# Syself

> Syself is a Kubernetes management platform that simplifies the deployment, operation, and lifecycle management of production-ready Kubernetes clusters on Hetzner, its first supported provider (both cloud VMs and bare metal servers). Syself runs secure, production-grade Kubernetes on European infrastructure through automation, security hardening, self-healing, zero-downtime upgrades, and declarative GitOps-compatible configurations — no Kubernetes expertise required, at a predictable, usage-based cost.

For the full content version, see: https://syself.com/llms-full.txt

Syself simplifies Kubernetes by eliminating the operational burden of cluster management. The platform, called Syself Autopilot, leverages Cluster API (CAPI) to provide automated provisioning, scaling, self-healing, and zero-downtime upgrades for Kubernetes clusters running on Hetzner Cloud and Hetzner dedicated (bare-metal) servers. Unlike traditional Infrastructure as Code tools such as Terraform or Ansible, Syself continuously reconciles infrastructure state, automatically fixing configuration drift and server failures without human intervention.

Syself is purpose-built for teams that want enterprise-grade Kubernetes without hiring a dedicated infrastructure team. The platform supports cloud virtual machines, bare-metal servers, ARM nodes, and GPU-equipped machines within the same cluster. Features include declarative cluster configuration, GitOps-native workflows compatible with Argo CD and Flux, OIDC-based identity management, managed databases on local NVMe storage, and GDPR-compliant European hosting. Syself maintains and tests hardened OS images, handles Kubernetes version upgrades across all cluster components, and provides Cluster Stacks — versioned, tested bundles that define every aspect of a cluster from the CNI to the OS image.

Syself serves customers across 28 countries, powering infrastructure for over 100 million end users daily. Customers range from startups and agencies to enterprises like LanguageTool (250 bare-metal GPU servers, 20,000 req/s) and educational platforms like eKool (70% of Estonian schools). The company is based in Eschborn, Germany, is a founding member of the Sovereign Cloud Stack Forum, and was awarded the German government's KaaS framework tender (SCS VP-05). Syself offers a 14-day free trial and pricing based on cloud provider spend rather than per-node or per-CPU fees.

## Quickstart

- [Syself Autopilot: Managed Kubernetes You Own](https://syself.com/docs/hetzner/apalla/getting-started/overview): Syself Autopilot is fully managed Kubernetes on your own Hetzner servers. You declare one object; Syself builds, heals, and upgrades the cluster on standard upstream Kubernetes
- [Prerequisites](https://syself.com/docs/hetzner/apalla/getting-started/prerequisites): Install kubectl and kubelogin for your system architecture before you connect to the Syself Autopilot management cluster
- [Accessing the management cluster](https://syself.com/docs/hetzner/apalla/getting-started/access-the-management-cluster): Learn how to access our management cluster to create, update, and scale your Kubernetes clusters with Syself Autopilot
- [Hetzner account preparation](https://syself.com/docs/hetzner/apalla/getting-started/prepare-your-hetzner-account): Prepare your Hetzner account to run Kubernetes nodes on cloud and bare metal servers with Syself Autopilot
- [Creating clusters](https://syself.com/docs/hetzner/apalla/getting-started/create-your-first-cluster): Step-by-step guide to creating Kubernetes clusters on Hetzner with Syself Autopilot. Use Cluster Stacks to deploy production-ready clusters in minutes
- [Access your new cluster](https://syself.com/docs/hetzner/apalla/getting-started/access-your-new-cluster): Fetch the kubeconfig for a workload cluster you just created with Syself Autopilot, point kubectl at it, and confirm every node is Ready
- [Explore your cluster](https://syself.com/docs/hetzner/apalla/getting-started/explore-your-cluster): Run essential kubectl commands to inspect your Syself Autopilot cluster. Learn what healthy nodes, system pods, and events look like on a fresh cluster
- [Deploy your first app](https://syself.com/docs/hetzner/apalla/getting-started/deploy-your-first-app): Deploy a sample application and expose it with a Hetzner Load Balancer using kubectl. See the external IP appear and access your app from the internet
- [Next steps](https://syself.com/docs/hetzner/apalla/getting-started/next-steps): Where to go after deploying your first app on Syself Autopilot: understand the platform, plan for upgrades, work through the security checklist, and run real services

## Documentation

Syself Autopilot docs are versioned: the URLs below carry no version segment and resolve to the current Kubernetes release. See https://syself.com/versions for the maintained version tracks.

### Concepts

- [Concepts](https://syself.com/docs/hetzner/apalla/concepts/overview): Syself Autopilot runs managed upstream Kubernetes on your own Hetzner servers. The two-cluster model, cluster stacks, what Syself operates, what stays yours, and where to read next

#### Foundations

- [Architecture](https://syself.com/docs/hetzner/apalla/concepts/foundations/architecture): Syself builds the whole cluster as one hash-pinned unit and locks it to a release before any node boots, so the boundaries between OS, topology, and cluster components are Syself's to manage, not yours
- [Management and Workload Clusters](https://syself.com/docs/hetzner/apalla/concepts/foundations/management-and-workload-clusters): Understand the role of management and workload clusters in Kubernetes and how Syself Autopilot uses Cluster API to provision and manage infrastructure
- [Inside a Workload Cluster](https://syself.com/docs/hetzner/apalla/concepts/foundations/inside-a-workload-cluster): What a running workload cluster is made of: what sits on a control-plane node, what sits on a worker, how KubeGate fronts the API server, and how the pieces connect over the public internet
- [Cluster Stacks](https://syself.com/docs/hetzner/apalla/concepts/foundations/cluster-stacks): Learn how Cluster Stacks in Syself Autopilot define versioned, tested, and reproducible Kubernetes cluster configurations
- [Declarative Cluster Management](https://syself.com/docs/hetzner/apalla/concepts/foundations/declarative-cluster-management): Your whole cluster is one Kubernetes object, and Syself's controllers keep the running cluster matching it continuously, not just at apply time

#### The operations model

- [The node lifecycle: replacement instead of patching](https://syself.com/docs/hetzner/apalla/concepts/operations/node-lifecycle): A Syself node is built immutable before it boots, never patched while it runs, and replaced with a fresh identical node when it needs to change
- [Fast, Reliable Provisioning](https://syself.com/docs/hetzner/apalla/concepts/operations/fast-reliable-provisioning): Every hard part of building a Syself node happens in a throwaway rescue system before the node boots, so a node either comes up correct or never joins
- [Self-Healing](https://syself.com/docs/hetzner/apalla/concepts/operations/self-healing-and-node-replacement): Syself Autopilot detects node and control plane failures and repairs or replaces the machine automatically
- [Cluster Upgrades](https://syself.com/docs/hetzner/apalla/concepts/operations/cluster-upgrades): How Syself Autopilot moves a cluster to a new tested version by replacing nodes one at a time, with the control plane available throughout
- [Backup and Disaster Recovery](https://syself.com/docs/hetzner/apalla/concepts/operations/backup-and-disaster-recovery): Syself heals your infrastructure but does not back up your data. Know what state exists in a cluster, what survives a node dying, and how each piece comes back
- [The observability model](https://syself.com/docs/hetzner/apalla/concepts/operations/observability-model): Every Syself Autopilot cluster runs live monitoring (metrics-server, Hubble, a node health daemon, audit logs) and you bring the storage, so the metrics, logs, and audit trail stay on storage you own

