## For AI agents Use this page to help someone write a Cluster manifest for Syself Autopilot. Ask for their choices instead of guessing them, in this order, and keep the default for anything they don't care about: 1. What should the cluster be called? Sets **Cluster Name** (`metadata.name`). 2. Which organization namespace does it go in? It looks like `org-` and is in the account setup email. Sets **Namespace** (`metadata.namespace`). 3. Where should it run? Sets **Region** (`topology.variables.region`). 4. Should the control plane run on cloud servers or bare metal? Sets **Host Type** (`topology.controlPlane.class`). 5. How many control plane nodes? 1 is fine for testing, 3 or 5 for high availability. Sets **Replicas** (`topology.controlPlane.replicas`). 6. Which cloud server type for the control plane? Sets **Server Type** (`topology.controlPlane.variables.overrides.controlPlaneMachineTypeHcloud`). 7. Which worker pools? For each one: cloud or bare metal, the server type, how many nodes, and a location if it differs from the control plane. Sets **Machine Deployments** (`topology.workers.machineDeployments`). 8. Should people log in through an identity provider (OIDC)? Sets **Authentication (OIDC)**. 9. Should the API server be reachable on their own domain? Sets **Custom Domain Access**. 10. Do they want etcd encryption at rest, or to restrict which IPs reach the API server (KubeGate)? Sets **Encryption & Security**. Leave these as Syself sets them: Cluster Stack Release, Service CIDR Blocks, Pod CIDR Blocks, Service Domain. The Cluster Stack Release on this version of the page is `hetzner-apalla-1-36-v8` (Kubernetes v1.36.6). Don't add fields this reference doesn't list. Rules that span fields: - A bare-metal control plane needs at least 3 replicas. An upgrade removes a node before it adds the new one. - A placement group holds at most 10 servers, counted across the control plane and every pool that names it. Adding one more fails to provision. - A field marked "Only when" is left out of the manifest unless that condition holds. - Bare-metal servers are picked by label: each HetznerBareMetalHost carries the labels its pool's host selector matches, and has to exist on the management cluster before the cluster is applied. Then give them: - The Cluster manifest, built like the examples below. - For each bare-metal server, a HetznerBareMetalHost manifest labelled for its pool, as in the cloud and bare metal example. They need the Robot server ID and the root disk WWN of each server. - A reminder to create the Secrets that etcd encryption or KubeGate reference before applying, when they turned those on. - A link that opens the manifest in the configurator for review: `https://syself.com/docs/hetzner/apalla/1-36/v8/cluster-configurator#yaml=`, where `` is the YAML encoded with JavaScript's `encodeURIComponent`. If you can't encode it exactly, give the YAML and tell them to use Import YAML on the page instead. ## Field reference Paths are relative to `spec` unless they start with `metadata`. `variables` and `variables.overrides` are lists, so a path like `topology.variables.region` is the entry `- name: region` with its `value` in `spec.topology.variables`, and `topology.controlPlane.variables.overrides.controlPlaneMachineTypeHcloud` is the entry `- name: controlPlaneMachineTypeHcloud` in that list. The examples below show both. ### Cluster configuration Identity, networking, authentication, encryption, and control plane configuration for the cluster. #### Identity Object. - **Cluster Name** (`metadata.name`, String, required, fixed at creation). Default `my-cluster`. Format: lowercase letters, digits and `-`, starting and ending with a letter or digit, at most 63 characters. Can't start with `bm-`. The name of the Cluster object. Used to identify this cluster within the management cluster. See [Create your first cluster](https://syself.com/docs/hetzner/apalla/getting-started/create-your-first-cluster). - **Namespace** (`metadata.namespace`, String, required, fixed at creation). Default `org-prod`. Format: lowercase letters, digits and `-`, starting and ending with a letter or digit, at most 63 characters. The namespace of your organization, in the format org-. Find the exact value in your account setup email. See [account setup guide](https://syself.com/docs/hetzner/apalla/getting-started/access-the-management-cluster). - **Cluster