We already create our servers with Terraform or Ansible. What’s missing?

The time after the first run. Terraform creates servers through the Hetzner API with a cloud-init script for first boot; Ansible sets them up over SSH. Neither checks afterwards that a new server joined or that nodes stay healthy and identical. Syself keeps checking each cluster, replaces failed cloud servers and tells you what broke when bare-metal hardware fails.

Is Syself Autopilot built on RKE2 or K3s?

No. Syself Autopilot runs standard upstream Kubernetes on Syself’s own parts: Syself Linux, the Syself Health agent, the Syself provisioner and KubeGate in front of the API server, built and tested as one unit. Your manifests, Helm charts and data move between any conformant clusters.

Why do teams run Kubernetes on Hetzner bare metal?

Price and ownership. A bare-metal server includes its NVMe disks, and traffic on the default 1 Gbit uplink is unlimited. Databases run in the cluster on local disks, and KubeVirt runs virtual machines on the same servers. You run the databases, or an agency runs them for you in your cluster.

Who is on call for us, around the clock?

Syself runs the servers, the operating system, Kubernetes and the in-cluster components; your applications and data stay with you. Syself Autopilot includes support from the Syself team on business days; Premium Support adds a custom SLA and 24/7 cover. Syself or agencies can help you migrate.

Do hetzner-k3s or kube-hetzner close the gap?

They shorten the setup. hetzner-k3s creates Hetzner Cloud servers and installs K3s. kube-hetzner, built on Terraform or OpenTofu, installs K3s or RKE2 on openSUSE Leap Micro and also automates OS and Kubernetes updates. Both add Hetzner’s cloud controller and CSI driver. You then own those tools, the hosts and every upgrade. The Hetzner options page compares that path with Cluster API and Syself Autopilot.

Should we pick K3s or RKE2?

K3s is a single binary under 100 MB for small machines, using SQLite on one server or embedded etcd or an external database for high availability; it suits edge and small clusters. RKE2 is SUSE’s choice for regulated environments: it runs its control plane as static pods and passes most CIS controls by default.

Why does it matter that Syself tests the whole stack?

The kernel, container runtime, kubelet, network plugin, storage and Hetzner integration each ship on their own schedule, and a change in one can break another. You only find that by running them together on real servers through each upgrade. Syself runs more than 400 tests on real clusters per release, including failure tests. With K3s or RKE2, that testing is yours.

How do upgrades and backups compare?

K3s and RKE2 upgrade by hand or through system-upgrade-controller plans, and snapshot etcd every 12 hours by default. Syself ships tested updates every week; you trigger one and it moves the cluster, Syself Linux included, with no rollback. A lost cluster is recreated from its Cluster object and your manifests in Git, so no etcd backup is needed, and Velero covers the rest.

K3s and RKE2 are free. Why pay for Syself Autopilot?

Running Kubernetes on free software is still work. Patching alone means tracking CVEs, testing fixes and rolling them out to every node, at least monthly. Syself does it for a platform fee plus a usage-based fee tied to your infrastructure spend, not to nodes or clusters. Try the pricing calculator.

Syself Autopilot vs K3s / RKE2 (DIY): K3s or RKE2 on Hetzner: Who Keeps It Running?

K3s and RKE2 give you Kubernetes for free, and kube-hetzner even automates OS and Kubernetes updates. You still replace broken cloud servers, follow CVEs and test each upgrade of the OS, Kubernetes and Hetzner add-ons together. Syself Autopilot does that work on your own Hetzner servers.

K3s / RKE2 (DIY)

What it is: K3s and RKE2 are Kubernetes distributions from SUSE’s Rancher team: a bundle of components that installs and configures Kubernetes on a Linux host such as Ubuntu or Debian.¹⁷¹³¹⁴ They don’t create servers or patch the operating system.
Who does the work: You create the servers with Terraform or Ansible and install the distribution.²³³⁹¹⁴ After that, you patch the OS, upgrade Kubernetes and the add-ons, follow CVEs and repair broken nodes.
Where it runs: Most modern Linux hosts, anywhere. On Hetzner, community tools such as hetzner-k3s and kube-hetzner script the setup for you.¹⁴¹⁷²¹²²

What it is: A managed service run by Syself: upstream Kubernetes on your own Hetzner servers. Syself builds, tests and runs the servers, Syself Linux, Kubernetes and the in-cluster components as one unit.¹¹⁰
Who does the work: Syself patches the node OS, sets up each server, upgrades Kubernetes and the in-cluster components together, and replaces failed nodes.³⁵²⁴ Every Cluster Stack release passes more than 400 tests on real clusters, and support is included.¹⁰⁹
Where it runs: Hetzner Cloud and bare-metal servers in your own Hetzner account. Each cluster has its own control plane, never shared with other customers.¹¹²

Which One Fits You?