#### Platform internals

- [Syself Linux](https://syself.com/docs/hetzner/apalla/concepts/internals/syself-linux): The node OS on every server in your cluster is read-only, around 350 MB, immutable, verified by the kernel on every disk read, and replaced instead of patched when it must change
- [Platform Components: KubeGate, syself-agent, and the Tunnel](https://syself.com/docs/hetzner/apalla/concepts/internals/platform-components): The Syself-built pieces that let a Kubernetes node run safely on the public internet: KubeGate in front of a loopback-only API server, the one syself-agent binary, and a reverse mTLS tunnel that nodes dial outward
- [Networking and Cilium](https://syself.com/docs/hetzner/apalla/concepts/internals/networking): How one eBPF layer (Cilium) does pod networking, service load balancing, the host firewall, and network policy in every cluster, and where L7 policy still falls short
- [Minimal Provider Dependency](https://syself.com/docs/hetzner/apalla/concepts/internals/minimal-provider-dependency): Syself Autopilot takes servers and load balancers from Hetzner and nothing else, and never builds a security boundary on the Hetzner private network
- [The Storage Model](https://syself.com/docs/hetzner/apalla/concepts/internals/storage): Syself Autopilot ships one storage backend, network-attached Hetzner Cloud volumes; local disks through TopoLVM are fast but pinned to one machine, so a database on local disk cannot move off that machine
- [Bare Metal](https://syself.com/docs/hetzner/apalla/concepts/internals/bare-metal-and-cloud): Run Kubernetes and high-performance workloads on dedicated bare metal servers. Get predictable performance, dedicated NVMe storage, and improved reliability compared to virtual machines

#### Own it, your way

- [Run Your Own Services](https://syself.com/docs/hetzner/apalla/concepts/ownership/run-your-own-services): Syself runs the cluster; you run the databases, queues, and caches you used to rent, on standard open-source operators, behind the plain Kubernetes API
- [Run It Yourself, or With Help](https://syself.com/docs/hetzner/apalla/concepts/ownership/run-it-yourself-or-with-help): Every service on Syself Autopilot is standard Kubernetes objects in your own cluster, so you can run it yourself, have Syself operate it, or move between the two per service without migrating anything
- [The Economics of Owning vs Renting](https://syself.com/docs/hetzner/apalla/concepts/ownership/economics): Owning your servers costs far less than renting equivalent cloud compute, because renting adds a per-vCPU premium, a per-gigabyte egress bill, and a per-cluster control-plane fee that owning avoids
- [What You Own, What Syself Manages](https://syself.com/docs/hetzner/apalla/concepts/ownership/ownership-and-shared-responsibility): Hetzner runs the hardware, Syself runs the platform and ships the compliance evidence, and you own your workloads and your audit
- [The security model](https://syself.com/docs/hetzner/apalla/concepts/ownership/security-model): Every connection into a Syself Autopilot node authenticates on its own, so a node runs safely on the public internet with no private network. You still configure SSH access and pod-to-pod segmentation
- [Sovereignty and Data Residency](https://syself.com/docs/hetzner/apalla/concepts/ownership/sovereignty-and-data-residency): Why an EU region alone does not make you sovereign, and how Syself Autopilot closes the gap with clusters in your own Hetzner account, a dedicated control plane per cluster, and keys you generate yourself
- [The Kubernetes Layer for Sovereign Cloud Stack (SCS)](https://syself.com/docs/hetzner/apalla/concepts/ownership/sovereign-cloud-stack): Syself builds the Kubernetes-as-a-Service layer for the Sovereign Cloud Stack, and Syself Autopilot runs on that same open standard, so you can prove your cluster's conformance yourself

### Cluster management

#### Define and configure

- [Create a Cluster](https://syself.com/docs/hetzner/apalla/clusters/configure/create-a-cluster): Define a workload cluster as a single Kubernetes Cluster object, choose its Cluster Stack release, size the control plane and worker pools, and apply it to the Syself management cluster
- [HA Kubernetes Control Plane](https://syself.com/docs/hetzner/apalla/clusters/configure/high-availability-control-plane): Choose the right number of Kubernetes cluster control planes for resilience and high availability, based on cluster size and requirements
- [Baremetal Control Planes](https://syself.com/docs/hetzner/apalla/clusters/configure/fully-bare-metal-cluster): Learn how to configure your cluster to use Hetzner baremetal servers for control plane nodes instead of HCloud VMs
- [Run a worker-less cluster](https://syself.com/docs/hetzner/apalla/clusters/configure/worker-less-cluster): Run a control-plane-only cluster for platform components, and know what stops working without workers
- [Using Cluster Autoscaler](https://syself.com/docs/hetzner/apalla/clusters/configure/autoscale-a-cluster): Efficiently manage workloads with the Pod Autoscaler and configure the Cluster Autoscaler to scale nodes in the cluster fully automated
- [Access your cluster through a domain](https://syself.com/docs/hetzner/apalla/clusters/configure/access-through-a-domain): Access and manage your clusters easily by assigning a domain name using Hetzner Load Balancers
- [OIDC configuration for your cluster](https://syself.com/docs/hetzner/apalla/clusters/configure/configure-oidc): Set up OIDC for Kubernetes cluster using token-based auth with your own identity provider and improve your operations
- [Creating SCS compatible clusters](https://syself.com/docs/hetzner/apalla/clusters/configure/scs-compatible-cluster): How to create a Kubernetes cluster compatible with the Sovereign Cloud Stack guidelines
- [Using specific Cluster Stack versions](https://syself.com/docs/hetzner/apalla/clusters/configure/using-specific-clusterstack-versions): Create and manage Kubernetes clusters on Hetzner with specific Cluster Stack versions to have all flexibility regarding the versions of your component stack
- [How to check the Kubernetes version and Cluster Stack](https://syself.com/docs/hetzner/apalla/clusters/configure/how-to-check-the-kubernetes-version-and-stack): Find the Kubernetes version and Cluster Stack release used by a cluster