Labels** (`metadata.labels`, Map, optional). A map, written as `key: value` pairs. Labels on the Cluster object itself, labels are a standard Kubernetes concept that exists on any Kubernetes object and have no effect on the cluster itself. They can be useful for filtering cluster objects and are not propagated to nodes. - **Cluster Annotations** (`metadata.annotations`, Map, optional). A map, written as `key: value` pairs. Annotations on the Cluster object itself. Annotations are a standard Kubernetes concept that exists on any Kubernetes object and have no effect on the cluster itself. They can be used to attach arbitrary metadata to objects. - **Cluster Stack Release** (`topology.classRef.name`, String, required). Default `hetzner-apalla-1-36-v8`. Set by Syself, leave it as it is. Change the release with the version selector, or follow the Upgrade Guide for an existing cluster. References a specific Cluster Stack release. To choose a release for a new cluster, see [Cluster Stacks](https://syself.com/docs/hetzner/apalla/concepts/foundations/cluster-stacks). Updating this value upgrades the cluster's Kubernetes version. To upgrade an existing cluster, go to the [upgrade guide](https://syself.com/docs/hetzner/apalla/clusters/upgrades/upgrade-to-a-new-kubernetes-version) and follow the steps. #### Control Plane Object. Configuration for the machines running the cluster's control plane, the Kubernetes API server and core components. - **Load Balancer Type** (`topology.variables.clusterLoadBalancerType`, String, optional). Default `lb11`. One of `lb11`, `lb21`, `lb31`. Hetzner load balancer type for control plane API traffic. Changing this also resizes an existing cluster's load balancer. See the [load balancer guide](https://syself.com/docs/hetzner/apalla/network/load-balancing/configure-a-load-balancer). - **Region** (`topology.variables.region`, String, required). Default `fsn1`. One of `fsn1` (DE), `nbg1` (DE), `hel1` (FI), `sin` (SG), `ash` (US), `hil` (US). Hetzner location for the control plane's load balancer. On HCloud, this also places the control plane's servers. Machine deployments default to this same location unless they set their own failureDomain. See [Hetzner's location list](https://docs.hetzner.com/cloud/general/locations/). - **Host Type** (`topology.controlPlane.class`, String, required). Default `hcloud`. One of `hcloud` (HCloud), `hetznerbaremetal` (Bare Metal). Which infrastructure backs the control plane. One of hcloud or hetznerbaremetal. See [Bare-metal control planes](https://syself.com/docs/hetzner/apalla/clusters/configure/fully-bare-metal-cluster). - **Bare Metal Host Selector** (`topology.controlPlane.variables.overrides.controlPlaneHostSelectorBareMetal`, Object, optional). Only when Host Type is `hetznerbaremetal`. Written as `matchLabels` `cluster: ` and `role: controlplane`. Give every HetznerBareMetalHost meant for it the same labels. Selects existing HetznerBareMetalHost objects on the management cluster, in the namespace for your organization, for use by this control plane. See: [adding bare-metal servers](https://syself.com/docs/hetzner/apalla/servers-and-nodes/bare-metal/add-bare-metal-servers). - **Server Type** (`topology.controlPlane.variables.overrides.controlPlaneMachineTypeHcloud`, String, required). Default `cpx32`. Only when Host Type is `hcloud`. A cloud server type from the server types table, allowed for the control plane offered at the location in `region`. Setting it also writes `topology.controlPlane.variables.overrides.controlPlaneMachineArchHcloud`: `amd64`. Hetzner server type for control plane machines. See the [server sizing guide](https://syself.com/docs/hetzner/apalla/servers-and-nodes/cloud/server-types-and-sizing). - **Replicas** (`topology.controlPlane.replicas`, Integer, required). Default `3`. One of `1`, `3`, `5`. Number of control plane nodes. See the [HA control plane guide](https://syself.com/docs/hetzner/apalla/clusters/configure/configure-control-planes). ##### Placement Group Object, optional. Only when Host Type is `hcloud`. Names a placement group for the control plane's machines, spread across separate physical hosts for fault tolerance. Whatever name you type here, automatically shows up in the [Placement groups section](#placement-groups) of Cluster configuration. See [Spread nodes with placement groups](https://syself.com/docs/hetzner/apalla/servers-and-nodes/cloud/placement-groups). We recommend