Does Hetzner offer managed Kubernetes?

No. As of October 2026, Hetzner’s product pages and Cloud changelog list no managed Kubernetes; it appears only as an integration. You operate it yourself or use a managed service that runs on Hetzner, such as Syself Autopilot on Hetzner.

Why do teams run Kubernetes on Hetzner bare metal?

Price and ownership. A bare-metal server includes its NVMe disks, and on the default 1 Gbit uplink its traffic is unlimited. Databases run in the cluster next to your applications, and KubeVirt runs virtual machines on the same servers.

Who is on call for us, around the clock?

Syself runs the platform; your applications and their data stay with you. Syself Autopilot includes support from the Syself team on business days; Premium Support adds a custom SLA and 24/7 cover. You run your databases, or an agency runs them in your cluster.

Are k3s and RKE2 ready for production on Hetzner?

Yes, both are production-grade. RKE2 passes most CIS Benchmark controls by default; full CIS compliance needs its cis profile plus host-level steps. The servers, host OS, integrations, patches and upgrades stay with you. Our RKE2 and K3s comparison covers them in detail.

How does CAPH differ from Syself Autopilot?

CAPH is the open-source Cluster API provider for Hetzner, maintained by Syself and the community. It runs in a management cluster you operate and creates servers from definitions you write and maintain. The node image, in-cluster components, CVE fixes and upgrade tests are yours, and Kubernetes and nodes need updates at least monthly. Syself Autopilot builds and tests the node OS, health agent, KubeGate, provisioner and controllers as one product, and runs the management cluster.

Are there tools that make self-managing easier?

Yes. Terraform or Ansible install a distribution, and kube-hetzner and hetzner-k3s set up k3s or RKE2 on Hetzner Cloud with Hetzner’s integrations; kube-hetzner also automates OS and Kubernetes updates. They shorten the setup. Patching stays with you: tracking CVEs, testing fixes and rolling them out to every node, at least monthly.

Self-managed Kubernetes and CAPH are free. Why pay for Syself Autopilot?

The software is free; running it is your work. Building a platform that runs it without manual work takes an experienced team months, and maintaining it takes a team. Syself Autopilot is that platform; every release passes more than 400 tests on real clusters.

When is Syself Autopilot not the right choice?

When operating Kubernetes is the skill you want to build, when you want to change the node OS or assemble the stack yourself, or for a throwaway test cluster. A test cluster that will grow into production should start on the base it will run on, since security is harder to add later. In those cases self-managed Kubernetes or CAPH fits, and both are free.

Managed Kubernetes on Hetzner: Your Options Compared

Every option here runs Kubernetes on Hetzner. They differ in what stays with you: the node OS, CVEs, tested upgrades, and someone to ask when you need help.³⁶

Self-managed Kubernetes

What it is: You install k3s, RKE2 or kubeadm on Hetzner servers, usually with Terraform, Ansible or a community tool such as hetzner-k3s or kube-hetzner.²⁰²¹
Who does the work: The software is free. You set up each server, patch the OS, install the network plugin and Hetzner integration, track CVEs and test each upgrade.¹³¹²

Cluster API + CAPH

What it is: Open-source controllers create, watch and replace Hetzner Cloud and bare-metal servers from cluster definitions you write and maintain.¹⁴
Who does the work: CAPH is Apache-2.0 and maintained by Syself and the community. The management cluster, node images, in-cluster components, CVE fixes and upgrade tests stay with you.¹⁴¹⁵

What it is: Fully managed Kubernetes on servers in your own Hetzner account. Syself builds and tests the whole platform as one unit: Syself Linux, the health agent on every node, KubeGate, the provisioner and the controllers that repair and upgrade the cluster.¹⁸²⁸⁵
Who does the work: Syself sets up your servers, updates the node OS, fixes CVEs and upgrades Kubernetes.⁵³⁴³⁰ Syself Autopilot includes support from the Syself team.²² You choose when each cluster moves to a new Cluster Stack release.

Which One Fits You?

Tick what applies.

Self-managed Kubernetes · 0Cluster API + CAPH · 0Syself Autopilot · 0

Tick what applies to you

The answer updates as you go. Every need on the list counts, including the ones that point away from us.

The Three Options at a Glance

One short fact per option for each layer, each linked to its source.