#### Lifecycle and upgrades

- [Plan maintenance and run prechecks](https://syself.com/docs/hetzner/apalla/clusters/upgrades/plan-maintenance-and-prechecks): What to check before upgrading a Syself Autopilot cluster: deprecated API usage, pod disruption budgets, control plane health, node capacity, and pending CSRs
- [Update within a Kubernetes version](https://syself.com/docs/hetzner/apalla/clusters/upgrades/update-within-a-version): Move a Syself Autopilot cluster to a newer Cluster Stack release on the same Kubernetes minor version: make the release available, then point the cluster at it
- [Upgrade the cluster to a new Kubernetes version](https://syself.com/docs/hetzner/apalla/clusters/upgrades/upgrade-to-a-new-kubernetes-version): Move a running cluster to a new Kubernetes minor version — edit the cluster object, let the nodes roll, and confirm the upgrade finished
- [Cluster API v1beta2](https://syself.com/docs/hetzner/apalla/clusters/upgrades/migrate-a-manifest-to-v1beta2): Learn about the Cluster API v1beta2 update and how it affects your clusters
- [Cluster Stack releases and Kubernetes versions](https://syself.com/docs/hetzner/apalla/clusters/upgrades/kubernetes-version-overview): Overview of every Syself Autopilot Cluster Stack release for Hetzner and the exact Kubernetes version each one ships, including release dates

#### Keep workloads available

- [Prepare workloads for upgrades](https://syself.com/docs/hetzner/apalla/clusters/availability/prepare-workloads-for-upgrades): What an upgrade does to a running workload on Syself Autopilot, and the four rules every workload needs to stay available while nodes are replaced
- [Keep stateless workloads available](https://syself.com/docs/hetzner/apalla/clusters/availability/keep-stateless-workloads-available): Configure replicas, a hard topology spread, a PodDisruptionBudget, readiness probes, and graceful shutdown so a stateless workload stays served through a Syself Autopilot upgrade
- [Keep ingress and load balancers available](https://syself.com/docs/hetzner/apalla/clusters/availability/keep-ingress-and-load-balancers-available): Keep your ingress controller and Hetzner load balancer serving through a Syself Autopilot upgrade with spread ingress replicas, a PodDisruptionBudget, and the right externalTrafficPolicy
- [Keep databases available](https://syself.com/docs/hetzner/apalla/clusters/availability/keep-databases-available): How a database behaves when its node is replaced during a Syself Autopilot upgrade, why a single instance has a short gap, and how a replicated database with failover stays available

#### Cluster workflows

- [Run dev, staging, and prod](https://syself.com/docs/hetzner/apalla/clusters/workflows/run-dev-staging-prod): Stand up separate clusters per environment and promote the same declaration through them
- [Throwaway clusters](https://syself.com/docs/hetzner/apalla/clusters/workflows/throwaway-clusters): Spin up a short-lived cluster for a test, a demo, or a preview, then tear it down cleanly
- [Delete a cluster](https://syself.com/docs/hetzner/apalla/clusters/workflows/delete-a-cluster): Tear a cluster down in the safe order so nothing keeps billing and no data is lost by accident

#### Manage from Git

- [Introduction to GitOps](https://syself.com/docs/hetzner/apalla/clusters/gitops/overview): Efficiently manage Kubernetes resources with GitOps tools for transparent, auditable, and automated deployment in modern cloud-native environments
- [Using Argo CD](https://syself.com/docs/hetzner/apalla/clusters/gitops/set-up-argo-cd): Learn how to set up Argo CD for managing Kubernetes resources, which goes hand in hand with deploying applications - following all GitOps best practices
- [Self-managed GitOps](https://syself.com/docs/hetzner/apalla/clusters/gitops/self-management-pattern): Deploy Argo CD with Helm and build a GitOps workflow that manages the cluster from Git
- [Headless access to Syself Autopilot](https://syself.com/docs/hetzner/apalla/clusters/gitops/headless-access): How to access the Syself Autopilot management cluster without needing to interact with a browser, useful for pipelines and remote servers

#### Troubleshooting

- [Cluster creation fails](https://syself.com/docs/hetzner/apalla/clusters/troubleshooting/cluster-creation-fails): Diagnose why your Syself Autopilot cluster is not coming up, from missing Hetzner secrets and quota limits to stuck machines
- [No servers available in your location](https://syself.com/docs/hetzner/apalla/clusters/troubleshooting/no-servers-available): How to circumvent Hetzner Cloud server unavailability
- [A failed or stuck upgrade, and rollback](https://syself.com/docs/hetzner/apalla/clusters/troubleshooting/stuck-or-failed-upgrade): A stack or Kubernetes upgrade is not completing, so find what is blocking the rollout and how to recover
- [Control-plane and etcd recovery](https://syself.com/docs/hetzner/apalla/clusters/troubleshooting/control-plane-and-etcd-recovery): The API server is flapping or an etcd member is unhealthy, so restore quorum without making it worse
- [Expired certificates](https://syself.com/docs/hetzner/apalla/clusters/troubleshooting/expired-certificates): kubectl reports an expired certificate, so find out whether your kubeconfig or the API server certificate ran out, and renew the right one

### Servers and nodes

- [Servers and nodes](https://syself.com/docs/hetzner/apalla/servers-and-nodes/overview): Add cloud and bare-metal machines to your clusters and keep them running, on your own Hetzner account

#### Provision capacity

- [Adding HCloud servers](https://syself.com/docs/hetzner/apalla/servers-and-nodes/provision/add-cloud-servers): Efficiently manage Hetzner HCloud servers. Choose the server types according to their individual specifications based on your requirements, such as resource-efficient ARM technology
- [Order and prepare a Robot (bare-metal) server](https://syself.com/docs/hetzner/apalla/servers-and-nodes/provision/order-and-prepare-a-robot-server): Buy a Hetzner dedicated server, clear its disks, and find the WWN before you register it
- [How to add baremetal servers to your cluster](https://syself.com/docs/hetzner/apalla/servers-and-nodes/provision/add-bare-metal-servers): Register Hetzner dedicated servers as HetznerBareMetalHost objects and attach them to a cluster
- [Add GPU nodes](https://syself.com/docs/hetzner/apalla/servers-and-nodes/provision/gpu-nodes): Run Nvidia GPU workloads in Kubernetes using Syself Autopilot and Hetzner bare metal servers. Deploy AI, ML, inference, and accelerated compute workloads
- [Using ARM servers](https://syself.com/docs/hetzner/apalla/servers-and-nodes/provision/arm-nodes-legacy): Run ARM (CAX) worker and control-plane nodes on Hetzner Cloud
- [Migrate ARM servers to x86 in your cluster](https://syself.com/docs/hetzner/apalla/servers-and-nodes/provision/migrate-arm-to-x86): Learn how to migrate ARM-based (CAX) nodes to x86 nodes in your Syself Autopilot cluster by updating machine deployment classes and server types
- [Placement Groups](https://syself.com/docs/hetzner/apalla/servers-and-nodes/provision/placement-groups): Managing Hetzner Cloud Placement Groups for Nodes