giving the control plane its own placement group, separate from worker pools this way a growing worker pool can never push it past the 10-server limit. - **Placement Group Name** (`topology.controlPlane.variables.overrides.controlPlanePlacementGroupNameHcloud`, String, optional). - **Control Plane Labels** (`topology.controlPlane.metadata.labels`, Map, optional). Label keys: `node.cluster.x-k8s.io/: `. Labels for the control plane, merged onto the actual Control Plane Machines it creates. See: [Label nodes and assign roles](https://syself.com/docs/hetzner/apalla/servers-and-nodes/labels/label-nodes-and-assign-roles). #### Cluster Network Object. Cluster networking configuration. Syself templates a working default for the service CIDR, pod CIDR and service domain, shown for reference, they're not meant to be edited. See [pod and service subnet guide](https://syself.com/docs/hetzner/apalla/network/egress/configure-pod-and-service-subnets). - **Service CIDR Blocks** (`clusterNetwork.services.cidrBlocks`, String array, required). Default `100.96.0.0/16`. Format: a CIDR block, like `100.96.0.0/16`. Set by Syself, leave it as it is. CIDR block for Service IPs, already templated in for you. Not meant to be edited, a working default is always set. - **Pod CIDR Blocks** (`clusterNetwork.pods.cidrBlocks`, String array, required). Default `100.64.0.0/11`. Format: a CIDR block, like `100.96.0.0/16`. Set by Syself, leave it as it is. CIDR block for Pod IPs, already templated in for you. Not meant to be edited, a working default is always set. - **Service Domain** (`clusterNetwork.serviceDomain`, String, required). Default `cluster.local`. Set by Syself, leave it as it is. Cluster-internal DNS domain, already templated in for you. Not meant to be edited, a working default is always set. ##### Custom Domain Access Object, optional. Reach the Kubernetes API through your own domain instead of the load balancer's IP. To use this feature, you need to create a load balancer manually on Hetzner before creating the cluster. This load balancer serves only the Kubernetes API. Exposing applications requires a separate load balancer. See the [domain access guide](https://syself.com/docs/hetzner/apalla/clusters/configure/access-through-a-domain). - **API Server Hostname** (`topology.variables.clusterEndpointHost`, String, optional, fixed at creation). Example `cluster.example.com`. Setting it also writes `topology.variables.clusterEndpointPort`: `443`. The domain name you want the API server reachable at, instead of the load balancer IP. Requires a DNS A record pointing to that load balancer. Wait for DNS propagation before creating the cluster. Once the cluster is created, the domain cannot be changed. To use a different domain, delete the cluster and recreate it with the new domain. - **Load Balancer Name** (`topology.variables.clusterLoadBalancerName`, String, optional). Example `my-cluster-lb`. The exact name of the load balancer you created. - **DNS Servers** (`topology.variables.dnsServers`, Array, optional). A list. Each entry must be an IPv4 or IPv6 address. Custom DNS resolvers for this cluster's nodes. Set this when the resolvers baked into the node image don't fit. Leave unset to keep the image defaults. Each entry must be an IPv4 or IPv6 address. - **Placement Groups** (`topology.variables.hcloudPlacementGroups`, Array, optional). Written by the configurator from the placement group names, don't set it directly. A placement group keeps its servers on separate physical hosts, so a single hardware failure can't take down more than one at a time. Set a name in control plane's placement group name, or a machine deployment's placement group name, and it will appear here. Each group is always created with type spread, which forces its members onto different physical hosts for fault tolerance, currently the only placement-group type Hetzner Cloud supports. Hetzner caps every group at 10 servers, combined across every machine deployment that references the same name. Adding an 11th fails to provision. #### Authentication (OIDC) Object, optional. OpenID Connect (OIDC) lets you delegate cluster authentication to an external identity provider. First complete the OIDC setup in your identity provider (Keycloak, Authentik, etc.) and then set these variables on the cluster. OIDC does not have to be enabled at cluster creation, it can be configured later. See the [OIDC