000

This guide is an alternative to OpenTofu

This guide shows the manual steps that OpenTofu automates. Use this if you want to understand what happens behind the scenes, or if you prefer to set up infrastructure manually via the Hetzner Cloud Console. For the automated approach, see [Infrastructure (OpenTofu)](/kubeclaw/docs/guide/infrastructure/).

Overview

This setup creates a secure server infrastructure with the following properties:

No public IPv4/IPv6 addresses (after setup)
SSH access exclusively via Cloudflare Tunnel
Internal communication via Hetzner Private Network
Hardened SSH configuration with fail2ban and UFW

Architecture

┌─────────────────────────────────────────────────────────────────┐
│ Internet │
└─────────────────────────────────────────────────────────────────┘
 │
 ▼
┌─────────────────────────────────────────────────────────────────┐
│ Cloudflare Tunnel │
│ console.yourdomain.org │
└─────────────────────────────────────────────────────────────────┘
 │
 ▼
┌─────────────────────────────────────────────────────────────────┐
│ Hetzner Cloud │
│ ┌─────────────────────────────────────────────────────────┐ │
│ │ Private Network (10.0.0.0/24) │ │
│ │ │ │
│ │ ┌─────────────────┐ ┌─────────────────┐ │ │
│ │ │ control-node │ │ worker-node │ │ │
│ │ │ 10.0.0.2 │◄─────►│ 10.0.0.3 │ │ │
│ │ │ (cloudflared) │ │ (isolated) │ │ │
│ │ └─────────────────┘ └─────────────────┘ │ │
│ │ │ │
│ └─────────────────────────────────────────────────────────┘ │
└─────────────────────────────────────────────────────────────────┘

Prerequisites

Hetzner Cloud account
Cloudflare account with your own domain
macOS/Linux machine with SSH
cloudflared installed locally (brew install cloudflared)

Step 1: Create Hetzner Private Network

Open the Hetzner Cloud Console
Select your project
Go to Networks > Create Network
Configure:
- Name: k8s-network (or any name)
- IP Range: 10.0.0.0/8 (Hetzner requires /8 for the network object)
Click Create Network
Add a Subnet: 10.0.0.0/24 in zone eu-central (this is the actual range used by nodes)

Step 2: Generate SSH keys

Create a separate SSH key for each server:

How-to on KubeClaw

SSH Keys with Passphrase

Why use a passphrase?

Creating keys with a passphrase

Using ssh-agent

Store SSH Keys in Password Manager

General workflow

1. Create keys locally

2. Save to your password manager

Manual Setup (Alternative)

Overview

Architecture

Prerequisites

Step 1: Create Hetzner Private Network

Step 2: Generate SSH keys