Join a node

A node is any Linux host you attach to your control plane as a Kubernetes worker — a homelab box, a spare server, or a cloud VM. The join is outbound-only: the node dials the control plane, so there’s no public IP, no inbound firewall hole, and no port-forwarding to set up. Pods run on your nodes; the control plane is managed for you.

What a node needs: a Debian/Ubuntu or RHEL/Fedora/Rocky host (amd64 or arm64) with outbound internet and root. That’s it — no CNI to install, no Kubernetes to configure by hand.

Attach one node

From your workstation, mint a join and print the exact command to run on the node:

lbr cp node attach home

It prints a one-liner carrying a single-use join token (valid for an hour):

curl -fsSL https://api.eu-hel.cp.lngbrdg.com/install.sh \
  | sudo bash -s -- --token <token> --k8s-version 1.34

Run that on the node as root. The installer pulls the prerequisites — containerd, kubeadm/kubelet matched to your cluster’s Kubernetes version, and the outbound fabric tunnel — brings the tunnel up, and joins. Confirm it registered:

lbr cp node list home     # or: kubectl get nodes

The control plane installs the CNI (Cilium) into your cluster for you — you don’t wire up pod networking or logs/exec by hand.

Prefer the browser? The Console shows the same command on the cluster’s Attach a node card, and lists nodes as they come up.

Attach a fleet

For an autoscaling group you want a reusable credential, not a one-shot token. Mint a registration token and get a ready cloud-init:

lbr cp registration-token create home --name pool-a --cloud-config

Bake the printed #cloud-config into your launch template’s user-data: every instance self-registers on boot and deregisters on shutdown. Revoke the token to cut off new joins. (The same command without --cloud-config prints only the token.)

Prefer we run the elasticity for you? A managed node pool provisions and autoscales nodes in your own cloud from a stored credential — no launch template, no autoscaler to operate.

By environment

The flow is identical everywhere — only how you get a Linux box differs.

Homelab

A mini-PC, an old laptop, or a Raspberry Pi (arm64) running Ubuntu is plenty. Because the join is outbound-only, a machine on your home LAN behind NAT joins with no router changes.

Hetzner

A small shared-vCPU Cloud server (for example cx23) running Ubuntu is a fine worker. It registers over the public network — still outbound-initiated, no inbound rules needed.

AWS

Launch an Ubuntu instance. Spot instances are a good fit — cheap, and the control plane sees nodes come and go; pair them with a registration token and the cloud-init above. The security group needs no inbound rules for the join.

Remove a node

Drain its workloads, then deregister it — one command cleans the node up across the cluster and the fabric:

kubectl drain <node> --ignore-daemonsets --delete-emptydir-data
lbr cp node rm home <node>

The hardware is yours — reclaim it whenever you like. That’s the no-lock-in part, made literal.

Troubleshooting

• Node never appears. Check the machine has outbound internet and the token isn’t revoked or expired. For a fleet, mint a fresh registration token with lbr cp registration-token create <cluster> --name <name>.
• NotReady after joining. The CNI is installing; give it a minute. If it persists, check the node’s clock is in sync.
• Unsupported distro. The installer needs apt or dnf (Debian/Ubuntu or RHEL/Fedora/Rocky) on amd64/arm64; on anything else it stops cleanly.