guide](https://syself.com/docs/hetzner/apalla/clusters/configure/configure-oidc). Set `issuerUrl` and `clientId` together, or neither. - **Issuer URL** (`topology.variables.oidcIssuerUrl`, String, optional). Example `https://issuer.example.com`. Format: an absolute `https://` URL. Enables OIDC login for this cluster, set this to turn the feature on. Required together with oidcClientID. - **Client ID** (`topology.variables.oidcClientID`, String, optional). Example `my-client-id`. The client ID of the OIDC application you register with your identity provider for this cluster. Required together with oidcIssuerUrl. - **Username Claim** (`topology.variables.oidcUsernameClaim`, String, optional). Example `sub`. Which claim in the ID token becomes the Kubernetes username, depending on your identity provider. - **Groups Claim** (`topology.variables.oidcGroupsClaim`, String, optional). Example `groups`. Which claim in the ID token becomes the user's Kubernetes groups, used to bind RBAC roles by group instead of by individual user. #### Encryption & Security Object, optional. Protects sensitive data stored in your cluster. etcd encryption-at-rest ensures Secrets, ConfigMaps, and other resources in etcd can't be read from raw disk or backups. [KubeGate](https://syself.com/docs/hetzner/apalla/security/restrict-api-server-access) restricts which source IPs can reach the Kubernetes API server. ##### etcdEncryptionSecretRef `topology.variables.etcdEncryptionSecretRef`, Object, optional. Enables etcd encryption-at-rest from a Secret you provide. Set the Secret Name to turn it on. The Secret has to exist in the Cluster's namespace before you apply. See how to create it in [encrypt etcd](https://syself.com/docs/hetzner/apalla/clusters/configure/encrypt-etcd). `name` is required once `secretKey` is set. - **Encryption Secret Name** (`topology.variables.etcdEncryptionSecretRef.name`, String, optional). Example `etcd-encryption`. Format: lowercase letters, digits, `-` and `.`, starting and ending with a letter or digit, at most 253 characters. Setting it also writes `topology.variables.etcdEncryptionSecretRef.enabled`: `true`. Name of the Secret holding the encryption config. Setting it turns encryption on. References a secret, created separately, not part of this Cluster object. Create this Secret on the management cluster, in the same namespace as this Cluster, before you apply the Cluster. - **Encryption Secret Key** (`topology.variables.etcdEncryptionSecretRef.key`, String, optional). Example `config`. Format: letters, digits, `-`, `_` and `.`. Key within the Secret holding the encryption config. Leave it empty to use "config". ##### kubeGatePolicySecretRef `topology.variables.kubeGatePolicySecretRef`, Object, optional. Loads a source-IP allow policy for KubeGate from a Secret you provide. Set the Secret Name to turn it on. The Secret has to exist in the Cluster's namespace before you apply. `name` is required once `secretKey` is set. - **Policy Secret Name** (`topology.variables.kubeGatePolicySecretRef.name`, String, optional). Example `kubegate-policy`. Format: lowercase letters, digits, `-` and `.`, starting and ending with a letter or digit, at most 253 characters. Setting it also writes `topology.variables.kubeGatePolicySecretRef.enabled`: `true`. Name of the Secret holding the policy. Setting it turns KubeGate on. References a secret, created separately, not part of this Cluster object. Create this Secret on the management cluster, in the same namespace as this Cluster, before you apply the Cluster. - **Policy Secret Key** (`topology.variables.kubeGatePolicySecretRef.key`, String, optional). Example `policy.yaml`. Format: letters, digits, `-`, `_` and `.`. Key within the Secret holding the policy. Leave it empty to use "policy.yaml". ### Machine deployments The worker machine deployments that make up this cluster. #### Machine Deployments `topology.workers.machineDeployments`, Array. A list with at least 1 item. Each item has the fields below. - **Name** (`topology.workers.machineDeployments[].name`, String, required). Default `md-0`. Format: lowercase letters, digits and `-`, starting and ending with a letter or digit, at most 63 characters. Can't start with `bm-`. Unique across the items of this list. Generated from the position in the list, and yours to rename. Unique within the cluster. See [Node pools and machine