#### Node pools and roles

- [Node pools and machine deployments](https://syself.com/docs/hetzner/apalla/servers-and-nodes/pools/node-pools-overview): A pool is one entry in your Cluster resource, a class, a machine type, a count, and optional labels
- [Scale a node pool](https://syself.com/docs/hetzner/apalla/servers-and-nodes/pools/scale-a-pool): Change a pool's replica count to grow or shrink it, and Syself Autopilot adds or removes machines to match
- [Labelling and assign roles on nodes](https://syself.com/docs/hetzner/apalla/servers-and-nodes/pools/label-nodes-and-assign-roles): Add labels to a worker pool so every node it creates carries them, and target that pool from pods
- [Mix cloud and bare-metal pools](https://syself.com/docs/hetzner/apalla/servers-and-nodes/pools/mix-cloud-and-bare-metal): Run bare-metal and cloud pools in the same cluster, and put each workload on the tier it belongs on

#### Scheduling controls

- [Node affinity and selectors in practice](https://syself.com/docs/hetzner/apalla/servers-and-nodes/scheduling/node-affinity-and-selectors): Use nodeSelector or node affinity to steer pods onto the right pool, matching the exact labels you set
- [Taints](https://syself.com/docs/hetzner/apalla/servers-and-nodes/scheduling/apply-taints): Why taints are not supported

#### Node OS and customization

- [What you can and cannot change on a sealed node](https://syself.com/docs/hetzner/apalla/servers-and-nodes/node-os/what-you-can-change-on-a-sealed-node): Syself Linux is sealed and read-only, so know what you can change on a running node before you try

#### Node maintenance

- [Remove specific nodes](https://syself.com/docs/hetzner/apalla/servers-and-nodes/maintenance/remove-a-specific-node): Learn how to remove specific nodes from the cluster by annotating the Cluster API's machine objects
- [Rebooting bare metal nodes](https://syself.com/docs/hetzner/apalla/servers-and-nodes/maintenance/reboot-a-bare-metal-server): Reboot bare metal servers for maintenance without triggering a reprovisioning in Syself Autopilot
- [Wiping baremetal server disks](https://syself.com/docs/hetzner/apalla/servers-and-nodes/maintenance/wipe-a-disk): Resolve errors "DetectLinuxOnAnotherDisk failed" when wiping Hetzner server disks. Follow steps for RAID and non-RAID disks
- [DetectLinuxOnAnotherDisk failed in HetznerBareMetalHosts](https://syself.com/docs/hetzner/apalla/servers-and-nodes/maintenance/caph-linux-on-another-disk): Troubleshooting the error message DetectLinuxOnAnotherDisk indicating that our software found Linux /boot/efi partitions on other disks
- [Machine health checks and remediation](https://syself.com/docs/hetzner/apalla/servers-and-nodes/maintenance/machine-health-checks-and-remediation): Syself Autopilot watches your nodes and replaces the ones that go unhealthy on their own, unless you pause it first for planned maintenance

#### Access, debug, and troubleshoot

- [How to SSH into nodes](https://syself.com/docs/hetzner/apalla/servers-and-nodes/access/emergency-ssh-access): Learn how to SSH into nodes using different container images for debugging or other purposes
- [Debug a node](https://syself.com/docs/hetzner/apalla/servers-and-nodes/access/debug-a-node): Get onto a node, read its logs, and work out what's a real problem versus routine noise
- [Node problem detection and conditions](https://syself.com/docs/hetzner/apalla/servers-and-nodes/access/node-problem-detection-and-conditions): Node conditions tell you a node is unhealthy before it fails outright
- [Serial console and rescue system](https://syself.com/docs/hetzner/apalla/servers-and-nodes/access/serial-console-and-rescue): Use the serial console and the Hetzner rescue system to get output and a shell on a node that won't boot
- [Baremetal Servers Rescue Mode](https://syself.com/docs/hetzner/apalla/servers-and-nodes/access/server-not-provisioning): Fix a Hetzner bare-metal server that will not boot the rescue system
- [GPU not scheduling](https://syself.com/docs/hetzner/apalla/servers-and-nodes/access/gpu-not-scheduling): When a GPU pod stays Pending or the card won't work, check the node label, the driver, and activation
- [Certificate expiry and rotation](https://syself.com/docs/hetzner/apalla/servers-and-nodes/access/certificate-expiry-and-rotation): Fix a stuck CertRenewalFailing condition or an expired certificate that's breaking connections

#### Multi-client and fleet

- [Dedicate node pools per client](https://syself.com/docs/hetzner/apalla/servers-and-nodes/fleet/dedicate-node-pools-per-client): Give each client its own pool of nodes, so tenants are isolated by hardware, not just by namespace
- [Size a cluster for cost](https://syself.com/docs/hetzner/apalla/servers-and-nodes/fleet/size-a-cluster-for-cost): Figure out where bare metal beats cloud, and size your pools so you're not overpaying a hyperscaler for capacity you don't use

### Networking

#### Expose applications

- [Exposing applications using Ingress or Gateway API](https://syself.com/docs/hetzner/apalla/network/expose/choose-how-to-expose): Learn how to expose applications on Syself Autopilot using an Ingress Controller or the Gateway API
- [Expose an app with a LoadBalancer Service](https://syself.com/docs/hetzner/apalla/network/expose/service-type-loadbalancer): Place a single application on the internet with a type LoadBalancer Service that the Hetzner cloud-controller-manager turns into a load balancer
- [Install Traefik for HTTP routing](https://syself.com/docs/hetzner/apalla/network/expose/install-traefik): Place many HTTP applications behind one Hetzner load balancer with Traefik. The platform includes no ingress controller, so you install the one you prefer
- [Route traffic with the Gateway API](https://syself.com/docs/hetzner/apalla/network/expose/gateway-api): Use the Gateway API (Gateway and HTTPRoute) instead of Ingress for role-split routing and richer traffic rules on Syself Autopilot
- [Terminate TLS at the ingress](https://syself.com/docs/hetzner/apalla/network/expose/terminate-tls-at-ingress): Hold the certificate at the ingress controller, decrypt HTTPS there, and forward plain HTTP to your pods
- [Serve multiple domains and wildcards](https://syself.com/docs/hetzner/apalla/network/expose/multi-domain-and-wildcard): Host many client domains and wildcard subdomains behind one ingress and one Hetzner load balancer

#### DNS and certificates

- [Understand in-cluster DNS (CoreDNS)](https://syself.com/docs/hetzner/apalla/network/dns-certs/coredns-behavior-and-tuning): How CoreDNS resolves Service names, the ndots cost, and how Syself autoscales it. CoreDNS is platform-managed, so you do not edit or scale it
- [Automate DNS records with external-dns](https://syself.com/docs/hetzner/apalla/network/dns-certs/automatic-dns-with-external-dns): Let external-dns publish and update A and AAAA records for your Services and Ingresses automatically at your DNS provider
- [Install cert-manager](https://syself.com/docs/hetzner/apalla/network/dns-certs/install-cert-manager): Install cert-manager as a normal workload so the cluster can request and renew TLS certificates on its own
- [Set up a Let's Encrypt ClusterIssuer](https://syself.com/docs/hetzner/apalla/network/dns-certs/lets-encrypt-clusterissuer): Create a Let's Encrypt ClusterIssuer and let cert-manager fetch free certificates for every ingress in the cluster
- [Rotate and renew certificates](https://syself.com/docs/hetzner/apalla/network/dns-certs/certificate-rotation-and-renewal): How cert-manager renews certificates before they expire, and how to force, monitor, and recover a rotation
- [Set up private and split DNS](https://syself.com/docs/hetzner/apalla/network/dns-certs/private-and-split-dns): Resolve internal names privately through the cluster's upstream resolver, and keep internal records off the public internet