Tick what applies. The DIY setup wins several of these, and the answer says so.

K3s / RKE2 (DIY) · 0Syself Autopilot · 0

Tick what applies to you

The answer updates as you go. Every need on the list counts, including the ones that point away from us.

Syself Autopilot vs K3s or RKE2, Layer by Layer

One short fact per side, each linked to its source.

Theme	K3s / RKE2 (DIY) with Terraform or Ansible	fully managed, on your servers
Where it runs	K3s / RKE2 (DIY) Any systemd Linux on amd64 or arm64, anywhere; RKE2 also supports Windows workers¹⁴	Syself Autopilot Hetzner Cloud and bare-metal servers¹
Creating servers	K3s / RKE2 (DIY) Terraform or Ansible create them through the Hetzner API; cloud-init, or Ansible over SSH, sets them up²³³⁹²⁵²⁶	Syself Autopilot Built in the rescue system before first boot, so a node boots with nothing to download or configure, without internet or a registry⁵
Bare-metal servers	K3s / RKE2 (DIY) Install Linux and the agent yourself	Syself Autopilot Renting them is the only manual step; Syself Autopilot checks the disks, installs Syself Linux from the rescue system and joins them to the cluster⁸⁵
After a server breaks	K3s / RKE2 (DIY) Terraform finds changes on plan or apply; it doesn’t notice a node that never joined, and nothing replaces a failed server²⁴	Syself Autopilot Cloud nodes rebooted, then replaced if they don’t recover; bare-metal nodes rebooted, and Syself tells you what broke when the hardware is at fault⁴
Operating system	K3s / RKE2 (DIY) Yours to choose and patch, such as Ubuntu, Debian or RHEL; kube-hetzner uses openSUSE Leap Micro, an immutable OS with automatic transactional updates¹⁴²²⁴⁰	Syself Autopilot Syself Linux from release 1.36: about 350 MB, read-only, replaced rather than patched, CVE feed re-audited daily. A security team tracks each CVE, checks whether your clusters are exposed and ships the fix in a tested release; support is included³¹¹
Kubernetes upgrades	K3s / RKE2 (DIY) By hand, or with system-upgrade-controller plans you write¹⁸	Syself Autopilot Tested updates every week, listed in the Version Hub; you trigger one and Syself drains, removes and replaces each node²⁶
Testing	K3s / RKE2 (DIY) SUSE tests the distribution, and kube-hetzner tests its own releases on live Hetzner clusters; your mix of OS, Hetzner add-ons and settings is yours to test²²	Syself Autopilot More than 400 tests on real clusters per release, including every supported upgrade path¹⁰
Inside the cluster	K3s / RKE2 (DIY) RKE2 defaults to Canal, K3s to Flannel; you install Hetzner’s cloud controller and CSI driver, or a tool does²⁰¹⁷²¹	Syself Autopilot Cilium, Hetzner’s cloud integration and storage, included and upgraded together in every release²
Recovering a lost cluster and rollback	K3s / RKE2 (DIY) Snapshots every 12 hours by default, 5 kept (K3s with embedded etcd); restore from a snapshot¹⁶¹⁹	Syself Autopilot Recreated from its Cluster object and your manifests in Git; no etcd backup needed. No rollback; you roll forward, and Velero covers what isn’t in Git⁷⁶
Security evidence	K3s / RKE2 (DIY) RKE2 passes most CIS controls by default, has a DISA STIG and supports FIPS 140-2; you turn on its CIS profile and set up the host and the OS¹⁵¹³⁴¹	Syself Autopilot CIS and STIG conformance; an SBOM and advisories with every release, in the Version Hub¹²¹¹
Support	K3s / RKE2 (DIY) Community, or SUSE Rancher Prime: support under defined SLAs and up to five years of support for RKE2 and K3s; the hosts and the Hetzner tooling stay yours⁴³	Syself Autopilot Support from the Syself team on business days included with Syself Autopilot; Premium Support with a custom SLA and 24/7 cover; migration by Syself or agencies⁹³⁸
Price	K3s / RKE2 (DIY) Free, Apache-2.0; the work of running it is yours	Syself Autopilot A platform fee plus a usage-based fee tied to your infrastructure spend, not to nodes or clusters; request a 14-day trial without limits or a free plan for one cluster of up to 5 nodes of any size⁹

This reflects K3s and RKE2 1.36 and 1.37, and Syself Autopilot 1.36.