deployments](https://syself.com/docs/hetzner/apalla/servers-and-nodes/pools/node-pools-overview). - **Host Type** (`topology.workers.machineDeployments[].class`, String, required). Default `workeramd64hcloud`. One of `workeramd64hcloud` (HCloud), `workeramd64baremetal` (Bare Metal). Selects the infrastructure this machine deployment runs on. See [Mix cloud and bare-metal pools](https://syself.com/docs/hetzner/apalla/servers-and-nodes/pools/mix-cloud-and-bare-metal). - **Location** (`topology.workers.machineDeployments[].failureDomain`, String, optional). Default `fsn1`. Only when Host Type is `workeramd64hcloud`. One of `fsn1` (DE), `nbg1` (DE), `hel1` (FI), `sin` (SG), `ash` (US), `hil` (US). Which Hetzner location this machine deployment's machines are placed in. See [Add cloud servers](https://syself.com/docs/hetzner/apalla/servers-and-nodes/cloud/add-cloud-servers). - **Server Type** (`topology.workers.machineDeployments[].variables.overrides.workerMachineTypeHcloud`, String, required, fixed at creation). Default `cpx32`. Only when Host Type is `workeramd64hcloud`. A cloud server type from the server types table, allowed for the worker offered at the location in `failureDomain`. Required when class is workeramd64hcloud. Hetzner server type for this machine deployment. - **Bare Metal Host Selector** (`topology.workers.machineDeployments[].variables.overrides.workerHostSelectorBareMetal`, Object, optional). Only when Host Type is `workeramd64baremetal`. Written as `matchLabels` `cluster: ` and `md: `. Give every HetznerBareMetalHost meant for it the same labels. Selects existing HetznerBareMetalHost objects on the management cluster, in the namespace for your organization, for use by this machine deployment. Each host here is labelled with this deployment and cluster name so the selector matches it. Download them and apply them to the management cluster before you create this cluster, or provisioning waits for them. - **Replicas** (`topology.workers.machineDeployments[].replicas`, Integer, required). Default `1`. A whole number, 0 or more. Number of worker nodes in this machine deployment. See [Scale a node pool](https://syself.com/docs/hetzner/apalla/servers-and-nodes/pools/scale-a-pool). - **Placement Group** (`topology.workers.machineDeployments[].variables.overrides.workerMachinePlacementGroupNameHcloud`, String, optional). Only when Host Type is `workeramd64hcloud`. A placement group holds at most 10 servers. Lower Replicas to 10 or fewer to set one. Names a placement group for this machine deployment's machines, spread across separate physical hosts for fault tolerance. Whatever name you type here, automatically shows up in the Placement groups section of Cluster configuration. - **Worker Node Labels** (`topology.workers.machineDeployments[].metadata.labels`, Map, optional). Label keys: `node-role.kubernetes.io/` (one role) and `node.cluster.x-k8s.io/: `. Labels for this machine deployment, merged onto the actual worker Machines it creates. ## Server types Cloud server types the configurator accepts, and where Hetzner sells them. Workers take any of these; the control plane only the ones marked. | Type | vCPU | RAM | Family | Locations | Control plane | | --- | --- | --- | --- | --- | --- | | `cx23` | 2 | 4 GB | Shared vCPU | fsn1, hel1, nbg1 | no | | `cx33` | 4 | 8 GB | Shared vCPU | fsn1, hel1, nbg1 | yes | | `cx43` | 8 | 16 GB | Shared vCPU | fsn1, hel1, nbg1 | yes | | `cx53` | 16 | 32 GB | Shared vCPU | fsn1, hel1, nbg1 | yes | | `cpx11` | 2 | 2 GB | Shared vCPU | ash, hil | no | | `cpx21` | 3 | 4 GB | Shared vCPU | ash, hil | no | | `cpx22` | 2 | 4 GB | Shared vCPU | fsn1, hel1, nbg1, sin | no | | `cpx31` | 4 | 8 GB | Shared vCPU | ash, hil | yes | | `cpx32` | 4 | 8 GB | Shared vCPU | fsn1, hel1, nbg1, sin | yes | | `cpx41` | 8 | 16 GB | Shared vCPU | ash, hil | yes | | `cpx42` | 8 | 16 GB | Shared vCPU | fsn1, hel1, nbg1, sin | yes | | `cpx51` | 16 | 32 GB | Shared vCPU | ash, hil | yes | | `cpx52` | 12 | 24 GB | Shared vCPU | fsn1, hel1, nbg1, sin | yes | | `cpx62` | 16 | 32 GB | Shared vCPU | fsn1, hel1, nbg1, sin | yes | | `ccx13` | 2 | 8 GB | Dedicated vCPU | ash, fsn1, hel1, hil, nbg1, sin | no | | `ccx23` | 4 | 16 GB | Dedicated vCPU | ash, fsn1, hel1, hil, nbg1, sin | yes | | `ccx33` | 8 | 32 GB | Dedicated vCPU | ash, fsn1, hel1, hil, nbg1, sin | yes | | `ccx43` | 16 | 64 GB | Dedicated vCPU | ash, fsn1, hel1, hil, nbg1, sin | yes | | `ccx53` | 32 | 128 GB | Dedicated vCPU | ash, fsn1, hel1, hil, nbg1, sin | yes | | `ccx63` | 48 | 192 GB | Dedicated vCPU | ash, fsn1, hel1, hil, nbg1, sin | yes | Locations: `fsn1` (DE), `nbg1` (DE), `hel1` (FI), `sin` (SG), `ash` (US), `hil` (US). ## Examples ### Cloud only The configurator's defaults: cloud control plane and one cloud worker pool. ```yaml apiVersion: cluster.x-k8s.io/v1beta2 kind: Cluster metadata: name: my-cluster namespace: org-prod spec: clusterNetwork: services: cidrBlocks: ['100.96.0.0/16'] pods: cidrBlocks: ['100.64.0.0/11'] serviceDomain: cluster.local topology: classRef: name: hetzner-apalla-1-36-v8 version: v1.36.6 controlPlane: replicas: 3 variables: overrides: - name: controlPlaneMachineTypeHcloud value: cpx32 - name: controlPlaneMachineArchHcloud value: amd64 workers: machineDeployments: - name: md-0 class: workeramd64hcloud replicas: 1 failureDomain: fsn1 variables: overrides: - name: workerMachineTypeHcloud value: cpx32 variables: - name: clusterLoadBalancerType value: lb11 - name: region value: fsn1 ``` ### With OIDC Login through an identity provider. Issuer URL and Client ID come from the provider. ```yaml apiVersion: cluster.x-k8s.io/v1beta2 kind: Cluster metadata: name: my-cluster namespace: org-prod spec: clusterNetwork: services: cidrBlocks: ['100.96.0.0/16'] pods: cidrBlocks: ['100.64.0.0/11'] serviceDomain: cluster.local topology: classRef: name: hetzner-apalla-1-36-v8 version: v1.36.6 controlPlane: replicas: 3 variables: overrides: - name: controlPlaneMachineTypeHcloud value: cpx32 - name: controlPlaneMachineArchHcloud value: amd64 workers: machineDeployments: - name: md-0 class: workeramd64hcloud replicas: 1 failureDomain: fsn1 variables: overrides: - name: workerMachineTypeHcloud value: cpx32 variables: - name: clusterLoadBalancerType value: lb11 - name: region value: fsn1 - name: oidcIssuerUrl value: https://issuer.example.com - name: oidcClientID value: my-client-id - name: oidcUsernameClaim value: email - name: oidcGroupsClaim value: groups ``` ### With a custom domain The API server on the reader's own domain. The load balancer has to exist in Hetzner, with a DNS A record pointing at it, before the cluster is applied. ```yaml apiVersion: cluster.x-k8s.io/v1beta2 kind: Cluster metadata: name: my-cluster namespace: org-prod spec: clusterNetwork: services: cidrBlocks: ['100.96.0.0/16'] pods: cidrBlocks: ['100.64.0.0/11'] serviceDomain: cluster.local topology: classRef: name: hetzner-apalla-1-36-v8 version: v1.36.6 controlPlane: replicas: 3 variables: overrides: - name: controlPlaneMachineTypeHcloud value: cpx32 - name: controlPlaneMachineArchHcloud value: amd64 workers: machineDeployments: - name: md-0 class: workeramd64hcloud replicas: 1 failureDomain: fsn1 variables: overrides: - name: workerMachineTypeHcloud value: cpx32 variables: - name: clusterLoadBalancerType value: lb11 - name: region value: fsn1 - name: clusterEndpointHost value: cluster.example.com - name: clusterEndpointPort value: 443 - name: clusterLoadBalancerName value: my-cluster-lb ``` ### Cloud and bare metal A cloud control plane with one cloud and one bare-metal worker pool. The bare-metal pool picks its servers by label, so each server gets a HetznerBareMetalHost like the one after the cluster, with its own Robot server ID and root disk WWN (the ones here are placeholders). ```yaml apiVersion: cluster.x-k8s.io/v1beta2 kind: Cluster metadata: name: my-cluster namespace: org-prod spec: clusterNetwork: services: cidrBlocks: ['100.96.0.0/16'] pods: cidrBlocks: ['100.64.0.0/11'] serviceDomain: cluster.local topology: classRef: name: hetzner-apalla-1-36-v8 version: v1.36.6 controlPlane: replicas: 3 variables: overrides: - name: controlPlaneMachineTypeHcloud value: cpx32 - name: controlPlaneMachineArchHcloud value: amd64 workers: machineDeployments: - name: md-0 class: workeramd64hcloud replicas: 1 failureDomain: fsn1 variables: overrides: - name: workerMachineTypeHcloud value: cpx32 - name: md-1 class: workeramd64baremetal replicas: 2 variables: overrides: - name: workerHostSelectorBareMetal value: matchLabels: cluster: my-cluster md: md-1 variables: - name: clusterLoadBalancerType value: lb11 - name: region value: fsn1 ``` ```yaml apiVersion: infrastructure.cluster.x-k8s.io/v1beta1 kind: HetznerBareMetalHost metadata: name: bm-1234567 namespace: org-prod labels: cluster: my-cluster md: md-1 spec: serverID: 1234567 rootDeviceHints: wwn: eui.8a2b4c6d8e0f1123 maintenanceMode: false ```