Resource limits in fresh account do not match the default configuration

[manuschillerdev]

Description

Thanks for your great starting point to get k8s up and running on hetzner cloud.
I created a fresh account with default settings on hetzner, and followed the readme of this repo (see Kube.tf for dertails).
My goal is to test out Cilium, SPIFFE/SPIRE, OPA and OpenFGA within hetzner.

However, terraform apply -auto-approve fails with an error, that my resource limit is exceeded:

module.kube-hetzner.null_resource.configure_autoscaler[0]: Creation complete after 1s [id=3475522426128264643]
╷
│ Error: server limit exceeded (resource_limit_exceeded)
│
│   with module.kube-hetzner.module.agents["2-0-storage"].hcloud_server.server,
│   on .terraform/modules/kube-hetzner/modules/host/main.tf line 22, in resource "hcloud_server" "server":
│   22: resource "hcloud_server" "server" {
│
╵
╷
│ Error: server limit exceeded (resource_limit_exceeded)
│
│   with module.kube-hetzner.module.agents["3-0-egress"].hcloud_server.server,
│   on .terraform/modules/kube-hetzner/modules/host/main.tf line 22, in resource "hcloud_server" "server":
│   22: resource "hcloud_server" "server" {
│
╵
╷
│ Error: server limit exceeded (resource_limit_exceeded)
│
│   with module.kube-hetzner.module.agents["1-0-agent-large"].hcloud_server.server,
│   on .terraform/modules/kube-hetzner/modules/host/main.tf line 22, in resource "hcloud_server" "server":
│   22: resource "hcloud_server" "server" {

My Account is too new to increase the limits - and I think a more leightweight setup would be sufficient. What would be a useful configuration to scale down resources to a minimum and still being able to test out Cilium/SPIFFE? Any hint to the right places in the configs would be appreciated :)

My Kube.tf has no changes besides the settings for cilium:

Kube.tf file

cni_plugin = "cilium"
# ...
cilium_values = <<EOT
ipam:
  mode: kubernetes
devices: "eth1"
k8s:
  requireIPv4PodCIDR: true
kubeProxyReplacement: strict
l7Proxy: false
encryption:
  enabled: true
  type: wireguard
auth:
  mTLS:
    spire:
      enabled: true
  EOT

Screenshots

Platform

Mac

[mysticaltech]

Hey @manuschillerdev, just do not do HA, turn off both automatic upgrade (since HA is needed for that), go with 1 control plane, 1 agent, so that you have room for autoscalers.

[manuschillerdev]

Thanks!