#### Load balancing

- [Configuring a Hetzner Load Balancer](https://syself.com/docs/hetzner/apalla/network/load-balancing/configure-a-load-balancer): Configure a Hetzner Load Balancer to expose your workload effectively. Annotate the Service for correct IP assignment. Example manifest provided for guidance
- [Tune health checks for node replacement](https://syself.com/docs/hetzner/apalla/network/load-balancing/health-checks-and-node-replacement): Set load balancer health checks so a node being drained and replaced leaves the target pool before it drops traffic
- [Enable PROXY protocol](https://syself.com/docs/hetzner/apalla/network/load-balancing/proxy-protocol): Turn on PROXY protocol so the load balancer forwards the real client IP, and configure the backend to read it
- [Preserving source IP address](https://syself.com/docs/hetzner/apalla/network/load-balancing/preserve-client-source-ip): How to preserve the client's source IP address with Hetzner Load Balancer
- [Serve IPv6 clients](https://syself.com/docs/hetzner/apalla/network/load-balancing/serve-ipv6): Accept IPv6 connections through the Hetzner load balancer while every node and pod stays IPv4-only
- [Handle hairpinning to a Service's own LB IP](https://syself.com/docs/hetzner/apalla/network/load-balancing/hairpinning): Understand why a pod calling its own Service's external load balancer IP can time out, and why the platform CCM makes it work
- [Load balance to bare-metal nodes](https://syself.com/docs/hetzner/apalla/network/load-balancing/bare-metal-lb-targets): How Hetzner Robot bare-metal servers join a load balancer as IP targets, and where they differ from Cloud nodes
- [Pass TLS through at Layer 4](https://syself.com/docs/hetzner/apalla/network/load-balancing/tls-passthrough-and-l4): Terminate TLS inside your pod instead of at the ingress by passing raw TCP or TLS straight through the load balancer

#### Egress and IP addressing

- [Configuring Egress Gateway with Static Node IP](https://syself.com/docs/hetzner/apalla/network/egress/route-egress-through-a-gateway): Learn how to route pod egress traffic through a specific Kubernetes node with a static public IP using Cilium Egress Gateway on Syself Autopilot
- [Pod and Service Subnet Configuration](https://syself.com/docs/hetzner/apalla/network/egress/configure-pod-and-service-subnets): Define Pod and Service subnets by setting CIDR values in YAML format for clusterNetwork under spec. Adjust CIDR Blocks for efficient subnet configuration
- [MTU and the VXLAN tunnel](https://syself.com/docs/hetzner/apalla/network/egress/mtu-and-tunnel-behavior): How Cilium's VXLAN overlay wraps pod traffic and how the resulting MTU affects throughput between nodes
- [Connect to on-prem or another VPC](https://syself.com/docs/hetzner/apalla/network/egress/connect-to-on-prem-or-vpc): Reach a private network, on-prem site, or another cloud VPC from the cluster over a VPN, planning IP ranges so nothing overlaps

#### Service mesh and resilience

- [mTLS and Service Meshes](https://syself.com/docs/hetzner/apalla/network/mesh/choose-a-service-mesh): Learn how service meshes and mutual TLS (mTLS) can provide encryption, service identity, and Zero Trust networking for Kubernetes workloads
- [Handle unreliable networks with Istio](https://syself.com/docs/hetzner/apalla/network/mesh/handle-unreliable-networks-with-istio): Use Istio so brief packet loss between nodes turns into a slightly slower response instead of a visible error
- [Add retries and outlier detection](https://syself.com/docs/hetzner/apalla/network/mesh/retries-and-outlier-detection): Configure Istio retries to save a request that fails right now, and outlier detection to steer traffic away from a pod that keeps failing

#### Debugging and troubleshooting

- [Debug node networking](https://syself.com/docs/hetzner/apalla/network/debug/debug-node-networking): Diagnose the most common node-level network failures using the files and service logs that show what a node actually sees
- [Diagnose pod DNS resolution](https://syself.com/docs/hetzner/apalla/network/debug/diagnose-pod-dns-resolution): Track down why a pod cannot resolve a name, from CoreDNS health to a policy that blocks port 53
- [Run a Cilium connectivity test](https://syself.com/docs/hetzner/apalla/network/debug/run-a-cilium-connectivity-test): Use Cilium's built-in connectivity test and Hubble to prove pod-to-pod, pod-to-Service, and egress paths actually work
- [Troubleshoot load balancers and service traffic](https://syself.com/docs/hetzner/apalla/network/debug/troubleshoot-load-balancers-and-services): A Service has no external IP or traffic is dropped, so trace it from the Hetzner CCM through the host firewall to the pod
- [Network Observability with Hubble](https://syself.com/docs/hetzner/apalla/network/debug/see-flows-with-hubble): Learn how to use Hubble to observe network traffic, troubleshoot connectivity issues, and understand service communication in Kubernetes

### Storage

- [Storage on Syself Autopilot](https://syself.com/docs/hetzner/apalla/storage/overview): The storage backends on a Syself Autopilot cluster, block, local, shared, and object, and when each one fits
- [Access modes and volume binding](https://syself.com/docs/hetzner/apalla/storage/access-modes): What ReadWriteOnce and ReadWriteMany mean on a Syself Autopilot cluster, and why the pod is scheduled first and the storage follows
- [Storage classes reference](https://syself.com/docs/hetzner/apalla/storage/storage-classes-reference): Every StorageClass on a Syself Autopilot cluster with its provisioner, access mode, reclaim policy, expansion, and binding mode
- [Choose storage for a workload](https://syself.com/docs/hetzner/apalla/storage/choose-storage): Pick the right storage on Syself Autopilot from two questions, how many writers and what happens to the data when a node is replaced
- [Host Databases with Syself Autopilot](https://syself.com/docs/hetzner/apalla/storage/run-databases): Run Postgres, MariaDB, ClickHouse, and MongoDB in-cluster on local NVMe storage