Who Does the Work of Running Kubernetes

Terraform or Ansible covers the first setup. These jobs come after it.

K3s / RKE2 (DIY) with Terraform or Ansible

12 of 15 jobs left to you, 3 shared

fully managed, on your servers

0 of 15 jobs left to you, 5 shared

Each segment is one job. Point at it to see which job it is, or click it to read why.

Left to you Shared Handled by the vendor, or not needed

Servers Create, provision and replace the machines
Create and set up new servers Terraform, Ansible, hetzner-k3s or kube-hetzner script it, and you run them. Syself creates and sets up the servers.²¹²²⁵

K3s / RKE2 (DIY) You
Syself Autopilot Syself
Notice when a new server fails to come up cloud-init runs once at boot; a node that never joins raises no alert. Syself checks each provisioning step.²⁶⁵

K3s / RKE2 (DIY) You
Syself Autopilot Syself
Bring bare-metal servers into a cluster Hetzner has no server types or instant delivery for bare metal, so renting is the only manual step. Syself checks the disks, installs the OS from the rescue system and joins it.⁸⁵ With K3s or RKE2 you install Linux and the agent on each server.

K3s / RKE2 (DIY) You
Syself Autopilot Syself
Replace a Hetzner Cloud server that fails Syself reboots it and replaces it from a fresh image if it doesn’t recover.⁴

K3s / RKE2 (DIY) You
Syself Autopilot Syself
Handle a failing bare-metal server Syself reboots the node and, when the hardware is at fault, tells you what broke so you can open the Hetzner ticket. Hetzner has no API for tickets, so that step stays with you.⁴

K3s / RKE2 (DIY) You
Syself Autopilot Shared
Operating system Install it, patch it and keep every node the same
Patch the operating system and follow its CVEs Syself checks each CVE against what a release contains (VEX) and ships fixes in a release built and tested as one; a release with an overdue CVE does not ship.³⁴³ On K3s or RKE2, you scan the hosts and install the fixes.

K3s / RKE2 (DIY) You
Syself Autopilot Syself
Keep every node the same Syself Linux is read-only and every node runs the release’s image.³ Hosts patched in place drift; kube-hetzner’s Leap Micro nodes are immutable, with Kured coordinating reboots.⁴⁰

K3s / RKE2 (DIY) You
Syself Autopilot Syself
Kubernetes Install, configure and upgrade the components
Decide when to upgrade Neither upgrades on its own unless you set it to.¹⁸ Syself ships tested updates every week, and the Version Hub shows what changed, what got fixed and where security stands; you choose when each cluster moves.²³⁴

K3s / RKE2 (DIY) You
Syself Autopilot Shared
Roll every node to the new Kubernetes version Upstream ships monthly patches, and you can’t skip a minor.³⁵ On K3s or RKE2 you write system-upgrade-controller plans and upgrade the OS and add-ons separately.¹⁸ Once you trigger it, Syself drains, removes and replaces each node on its own. Removed APIs are yours on both.

K3s / RKE2 (DIY) Shared
Syself Autopilot Syself
Replace a control-plane node Syself Autopilot replaces control-plane nodes one at a time, and the control plane stays available during the rollout.³⁵ On a DIY cluster you remove and rejoin the etcd member and the node by hand.

K3s / RKE2 (DIY) You
Syself Autopilot Syself
Test each platform update before it ships SUSE tests the distribution; your OS, add-ons and settings are yours to test. Syself runs more than 400 tests on real clusters per release.¹⁰

K3s / RKE2 (DIY) Shared
Syself Autopilot Syself
Inside the cluster The network plugin, the Hetzner integration and storage
Upgrade the network plugin, Hetzner integration and storage together A Cluster Stack pins them and moves them together. hetzner-k3s installs them on a DIY cluster; upgrading them stays with you.²²¹

K3s / RKE2 (DIY) You
Syself Autopilot Syself
Day to day Backups, access, logs and the workloads
Recover a lost cluster K3s and RKE2 snapshot etcd to local disk by default and can upload to S3; restores are yours. Syself recreates a lost cluster from its `Cluster` object and your manifests in Git, so there is no etcd snapshot to restore; Velero covers the rest.¹⁶⁷

K3s / RKE2 (DIY) Shared
Syself Autopilot Shared
Run databases and services, and back up their data Syself ships the storage and documents operators such as CloudNativePG, with point-in-time restore.²⁸ You run the databases, or an agency runs them for you in your cluster.³⁸ The same holds on a DIY cluster.