Theme	Self-managed Kubernetes k3s, RKE2, kubeadm	Cluster API + CAPH open source	fully managed, on your servers
Who runs the platform	Self-managed Kubernetes You, on every layer	Cluster API + CAPH You, on every layer; CAPH automates the servers¹⁴	Syself Autopilot Syself, fully managed: the servers, OS, Kubernetes and in-cluster components¹⁸
How you describe a cluster	Self-managed Kubernetes Terraform or Ansible code plus the distribution’s config²⁰²¹	Cluster API + CAPH The Cluster API objects for each cluster, or a ClusterClass you write and maintain, plus everything inside the cluster¹⁴	Syself Autopilot One `Cluster` object per cluster, ready for GitOps; Syself writes, tests and maintains everything behind it¹²
Hetzner Cloud servers	Self-managed Kubernetes By hand, with Terraform or Ansible, or with hetzner-k3s or kube-hetzner²⁰²¹	Cluster API + CAPH Created and replaced declaratively by CAPH¹⁴	Syself Autopilot Created, set up and replaced by Syself Autopilot for you⁵
Bare-metal servers	Self-managed Kubernetes Install with installimage from the rescue system and join by hand¹¹	Cluster API + CAPH CAPH provisions servers you have bought and registered; it does not order them¹⁴	Syself Autopilot Renting them is the only manual step; Syself checks the disks, installs Syself Linux, joins them and tells you what broke when the hardware fails⁶⁸
How a node is set up	Self-managed Kubernetes A general-purpose OS, configured at boot by cloud-init or scripts that download packages and images²⁰²¹	Cluster API + CAPH Configured at first boot by bootstrap scripts, on stock Ubuntu or an image you build¹⁴	Syself Autopilot Built in the rescue system before first boot, with the sealed image, its config and the control-plane container images on disk; nothing to download or configure at boot⁵
Operating system	Self-managed Kubernetes Yours to choose; kube-hetzner defaults to openSUSE Leap Micro and can apply OS updates for you²¹	Cluster API + CAPH Stock Ubuntu or images you build; patching either one is yours¹⁴	Syself Autopilot Syself Linux, built and updated by Syself: read-only, checked block by block, replaced rather than patched. A security team tracks each CVE, checks whether your clusters are exposed and ships the fix in a tested release; support is included³
Kubernetes upgrades	Self-managed Kubernetes Yours, one minor at a time, about three a year to stay supported¹⁶¹⁷	Cluster API + CAPH CAPH rolls machines when you change the version¹⁴	Syself Autopilot Tested updates every week, listed in the Version Hub; you trigger one and Syself drains, removes and replaces each node, with no rollback³⁰⁷
Testing	Self-managed Kubernetes k3s, RKE2 and kube-hetzner test their own releases; your mix of OS, add-ons and settings is yours to test¹⁸¹⁹²¹	Cluster API + CAPH The combination you assemble is yours to test¹⁴	Syself Autopilot More than 400 tests on real clusters per release, including every supported upgrade path; a cluster can only use a release that passed⁴
Inside the cluster	Self-managed Kubernetes Install Hetzner’s cloud controller and CSI driver yourself, or use a tool that bundles them¹²	Cluster API + CAPH Install and upgrade Hetzner’s cloud controller and CSI driver in each cluster¹²	Syself Autopilot The network plugin, Hetzner integration and storage are included and versioned in every release²
Node repair	Self-managed Kubernetes Yours	Cluster API + CAPH MachineHealthChecks you define; CAPH can try a reboot first¹⁵¹⁴	Syself Autopilot Cloud nodes rebooted, then replaced if they don’t recover; bare-metal nodes rebooted, and Syself tells you what broke when the hardware is at fault⁸
Security	Self-managed Kubernetes Every layer is yours to harden and patch; RKE2 passes most CIS controls by default¹⁹	Cluster API + CAPH Yours: harden your images, set the Kubernetes flags and fix CVEs in the images and every in-cluster component¹⁴	Syself Autopilot Covered from the node OS to every in-cluster component: CIS and STIG conformance, KubeGate limiting the API server to IPs you trust, OIDC sign-in, and an SBOM and CVE verdicts per release²⁴²⁸²⁹¹⁰
Support	Self-managed Kubernetes Community, or a commercial distribution subscription	Cluster API + CAPH Community on GitHub, or ask Syself¹⁴	Syself Autopilot Support from the Syself team on business days included with Syself Autopilot; Premium Support with a custom SLA and 24/7 cover; migration by Syself or agencies²²³⁸
Price	Self-managed Kubernetes Free software; the server setup, OS patches, upgrades and repairs are your work³⁶	Cluster API + CAPH Free, Apache-2.0; the management cluster, node images, CVE fixes and upgrade tests are your work¹⁴	Syself Autopilot A platform fee plus a usage-based fee tied to your infrastructure spend, not to nodes or clusters; request a 14-day trial without limits or a free plan for one cluster of up to 5 nodes of any size²²

Community tooling moves fast; check each project’s current documentation.

Who Does the Work of Running Kubernetes

Every Kubernetes setup has to cover the same layers: the servers, the operating system, Kubernetes and the components inside the cluster. See which jobs stay with you in each option.