#### Block storage

- [Using HCloud storage](https://syself.com/docs/hetzner/apalla/storage/block/use-hcloud-volumes): Use Hetzner volumes on Syself Autopilot clusters through the hcloud CSI driver. Create Persistent Volumes and bind them to pods
- [Expand a Hetzner Cloud volume](https://syself.com/docs/hetzner/apalla/storage/block/expand-a-volume): Grow a Hetzner Cloud volume in place by editing the PVC size, and understand why a volume can only grow, never shrink
- [Volume attach constraints and reclaim policies](https://syself.com/docs/hetzner/apalla/storage/block/attach-constraints-and-reclaim): Cloud volumes attach to one cloud node at a time and are kept, not deleted, when the PVC goes away, so clean them up to stop paying
- [Run a single-writer workload on block storage](https://syself.com/docs/hetzner/apalla/storage/block/run-a-workload-on-block-storage): Wire a StatefulSet or a Recreate Deployment to a cloud volume so it survives node drains without deadlocking on the RWO handoff

#### Local storage

- [Using local storage in bare metal](https://syself.com/docs/hetzner/apalla/storage/local/local-nvme-with-topolvm): Configure Hetzner bare metal servers to use their local storage for high-performance databases
- [Local PV lifecycle: provision, reclaim, wipe](https://syself.com/docs/hetzner/apalla/storage/local/local-pv-lifecycle): Follow a local PVC from thin logical volume to reclaimed space, and free the disk that a Retain policy leaves behind after you delete the claim
- [Data survival across reprovision](https://syself.com/docs/hetzner/apalla/storage/local/data-survival-across-reprovision): Syself Autopilot rewrites the OS disk on every reprovision and never touches your data disks, so local data survives in place unless the workload moves to another server
- [Performance of local vs network storage](https://syself.com/docs/hetzner/apalla/storage/local/local-vs-network-performance): Local disks skip the network hop, so latency stays low and predictable, which is why databases belong on them instead of network-attached storage

#### Shared storage

- [ReadWriteMany (RWX) Storage Options](https://syself.com/docs/hetzner/apalla/storage/shared/readwritemany-with-juicefs): Compare ReadWriteMany (RWX) storage options in Kubernetes and pick one for Syself Autopilot clusters
- [Shared storage with NFS](https://syself.com/docs/hetzner/apalla/storage/shared/nfs-option): Serve a ReadWriteMany filesystem on Syself Autopilot with NFS, using an in-cluster server or the NFS subdir provisioner for dynamic PVCs
- [Choose an RWX backend](https://syself.com/docs/hetzner/apalla/storage/shared/choose-an-rwx-backend): When to share data through object storage instead of a shared filesystem on Syself Autopilot, and how to choose JuiceFS or NFS when you do need ReadWriteMany

#### Object storage

- [Run SeaweedFS for S3-compatible object storage](https://syself.com/docs/hetzner/apalla/storage/object/run-seaweedfs): Deploy SeaweedFS inside a Syself Autopilot cluster as your own S3-compatible object store for buckets, backups, and JuiceFS
- [Use S3-compatible storage from workloads](https://syself.com/docs/hetzner/apalla/storage/object/use-s3-from-workloads): Point an application on Syself Autopilot at an S3-compatible endpoint for uploads, artifacts, and exports instead of a block volume

#### Data protection and DR

- [Backup layers and what needs protecting](https://syself.com/docs/hetzner/apalla/storage/backup/backup-strategy): The two kinds of data on a Syself Autopilot cluster, declared and runtime, and the backup each one needs
- [Backup strategies](https://syself.com/docs/hetzner/apalla/storage/backup/back-up-with-velero): Back up Kubernetes workloads on Syself Autopilot with GitOps and object storage
- [Volume snapshots and their limits](https://syself.com/docs/hetzner/apalla/storage/backup/snapshots-and-limits): Why Syself Autopilot backs up PVC data by file copy instead of CSI volume snapshots, and what that means for your data
- [Run a restore drill](https://syself.com/docs/hetzner/apalla/storage/backup/restore-drill): Rehearse restoring a Syself Autopilot backup into a scratch namespace so you know it works before a real outage
- [Offsite and immutable backups](https://syself.com/docs/hetzner/apalla/storage/backup/offsite-and-immutable-backups): Keep a copy of your Syself Autopilot backups in a second region and lock it with object-lock so ransomware cannot delete it
- [Disaster recovery for stateful data](https://syself.com/docs/hetzner/apalla/storage/backup/disaster-recovery-stateful): A concrete plan to rebuild a lost Syself Autopilot cluster and bring every stateful workload back to a known good point

#### Storage operations

- [Encrypt data at rest with LUKS](https://syself.com/docs/hetzner/apalla/storage/operations/encrypt-data-at-rest): Encrypt local disks at rest on Syself Autopilot with LUKS to meet ISO 27001 and similar requirements. Encrypt once, unlock the disks at boot, and manage your own key
- [Monitor storage capacity](https://syself.com/docs/hetzner/apalla/storage/operations/monitor-storage-capacity): Watch PVC usage, LVM thin-pool fill, and TopoLVM node capacity so you catch a full disk before a workload does
- [Tune storage performance](https://syself.com/docs/hetzner/apalla/storage/operations/tune-storage-performance): Get more out of the disk you have with the right storage class, filesystem, thin-pool sizing, cache, and resource requests
- [Migrate data between storage classes](https://syself.com/docs/hetzner/apalla/storage/operations/migrate-between-storage-classes): Move a workload from cloud volumes to local NVMe, or the reverse, by copying into a new PVC on the target class without losing data
- [Troubleshoot a stuck PVC](https://syself.com/docs/hetzner/apalla/storage/operations/troubleshoot-stuck-pvc): Every reason a PVC sits Pending, a pod will not mount, or a PVC will not delete, with the fix for each symptom

### Observability

- [Observability overview](https://syself.com/docs/hetzner/apalla/observability/overview): What every Syself Autopilot cluster ships for observability, and the metrics, dashboards, logs, traces, and alerts you run yourself on top
- [What ships and what you bring](https://syself.com/docs/hetzner/apalla/observability/what-ships-and-what-you-bring): metrics-server, Hubble, and the node health daemon are built in; Prometheus, Grafana, Loki, tracing, and alerting are not
- [Detection vs retention](https://syself.com/docs/hetzner/apalla/observability/detection-vs-retention): The health daemon detects node problems in real time and drives self-healing; your observability stack retains the evidence so you can investigate after a node is replaced
- [Plan your observability stack](https://syself.com/docs/hetzner/apalla/observability/plan-your-observability-stack): Decide in-cluster versus central, how long to keep data, and how big it will get, before you install anything

#### Collection

- [Using Alloy for observability](https://syself.com/docs/hetzner/apalla/observability/collection/using-alloy-for-observability): Run one Grafana Alloy DaemonSet for infrastructure telemetry and one clustered Alloy StatefulSet for application telemetry, so a runaway application cannot take your node telemetry down with it
- [Deploy the System Alloy](https://syself.com/docs/hetzner/apalla/observability/collection/deploy-the-system-alloy): Install one Grafana Alloy DaemonSet on the host network that scrapes every loopback and cluster component metrics endpoint and ships container, journald, and audit logs off the node
- [Deploy the Application Alloy](https://syself.com/docs/hetzner/apalla/observability/collection/deploy-the-application-alloy): Run a clustered Grafana Alloy StatefulSet that scrapes your workloads through their existing ServiceMonitors and receives OTLP traces, sharded across replicas
- [Troubleshoot the collectors](https://syself.com/docs/hetzner/apalla/observability/collection/troubleshoot-the-collectors): The failure modes worth knowing by name, from a target that is down and a series scraped twice to out-of-order samples and a cardinality spike

