feat(hetzner): add IP range configuration for private network #8570

tloesch · 2025-09-25T08:46:51Z

What type of PR is this?

/kind feature
/area provider/hetzner

What this PR does / why we need it:

This PR enables the optional specification of a subnet where autoscaled nodes will be placed. Previously, it was only possible to define a network ID, which caused issues when multiple subnets existed within that network.

Without subnet specification, Hetzner would place nodes randomly in one of the available subnets, leading to unpredictable network configurations and potential connectivity problems. This feature provides more precise control over node placement.

The implementation ensures that nodes receive consistent IP addresses from the specified subnet through the improved hetzner cloud api that prevents IP conflicts during scaling operations.

Which issue(s) this PR fixes:

Fixes # #5263

Special notes for your reviewer:

The implementation was developed based on the following discussion and is now possible since the changes were made to the api of hetzner and the hetzner-go library (hetznercloud/hcloud-go#723 #8554) (recommandation from @lukasmetzner):
#8334

It is possible to define a global IPRange within the new ClusterConfig and/or define it on a pool basis.
If the global value is defined and the pool is not, the global IPRange will be used for that pool.
If nothing is defined, the system will behave as before.
For more information, see the README.md file.

Question:
Should the IPRange value validation be performed earlier? For example, within the BuildHetzner function in the hetzner_cloud_provider.go file?

Does this PR introduce a user-facing change?

feat(hetzner): add IP range configuration for private network

k8s-ci-robot · 2025-09-25T08:47:01Z

Hi @tloesch. Thanks for your PR.

I'm waiting for a kubernetes member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

k8s-ci-robot · 2025-09-25T08:47:04Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: tloesch
Once this PR has been reviewed and has the lgtm label, please assign apricote for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

cluster-autoscaler/cloudprovider/hetzner/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

lukasmetzner · 2025-09-26T08:54:41Z

@tloesch Thanks a lot for all your efforts in pushing this feature. Unfortunately, I won't have the time to take a look at it this week. I will do ASAP 🙏

tloesch · 2025-09-26T09:01:30Z

@tloesch Thanks a lot for all your efforts in pushing this feature. Unfortunately, I won't have the time to take a look at it this week. I will do ASAP 🙏

@lukasmetzner No pressure. I am very grateful for the notification and the efforts to review it as quickly as possible. I am very satisfied with the cooperation so far.

elmiko · 2025-09-26T18:19:42Z

/ok-to-test

lukasmetzner

Thanks again for the contribution ^^ I have left a few suggestions and improvements.

lukasmetzner · 2025-10-02T11:49:40Z

cluster-autoscaler/cloudprovider/hetzner/hetzner_node_group.go

+	if nodeConfig, exists := clusterConfig.NodeConfigs[nodeId]; exists && nodeConfig.IPRange != "" {
+		_, ipNet, err := net.ParseCIDR(nodeConfig.IPRange)
+		if err != nil {
+			return nil, fmt.Errorf("failed to parse IP range %s for node %s: %v", nodeConfig.IPRange, nodeId, err)
+		}
+		return ipNet, nil
+	}
+	if clusterConfig.IPRange != "" {
+		_, ipNet, err := net.ParseCIDR(clusterConfig.IPRange)
+		if err != nil {
+			return nil, fmt.Errorf("failed to parse global IP range %s: %v", clusterConfig.IPRange, err)
+		}
+		return ipNet, nil
+	}


Please move the parsing part into the BuildHetzner(...) cloudprovider.Cloudprovider function and add new fields of type *net.IPNet to hetznerManager and hetznerNodeGroup. The config is static during runtime of the autoscaler, so parsing them once is enough and provides immediate feedback to the user.

type hetznerManager struct { // .... defaultSubnetIPRange *net.IPNet }

type hetznerNodeGroup struct { // .... subnetIPRange *net.IPNet }

The attribute defaultSubnetIPRange within hetznerManager would not be used by anything if the pasring is done within BuildHetzner. This is because we can set the default value immediately in the nodeGroups.

I am currently testing the changes. I will publish the changes afterwards.

Please give me feedback if necessary :)

lukasmetzner · 2025-10-02T11:49:59Z

cluster-autoscaler/cloudprovider/hetzner/hetzner_manager.go

 	Taints         []apiv1.Taint
 	Labels         map[string]string
 	ImagesForArch  *ImageList
+	IPRange        string


Suggested change

IPRange string

SubnetIPRange string

lukasmetzner · 2025-10-02T11:51:48Z

cluster-autoscaler/cloudprovider/hetzner/hetzner_manager.go

 	NodeConfigs      map[string]*NodeConfig
 	IsUsingNewFormat bool
 	LegacyConfig     LegacyConfig
+	IPRange          string


Suggested change

IPRange string

DefaultSubnetIPRange string

lukasmetzner · 2025-10-02T12:02:11Z

cluster-autoscaler/cloudprovider/hetzner/README.md

 **NOTE**: In contrast to `HCLOUD_CLUSTER_CONFIG`, this file is not base64 encoded.

-The global `imagesForArch` configuration can be overridden on a per-nodepool basis by adding an `imagesForArch` field to individual nodepool configurations.
+The `ipRange` configuration can be used to place nodes within a specific IP range. This only applies to private networks. Make sure that the IP range is within the configured private network IP Range. If you do not set this value, the default setting from Hetzner Cloud will be used.