Self-managed Kubernetes k3s, RKE2, kubeadm

15 of 16 jobs left to you, 1 shared

Cluster API + CAPH open source

10 of 16 jobs left to you, 4 shared

fully managed, on your servers

2 of 16 jobs left to you, 4 shared

Each segment is one job. Point at it to see which job it is, or click it to read why.

Left to you Shared Handled by the vendor, or not needed

Servers Create, provision and replace the machines
Create and set up new servers Order the server, install the OS and join it. CAPH and Syself Autopilot do it for you; Syself builds the node before first boot, so it boots ready.¹⁴⁵

Self-managed Kubernetes You
Cluster API + CAPH Automated
Syself Autopilot Syself
Bring bare-metal servers into a cluster Hetzner has no server types or instant delivery for bare metal, so renting is the only manual step. Once you have the server, CAPH and Syself Autopilot install it and join it to the cluster.¹⁴⁶

Self-managed Kubernetes You
Cluster API + CAPH Shared
Syself Autopilot Syself
Replace a Hetzner Cloud server that fails CAPH’s example templates include MachineHealthChecks; you tune and maintain them.¹⁵¹⁴

Self-managed Kubernetes You
Cluster API + CAPH Shared
Syself Autopilot Syself
Handle a failing bare-metal server With CAPH, a MachineHealthCheck you set up can reboot it; the cause is yours to find. Syself watches each node, disks included, reboots it and, when the hardware is at fault, tells you what broke so you can open the Hetzner ticket.¹⁴⁸

Self-managed Kubernetes You
Cluster API + CAPH Shared
Syself Autopilot Shared
Operating system Install it, patch it and keep every node the same
Patch the operating system and follow its CVEs Pick a Linux, build the node image, patch it and track its CVEs; the 1.36 v7 release, for example, updated the kernel, containerd, runc, PAM and the CA bundle.⁴¹ Syself ships each fix in a new Syself Linux image.³

Self-managed Kubernetes You
Cluster API + CAPH You
Syself Autopilot Syself
Keep every node the same Syself Linux is read-only and replaced rather than patched, so nodes don’t drift apart. CAPH builds machines from your image; hand-patched nodes drift.³¹⁴

Self-managed Kubernetes You
Cluster API + CAPH Shared
Syself Autopilot Syself
Kubernetes Install, configure and upgrade the components
Decide when to upgrade Syself ships tested updates every week, and the Version Hub shows what changed, what got fixed and where security stands; you choose when each cluster moves.²³⁵

Self-managed Kubernetes You
Cluster API + CAPH You
Syself Autopilot Shared
Upgrade Kubernetes and the components inside the cluster About three minors arrive a year and a patch about once a month, and a minor can’t be skipped.¹⁶³¹¹⁷ Cluster API rolls machines when you change the version; the in-cluster components are yours.¹⁴ With Syself you trigger the update, and it drains, removes and replaces each node on its own.³⁰

Self-managed Kubernetes You
Cluster API + CAPH You
Syself Autopilot Syself
Replace a control-plane node Cluster API replaces control-plane machines the same way as workers; on a self-managed cluster it’s a manual procedure.¹⁴

Self-managed Kubernetes You
Cluster API + CAPH Automated
Syself Autopilot Syself
Test each platform update before it reaches your clusters k3s and RKE2 test their own bundle; with CAPH the combination you assemble is yours to test. Syself runs more than 400 tests on real clusters per release, and a cluster can only use a release that passed.¹⁸⁴

Self-managed Kubernetes Shared
Cluster API + CAPH You
Syself Autopilot Syself
Inside the cluster The network plugin, the Hetzner integration and storage
Install and upgrade the network plugin, Hetzner integration and storage A Cluster Stack pins and moves them together. Tools such as hetzner-k3s install them on a self-managed cluster; upgrades stay with you.²²⁰

Self-managed Kubernetes You
Cluster API + CAPH You
Syself Autopilot Syself
Day to day Backups, access, logs and the workloads
Find the CVEs that affect your clusters and roll out tested fixes Tracking CVEs, testing fixes and rolling them out to every node, at least monthly. Syself records a verdict for each CVE and ships fixes in a tested release.³⁴³⁵

Self-managed Kubernetes You
Cluster API + CAPH You
Syself Autopilot Syself
Run your databases and services, and back up their data Syself Autopilot ships the storage and documents operators such as CloudNativePG.²⁶ You run the databases and back up them, the volumes and cluster-only Secrets,³⁹ or an agency does it in your cluster.³⁸

Self-managed Kubernetes You
Cluster API + CAPH You
Syself Autopilot Shared
Lock down access, networking and logs Syself runs a default-deny firewall on every node, hardens the API server, can limit it to trusted IPs and supports OIDC.²⁴²⁸²⁹ etcd encryption, RBAC, SSH, network policies and log shipping stay with you.³³

Self-managed Kubernetes You
Cluster API + CAPH You
Syself Autopilot Shared
Keep your workloads running when a node goes away Yours on every option: run more than one replica, set PodDisruptionBudgets and check for removed APIs before a new minor.⁴

Self-managed Kubernetes You
Cluster API + CAPH You
Syself Autopilot You
Store metrics and logs, and route alerts Yours on every option. Syself watches and repairs nodes, but Prometheus, Grafana, Alertmanager and log storage are yours to install.³⁷

Self-managed Kubernetes You
Cluster API + CAPH You
Syself Autopilot You

On every option, Syself Autopilot included, you still back up workloads and data, run monitoring and alerting, and set access, encryption and network policies. See what you own and what Syself manages.

