GitHub Actions

Automate cluster provisioning and configuration sync with GitHub Actions.

Prerequisites

• A repository containing your cluster.lok8s.yaml
• lok8s CLI available in CI (installed via b env add)
• GitHub repository secrets configured

Required secrets

Add these to your repository settings under Settings > Secrets and variables > Actions:

Secret	Description
HCLOUD_TOKEN	Hetzner Cloud API token
SSH_PRIVATE_KEY	SSH private key for node access
KUBECONFIG	Base64-encoded kubeconfig (for sync workflows)

Provision workflow

Create .github/workflows/provision.yml:

name: Provision Cluster
on:
  workflow_dispatch:
    inputs:
      action:
        description: 'Action to perform'
        required: true
        default: 'provision'
        type: choice
        options:
          - provision
          - destroy

jobs:
  provision:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install lok8s
        run: b env add github.com/kernpilot/lok8s

      - name: Setup SSH key
        run: |
          mkdir -p ~/.ssh
          echo "${{ secrets.SSH_PRIVATE_KEY }}" > ~/.ssh/id_ed25519
          chmod 600 ~/.ssh/id_ed25519

      - name: Provision
        env:
          HCLOUD_TOKEN: ${{ secrets.HCLOUD_TOKEN }}
        run: lo provision

Sync workflow

Create .github/workflows/sync.yml to apply configuration changes on push:

name: Sync Cluster
on:
  push:
    branches: [main]
    paths:
      - 'cluster.lok8s.yaml'
      - 'deploy/**'

jobs:
  sync:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install lok8s
        run: b env add github.com/kernpilot/lok8s

      - name: Setup kubeconfig
        run: |
          mkdir -p ~/.kube
          echo "${{ secrets.KUBECONFIG }}" | base64 -d > ~/.kube/config

      - name: Reconcile infrastructure
        env:
          HCLOUD_TOKEN: ${{ secrets.HCLOUD_TOKEN }}
        run: lo provision

      - name: Deploy platform
        run: lo deploy

lo provision is idempotent — re-running it reconciles the cluster to your spec. lo deploy rolls out the platform/workload manifests under deploy/.

Next steps

• Registration — register with the kubehz dashboard
• KubeOne — provisioner details
• CAPI — Cluster API provisioner

---

Doc status

Aspect	Detail
State	active
Last reviewed	2026-04-04