#### Metrics

- [metrics-server and live usage](https://syself.com/docs/hetzner/apalla/observability/metrics/metrics-server-and-live-usage): metrics-server ships in every cluster and feeds kubectl top and the HorizontalPodAutoscaler, but it keeps only the latest sample, so it is not history
- [Set up Prometheus](https://syself.com/docs/hetzner/apalla/observability/metrics/set-up-prometheus): Install the Prometheus Operator and one Prometheus that only receives, because the Alloy collectors do all the scraping
- [Control-plane metrics](https://syself.com/docs/hetzner/apalla/observability/metrics/control-plane-metrics): etcd, kube-controller-manager, kube-scheduler, the kubelet, and KubeGate keep their metrics on loopback, and this page covers what each one tells you and how it is reached
- [Cluster object metrics with kube-state-metrics](https://syself.com/docs/hetzner/apalla/observability/metrics/kube-state-metrics): kube-state-metrics turns every Kubernetes object's state into a metric, including the custom NodeConditions the health daemon latches, so you can alert on them
- [Node and hardware metrics](https://syself.com/docs/hetzner/apalla/observability/metrics/node-and-hardware-metrics): node-exporter binds to the host, so scrape it over loopback to get CPU, memory, disk, NVMe, and network metrics for cloud and bare-metal pools
- [Custom application metrics](https://syself.com/docs/hetzner/apalla/observability/metrics/custom-application-metrics): Expose your app's metrics and declare a ServiceMonitor or PodMonitor; the Application Alloy reads those objects, shards the targets across replicas, and keeps app cardinality away from node telemetry
- [Long-term storage and remote-write](https://syself.com/docs/hetzner/apalla/observability/metrics/long-term-storage-and-remote-write): Prometheus local storage is short-lived, so remote-write to Thanos, Mimir, or Victoria Metrics for durable, queryable, multi-cluster history
- [Data-plane and cluster component metrics](https://syself.com/docs/hetzner/apalla/observability/metrics/data-plane-and-addon-metrics): The platform's networking, DNS, storage, and cloud-integration cluster components each report their own metrics, some on loopback and some on the pod network, and this page covers what each one tells you

#### Reference

- [Reference: metrics per component](https://syself.com/docs/hetzner/apalla/observability/reference/metrics-per-component): Every Syself Autopilot component's metrics endpoint, its port and scheme, which nodes it exists on, and whether it sits on the pod network or the node's loopback

#### Dashboards

- [Set up Grafana](https://syself.com/docs/hetzner/apalla/observability/dashboards/set-up-grafana): Install Grafana, declare Prometheus and Loki as data sources in its values, reach it safely, and log a team in with OIDC
- [Dashboards for a Syself Autopilot cluster](https://syself.com/docs/hetzner/apalla/observability/dashboards/dashboards-for-a-syself-cluster): The generic Kubernetes dashboards miss the loopback and Cilium metrics, so map the panels that actually reflect a Syself Autopilot cluster
- [Dashboards as code](https://syself.com/docs/hetzner/apalla/observability/dashboards/dashboards-as-code): Keep dashboards in Git and let the Grafana sidecar or Argo CD provision them, so every client cluster gets the same views without click-ops

#### Alerting

- [Set up Alertmanager](https://syself.com/docs/hetzner/apalla/observability/alerting/set-up-alertmanager): Deploy Alertmanager as its own object, hold its config in a Secret, load rules with PrometheusRule objects, and confirm an alert flows end to end
- [Alert routing and receivers](https://syself.com/docs/hetzner/apalla/observability/alerting/alert-routing-and-receivers): Route alerts by severity, team, and cluster to Slack, PagerDuty, email, or a webhook, so the right person is paged and clients are separated
- [Platform alert rules](https://syself.com/docs/hetzner/apalla/observability/alerting/platform-alert-rules): Some conditions never trigger self-healing on bare-metal pools, so alerting is the only way to act on node integrity and capacity, and this page ships those rules
- [SLOs and error budgets](https://syself.com/docs/hetzner/apalla/observability/alerting/slos-and-error-budgets): Define service-level objectives on your own metrics and alert on burn rate instead of raw thresholds, so pages mean a real customer problem
- [Silences and grouping](https://syself.com/docs/hetzner/apalla/observability/alerting/silences-and-grouping): Group related alerts into one notification and silence known noise during maintenance, so on-call is not buried when a node pool rolls

#### Logs

- [Log sources on a sealed node](https://syself.com/docs/hetzner/apalla/observability/logs/log-sources-on-a-sealed-node): A sealed Syself node has a read-only root and a writable /var, and this page lists every log stream that lives there and disappears on reprovision
- [Set up Loki](https://syself.com/docs/hetzner/apalla/observability/logs/set-up-loki): Install Loki as the log store, back it with object storage, and add it to Grafana so logs and metrics share one query surface
- [Collect container and journald logs](https://syself.com/docs/hetzner/apalla/observability/logs/collect-container-and-journald-logs): Container stdout and the systemd journal are the two operational log streams on every node, and this page covers what each holds, how they are labelled, and how to cut the volume
- [Ship audit logs off-node](https://syself.com/docs/hetzner/apalla/observability/logs/ship-audit-logs): The auditd, Kubernetes API audit, and KubeGate audit streams are your evidence trail, so ship all three off-node before a replaced node takes them
- [Log retention and sizing](https://syself.com/docs/hetzner/apalla/observability/logs/log-retention-and-sizing): On-node logs are bounded and rotate, so this page gives the caps you start from and how to size retention in your own store

#### Tracing

- [Ingest OTLP traces](https://syself.com/docs/hetzner/apalla/observability/traces/ingest-otlp-traces): Your services export spans in OTLP to the Application Alloy, which batches them, derives span metrics, samples what you keep, and forwards to Tempo or Jaeger
- [Install Tempo or Jaeger](https://syself.com/docs/hetzner/apalla/observability/traces/install-tempo-or-jaeger): Pick a trace backend, Tempo for object-storage-cheap traces beside Loki, or Jaeger for a standalone UI, and wire it to the collector
- [Instrument a workload](https://syself.com/docs/hetzner/apalla/observability/traces/instrument-a-workload): Add OpenTelemetry to your service, with SDK code or zero-code auto-instrumentation, and point it at the collector so traces start flowing
- [Correlate traces, metrics, and logs](https://syself.com/docs/hetzner/apalla/observability/traces/correlate-traces-metrics-and-logs): Link a slow trace to the exact log lines and metric spikes behind it, so one Grafana click moves from symptom to cause

