How to work with multiple projects in Hetzner Cloud

Posted on April 16, 2021 by Adrian Wyssmann ‐ 3 min read

In Hetzner Cloud you can have multiple projects. As you can have different members per group, it really makes sense to have different projects for different purposes. I will explain in this article on how I work with multiple projects in Ansible, as well when using the cli

Multiple projects in Hetzner Cloud

A project in Hetzner Cloud has a dedicated set of members and resources, whereas each member has a role, which determines what they are allowed to do. In my case I have two projects, to separate productive systems from my playground/development resources:

How to access projects using the cli

Access to projects is controlled by the API token, which you have to create via the Cloud Console:

You can set the token as environment variable HCLOUD_TOKEN which can be used for both, ansible and the hcloud cli. However as you can have only one environment variable with this name, this may cause undesired side effect, as depending on the value set, you access either one or the other project. Luckily hcloud cli has context. You can define contexts by giving it a name and the project-specific token for example:

$ hcloud context create development
Token:
Context development created and activated
$ hcloud context create production
Token:
Context production created and activated
$ hcloud context list
ACTIVE   NAME
         development
*        production

Let’s see how this works

$ hcloud context active
production
$ hcloud server list
ID        NAME    STATUS    IPV4             IPV6                     DATACENTER
9830839   ttrss   running   x.x.x.x          aa:aa:aa:aa::/64         hel1-dc2
$ hcloud context use development
$ hcloud server list
ID         NAME      STATUS    IPV4            IPV6                      DATACENTER
11309447   dev0001   running   x.x.x.x         aa:aa:aa:aa::/64          hel1-dc2

Dynamic inventory in Ansible with multiple projects

I already wrote in one of my recent posts how manage inventory with inventory plugins using the hcloud inventory plugin and hetzner robot inventory plugin. If you use Hetzner Cloud. So far I started with a single inventory file inventory.hcloud.yml which looked like this:

plugin: hcloud
keyed_groups:
  - key: location
    prefix: hcloud_location
  - key: image_os_flavor
    separator: ""
  - key: status
    prefix: server_status
  - key: labels
    separator: ""
compose:
  server_ipv4: ipv4
  server_ipv6: ipv6
  ansible_host: name ~ ".example.com"

So far I always had HCLOUD_TOKEN set but when removing this will not work anymore:

$ ansible-inventory -i inventory.hcloud.yml  --graph
[WARNING]:  * Failed to parse /home/aedu/Workspaces/example.com/infrastructure/inventory.hcloud.yml with auto plugin: Invalid Hetzner Cloud API Token.
[WARNING]:  * Failed to parse /home/aedu/Workspaces/example.com/infrastructure/inventory.hcloud.yml with yaml plugin: Plugin configuration YAML file, not YAML inventory
[WARNING]:  * Failed to parse /home/aedu/Workspaces/example.com/infrastructure/inventory.hcloud.yml with ini plugin: Invalid host pattern 'plugin:' supplied, ending in ':' is not allowed, this character is
reserved to provide a port.
[WARNING]: Unable to parse /home/aedu/Workspaces/example.com/infrastructure/inventory.hcloud.yml as an inventory source
[WARNING]: No inventory was parsed, only implicit localhost is available
@all:
  |--@ungrouped:

If you check carefully in the docu of hcloud inventory plugin you can see that one can set the token. So let`s do that - obviously using an encrypted string:

token: !vault |
          $ANSIBLE_VAULT;1.1;AES256
          xxxxxx

And see, it’s working

$ ansible-inventory -i inventory.hcloud.yml  --graph
@all:
  |--@debian:
  |  |--dev0001
  |--@dev:
  |  |--dev0001
  |--@hcloud:
  |  |--dev0001
  |--@hcloud_location_hel1:
  |  |--dev0001
  |--@k8smaster:
  |  |--dev0001
  |--@server_status_running:
  |  |--dev0001
  |--@ungrouped:

As I have configured inventory in the ansible.cfg the above also works without the -i parameter. So as I have 2 projects, I also need 2 inventory files - inventory.dev.hcloud.yml and inventory.prd.hcloud.yml - both with the same configuration, but different token. I also update ansible.cfg as follows:

inventory      = ./inventory.yml,./inventory.dev.hcloud.yml,./inventory.prd.hcloud.yml

This is sufficient so that I can use the inventory of both projects - dev0001 runs in development whereas ttrss runs in production:

$ ansible-inventory --graph
@all:
  |--@debian:
  |  |--dev0001
  |  |--ttrss
  |--@dev:
  |  |--dev0001
  |--@hcloud:
  |  |--dev0001
  |  |--ttrss
  |--@hcloud_location_hel1:
  |  |--dev0001
  |  |--ttrss
  |--@k8smaster:
  |  |--dev0001
  |--@prod:
  |  |--ttrss
  |--@rss:
  |  |--ttrss
  |--@server_status_running:
  |  |--dev0001
  |  |--ttrss
  |--@ungrouped:

Wyssmann Engineering

Title here

How to work with multiple projects in Hetzner Cloud

Multiple projects in Hetzner Cloud

How to access projects using the cli

Dynamic inventory in Ansible with multiple projects