K3s / RKE2 (DIY) You
Syself Autopilot Shared
Lock down access, networking and logs Syself hardens the API server and firewalls every node by default; certificate checks replace a private network.¹²³⁶ You can restrict the API server by IP and use OIDC.³⁰³¹ RBAC, SSH, network policies, logs and metrics stay yours.³⁷

K3s / RKE2 (DIY) You
Syself Autopilot Shared

On every option, Syself Autopilot included, you still back up workloads and data, run monitoring and alerting, and set access, encryption and network policies. See what you own and what Syself manages.

What Each One Costs

The Hetzner server bill is the same either way. With K3s or RKE2 the software is free and the work is yours. With Syself Autopilot that work is in the fee.

K3s / RKE2 (DIY) with Terraform or Ansible

License, Apache-2.0: €0
SUSE Rancher Prime support: On request

fully managed, on your servers

What Syself runs for you

Servers, OS, Kubernetes and cluster components
Releases tested on real clusters, with SBOM and VEX
Support from the Syself team

Platform fee Usage-based fee

Usage-based fee tied to your infrastructure spend, not to nodes or clusters.

Estimate your price or tell us about your setup for a tailored price

Request a 14-day trial without limits or a free plan for one cluster of up to 5 nodes of any size, no vCPU cap, bare metal included.

Your servers Billed separately by your cloud or bare-metal provider

Syself Autopilot charges a platform fee plus a usage-based fee tied to your infrastructure spend.⁹ SUSE prices Rancher Prime support on request.

Syself Autopilot was the ideal solution for us. We wanted the raw computing power of Hetzner dedicated servers but without the added complexities such as maintaining a hardened OS image.

Stephen Hoogendijk

CTO, Maxroll

Questions Teams Ask Before Switching

Short answers, each linked to the projects’ and Syself’s documentation.

: The time after the first run. Terraform creates servers through the Hetzner API with a cloud-init script for first boot; Ansible sets them up over SSH.²³³⁹²⁵²⁶ Neither checks afterwards that a new server joined or that nodes stay healthy and identical.²⁴ Syself keeps checking each cluster, replaces failed cloud servers and tells you what broke when bare-metal hardware fails.⁴
: No. Syself Autopilot runs standard upstream Kubernetes on Syself’s own parts: Syself Linux, the Syself Health agent, the Syself provisioner and KubeGate in front of the API server, built and tested as one unit.¹³⁴⁵³⁰ Your manifests, Helm charts and data move between any conformant clusters.
: Price and ownership. A bare-metal server includes its NVMe disks, and traffic on the default 1 Gbit uplink is unlimited.²⁷ Databases run in the cluster on local disks,²⁸ and KubeVirt runs virtual machines on the same servers.²⁹ You run the databases, or an agency runs them for you in your cluster.
: Syself runs the servers, the operating system, Kubernetes and the in-cluster components; your applications and data stay with you.¹ Syself Autopilot includes support from the Syself team on business days; Premium Support adds a custom SLA and 24/7 cover.⁹ Syself or agencies can help you migrate.³⁸
: They shorten the setup. hetzner-k3s creates Hetzner Cloud servers and installs K3s. kube-hetzner, built on Terraform or OpenTofu, installs K3s or RKE2 on openSUSE Leap Micro and also automates OS and Kubernetes updates. Both add Hetzner’s cloud controller and CSI driver.²¹²² You then own those tools, the hosts and every upgrade. The Hetzner options page compares that path with Cluster API and Syself Autopilot.
: K3s is a single binary under 100 MB for small machines, using SQLite on one server or embedded etcd or an external database for high availability; it suits edge and small clusters.¹⁷ RKE2 is SUSE’s choice for regulated environments: it runs its control plane as static pods and passes most CIS controls by default.¹³²⁰¹⁵
: The kernel, container runtime, kubelet, network plugin, storage and Hetzner integration each ship on their own schedule, and a change in one can break another. You only find that by running them together on real servers through each upgrade. Syself runs more than 400 tests on real clusters per release, including failure tests.¹⁰ With K3s or RKE2, that testing is yours.
: K3s and RKE2 upgrade by hand or through system-upgrade-controller plans, and snapshot etcd every 12 hours by default.¹⁸¹⁶ Syself ships tested updates every week; you trigger one and it moves the cluster, Syself Linux included, with no rollback. A lost cluster is recreated from its Cluster object and your manifests in Git, so no etcd backup is needed, and Velero covers the rest.²⁷⁶
: Running Kubernetes on free software is still work.³³ Patching alone means tracking CVEs, testing fixes and rolling them out to every node, at least monthly.³⁵ Syself does it for a platform fee plus a usage-based fee tied to your infrastructure spend, not to nodes or clusters.⁹ Try the pricing calculator.