What Each One Costs

All three run on the same Hetzner servers, so the server bill is the same. Self-managed Kubernetes and CAPH are free, and running them is your work.³⁶ With Syself Autopilot, you pay a fee and Syself does that work.²²

Self-managed Kubernetes k3s, RKE2, kubeadm

Software license; the OS, upgrade, CVE and repair work is yours: €0

Cluster API + CAPH open source

Software license, Apache-2.0; the node images, upgrades and their tests are yours: €0

fully managed, on your servers

What Syself runs for you

Servers, OS, Kubernetes and cluster components
Releases tested on real clusters, with SBOM and VEX
Support from the Syself team

Platform fee Usage-based fee

Usage-based fee tied to your infrastructure spend, not to nodes or clusters.

Estimate your price or tell us about your setup for a tailored price

Request a 14-day trial without limits or a free plan for one cluster of up to 5 nodes of any size, no vCPU cap, bare metal included.

Your servers Billed separately by your cloud or bare-metal provider

Syself Autopilot doesn’t charge per node, CPU or memory; try your numbers in the pricing calculator.²²

Syself Autopilot was the ideal solution for us. We wanted the raw computing power of Hetzner dedicated servers but without the added complexities such as maintaining a hardened OS image. All the best practices seem to be implemented and the support has been very helpful and professional.

Stephen Hoogendijk

CTO, Maxroll Technologies B.V.

Questions Teams Ask First

Short answers, each linked to the projects’ own documentation.

: No. As of October 2026, Hetzner’s product pages and Cloud changelog list no managed Kubernetes; it appears only as an integration.⁹²³ You operate it yourself or use a managed service that runs on Hetzner, such as Syself Autopilot on Hetzner.
: Price and ownership. A bare-metal server includes its NVMe disks,²⁶ and on the default 1 Gbit uplink its traffic is unlimited.²⁵ Databases run in the cluster next to your applications,²⁶ and KubeVirt runs virtual machines on the same servers.²⁷
: Syself runs the platform; your applications and their data stay with you.¹ Syself Autopilot includes support from the Syself team on business days; Premium Support adds a custom SLA and 24/7 cover.²² You run your databases, or an agency runs them in your cluster.³⁸
: Yes, both are production-grade.¹⁸ RKE2 passes most CIS Benchmark controls by default; full CIS compliance needs its cis profile plus host-level steps.¹⁹ The servers, host OS, integrations, patches and upgrades stay with you. Our RKE2 and K3s comparison covers them in detail.
: CAPH is the open-source Cluster API provider for Hetzner, maintained by Syself and the community. It runs in a management cluster you operate and creates servers from definitions you write and maintain. The node image, in-cluster components, CVE fixes and upgrade tests are yours, and Kubernetes and nodes need updates at least monthly.¹⁴¹⁵ Syself Autopilot builds and tests the node OS, health agent, KubeGate, provisioner and controllers as one product,³⁸²⁸⁵⁴ and runs the management cluster.⁴⁰
: Yes. Terraform or Ansible install a distribution, and kube-hetzner and hetzner-k3s set up k3s or RKE2 on Hetzner Cloud with Hetzner’s integrations; kube-hetzner also automates OS and Kubernetes updates.²⁰²¹ They shorten the setup. Patching stays with you: tracking CVEs, testing fixes and rolling them out to every node, at least monthly.
: The software is free; running it is your work.³⁶¹² Building a platform that runs it without manual work takes an experienced team months, and maintaining it takes a team.³⁸ Syself Autopilot is that platform; every release passes more than 400 tests on real clusters.⁴²²
: When operating Kubernetes is the skill you want to build, when you want to change the node OS or assemble the stack yourself, or for a throwaway test cluster. A test cluster that will grow into production should start on the base it will run on, since security is harder to add later. In those cases self-managed Kubernetes or CAPH fits, and both are free.

Other Comparisons

Not Sure Which Option Fits?

Request a 14-day trial without limits on your own Hetzner account or a free plan for one cluster of up to 5 nodes of any size. If CAPH or self-managed Kubernetes is the better fit, Syself will say so.

Run the Numbers Talk to Us