Needs update when config values change. Please add a small notice, that the subnetwork needs to exist beforehand.

lukasmetzner · 2025-10-02T12:10:10Z

cluster-autoscaler/cloudprovider/hetzner/hetzner_node_group.go

+func isIpRangeInNetwork(ipRange *net.IPNet, network *hcloud.Network) bool {
+	found := false
+	for _, nSubnet := range network.Subnets {
+		_, nSubnetRange, _ := net.ParseCIDR(nSubnet.IPRange.String())
+		if nSubnetRange.String() == ipRange.String() {
+			found = true
+			break
+		}
+	}
+	return found
+}


Suggested change

func isIpRangeInNetwork(ipRange *net.IPNet, network *hcloud.Network) bool {

found := false

for _, nSubnet := range network.Subnets {

_, nSubnetRange, _ := net.ParseCIDR(nSubnet.IPRange.String())

if nSubnetRange.String() == ipRange.String() {

found = true

break

}

}

return found

}

func isIpRangeInNetwork(ipRange *net.IPNet, network *hcloud.Network) bool {

return slices.ContainsFunc(network.Subnets, func(subnet hcloud.NetworkSubnet) bool {

if ipRange == nil || subnet.IPRange == nil {

return false

}

return subnet.IPRange.IP.Equal(ipRange.IP) && len(subnet.IPRange.Mask) == len(ipRange.Mask)

})

}

jackfrancis · 2025-10-02T19:30:21Z

/release-note-edit

feat(hetzner): add IP range configuration for private network

refactor some code update README.md

feat(hetzner): add IP range configuration for private network

58386d9

k8s-ci-robot added release-note-none Denotes a PR that doesn't merit a release note. kind/feature Categorizes issue or PR as related to a new feature. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. do-not-merge/needs-area labels Sep 25, 2025

k8s-ci-robot requested review from apricote and elmiko September 25, 2025 08:47

k8s-ci-robot added the needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. label Sep 25, 2025

k8s-ci-robot added area/cluster-autoscaler area/provider/hetzner Issues or PRs related to Hetzner provider labels Sep 25, 2025

k8s-ci-robot added size/M Denotes a PR that changes 30-99 lines, ignoring generated files. and removed do-not-merge/needs-area labels Sep 25, 2025

fix typo

3ab4087

k8s-ci-robot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Sep 26, 2025

lukasmetzner suggested changes Oct 2, 2025

View reviewed changes

k8s-ci-robot added release-note Denotes a PR that will be considered when it comes time to generate release notes. and removed release-note-none Denotes a PR that doesn't merit a release note. labels Oct 2, 2025

change implementation to parse the iprange clusterconfig early

6a0f0af

refactor some code update README.md

k8s-ci-robot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. and removed size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels Oct 6, 2025

tloesch requested a review from lukasmetzner October 6, 2025 14:53

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat(hetzner): add IP range configuration for private network #8570

feat(hetzner): add IP range configuration for private network #8570

tloesch commented Sep 25, 2025 •

edited by k8s-ci-robot

Loading

Uh oh!

k8s-ci-robot commented Sep 25, 2025

Uh oh!

k8s-ci-robot commented Sep 25, 2025

Uh oh!

lukasmetzner commented Sep 26, 2025

Uh oh!

tloesch commented Sep 26, 2025

Uh oh!

elmiko commented Sep 26, 2025

Uh oh!

lukasmetzner left a comment

Uh oh!

lukasmetzner Oct 2, 2025

Uh oh!

tloesch Oct 6, 2025 •

edited

Loading

Uh oh!

lukasmetzner Oct 2, 2025

Uh oh!

lukasmetzner Oct 2, 2025

Uh oh!

lukasmetzner Oct 2, 2025

Uh oh!

lukasmetzner Oct 2, 2025

Uh oh!

jackfrancis commented Oct 2, 2025

Uh oh!

Uh oh!

feat(hetzner): add IP range configuration for private network #8570

Are you sure you want to change the base?

feat(hetzner): add IP range configuration for private network #8570

Conversation

tloesch commented Sep 25, 2025 • edited by k8s-ci-robot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What type of PR is this?

What this PR does / why we need it:

Which issue(s) this PR fixes:

Special notes for your reviewer:

Does this PR introduce a user-facing change?

Uh oh!

k8s-ci-robot commented Sep 25, 2025

Uh oh!

k8s-ci-robot commented Sep 25, 2025

Uh oh!

lukasmetzner commented Sep 26, 2025

Uh oh!

tloesch commented Sep 26, 2025

Uh oh!

elmiko commented Sep 26, 2025

Uh oh!

lukasmetzner left a comment

Choose a reason for hiding this comment

Uh oh!

lukasmetzner Oct 2, 2025

Choose a reason for hiding this comment

Uh oh!

tloesch Oct 6, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

lukasmetzner Oct 2, 2025

Choose a reason for hiding this comment

Uh oh!

lukasmetzner Oct 2, 2025

Choose a reason for hiding this comment

Uh oh!

lukasmetzner Oct 2, 2025

Choose a reason for hiding this comment

Uh oh!

lukasmetzner Oct 2, 2025

Choose a reason for hiding this comment

Uh oh!

jackfrancis commented Oct 2, 2025

Uh oh!

Uh oh!

tloesch commented Sep 25, 2025 •

edited by k8s-ci-robot

Loading

tloesch Oct 6, 2025 •

edited

Loading