#### Network flows

- [See flows with Hubble](https://syself.com/docs/hetzner/apalla/observability/network-flows/see-flows-with-hubble): Hubble is on by default and records every connection and drop, so scrape its metrics and use the CLI to watch flows live
- [Alert on dropped packets](https://syself.com/docs/hetzner/apalla/observability/network-flows/alert-on-drops): A rise in dropped packets means a workload is being blocked or probed, so alert on hubble_drop_total and keep a queryable flow log
- [The Hubble UI](https://syself.com/docs/hetzner/apalla/observability/network-flows/the-hubble-ui): The Hubble UI draws the live service map but has no login, so reach it by port-forward or put it behind authenticated ingress before anyone shares it

#### Fleet and management cluster

- [Monitor cluster and machine health](https://syself.com/docs/hetzner/apalla/observability/multi-cluster/monitor-cluster-and-machine-health): Syself runs the management cluster and heals your clusters, but the Cluster API objects it reconciles are yours to watch, so alert on their status
- [Multi-cluster observability](https://syself.com/docs/hetzner/apalla/observability/multi-cluster/multi-cluster-observability): Run one Grafana, one long-term store, and one alerting plane over many clusters so an agency operates a whole fleet from a single view

### Workloads

- [Workloads on Syself Autopilot](https://syself.com/docs/hetzner/apalla/workloads/overview): A map of what you can run on Syself Autopilot and where each task lives, framed by the one rule that shapes it all: node replacement is routine, so no pod stays put

#### Run production workloads

- [Run a production-ready workload](https://syself.com/docs/hetzner/apalla/workloads/production/run-a-production-ready-workload): The one page that wires every setting a real Deployment needs to survive a node drain, then narrates a single drain to show each one earning its place
- [Configure health probes](https://syself.com/docs/hetzner/apalla/workloads/production/health-probes): The probe mistakes that drop traffic on a platform that drains and replaces nodes, and how readiness, liveness, and startup probes avoid them
- [Set resource requests and limits](https://syself.com/docs/hetzner/apalla/workloads/production/resource-requests-and-limits): Why the right default on this platform is a memory limit equal to the request, no CPU limit, and Burstable QoS
- [Add a PodDisruptionBudget](https://syself.com/docs/hetzner/apalla/workloads/production/pod-disruption-budgets): Cap how many pods can be down during a drain so an upgrade or repair never takes your whole app offline, and read the two symptoms that mean the budget is wrong
- [Handle graceful shutdown](https://syself.com/docs/hetzner/apalla/workloads/production/graceful-shutdown): Finish in-flight requests when a node is replaced instead of dropping connections, by closing the endpoint-deregistration race with preStop and SIGTERM handling
- [Set namespace defaults with LimitRange and ResourceQuota](https://syself.com/docs/hetzner/apalla/workloads/production/namespace-limitrange-and-resourcequota): Give each client namespace a shape and a ceiling so one tenant can never starve another

#### Placement and scheduling

- [Steer workload placement](https://syself.com/docs/hetzner/apalla/workloads/placement/steer-workload-placement): A decision table that routes you to the right placement control, plus the default node and zone spread that already runs before you set anything
- [Set affinity and anti-affinity](https://syself.com/docs/hetzner/apalla/workloads/placement/affinity-and-anti-affinity): Require or prefer certain nodes, and co-locate or separate pods from each other, when a plain node selector is not enough
- [Spread pods with topology constraints](https://syself.com/docs/hetzner/apalla/workloads/placement/topology-spread-constraints): Keep replicas on separate nodes and zones so a single node replacement takes at most one of them
- [Reserve nodes with taints and tolerations](https://syself.com/docs/hetzner/apalla/workloads/placement/taints-and-tolerations): Custom node taints don't survive here, so keep general workloads off dedicated nodes with a dedicated pool, a label, and a nodeSelector instead

#### Scaling

- [Scale out with the Horizontal Pod Autoscaler](https://syself.com/docs/hetzner/apalla/workloads/scaling/horizontal-pod-autoscaler): Autoscale replicas on CPU, memory, or custom metrics, and keep minReplicas high enough to survive a node roll
- [Right-size with the Vertical Pod Autoscaler](https://syself.com/docs/hetzner/apalla/workloads/scaling/vertical-pod-autoscaler): Let the VPA recommend or apply the CPU and memory requests a workload actually needs instead of guessing
- [Scale a workload to zero](https://syself.com/docs/hetzner/apalla/workloads/scaling/scale-to-zero): On your own hardware, scaling to zero is the difference between paying for a node all night and letting the cluster drop it

#### Stateful workloads

- [Run a StatefulSet with storage](https://syself.com/docs/hetzner/apalla/workloads/stateful/run-a-statefulset-with-storage): Nodes get replaced routinely, so the storage class you choose is what decides whether your StatefulSet's data survives. Pick between local NVMe, Hetzner volumes, and shared JuiceFS
- [Keep stateful pods safe across node replacement](https://syself.com/docs/hetzner/apalla/workloads/stateful/stateful-placement-and-node-replacement): How to place stateful replicas so a Syself Autopilot node replacement rebuilds one member at a time and never costs you quorum or local data
- [Run databases on the cluster](https://syself.com/docs/hetzner/apalla/workloads/stateful/run-databases): Own your Postgres instead of renting a managed one: the honest tradeoffs, why you want an operator, and where every detailed recipe lives

#### Batch and jobs

- [Run a Job](https://syself.com/docs/hetzner/apalla/workloads/batch/run-jobs): Run a task that runs to completion once and reports success or failure, and design it to survive being evicted mid-run
- [Run a CronJob](https://syself.com/docs/hetzner/apalla/workloads/batch/run-cronjobs): Schedule recurring work on a cron expression, and let idle nodes disappear between runs
- [Control retries and clean up finished jobs](https://syself.com/docs/hetzner/apalla/workloads/batch/backoff-and-ttl-cleanup): Finished Jobs quietly bloat etcd and slow the API server. Set a TTL so they clean themselves up, and bound retries so a failing Job cannot loop forever

#### Specialized workloads

- [Run GPU workloads](https://syself.com/docs/hetzner/apalla/workloads/specialized/run-gpu-workloads): Schedule a pod onto an NVIDIA GPU node with no manual driver setup, because the sealed node OS ships the driver, CDI spec, and device plugin before the node boots
- [Share a GPU across pods](https://syself.com/docs/hetzner/apalla/workloads/specialized/share-a-gpu): A slice is a scheduling token, not a fraction of the card. Learn when co-scheduling is safe and how to keep a whole GPU to one workload
- [Run NUMA-aligned workloads](https://syself.com/docs/hetzner/apalla/workloads/specialized/run-numa-aligned-workloads): Pin a pod's CPUs and memory to one socket on multi-socket bare metal so latency-sensitive databases and real-time services stop paying the cross-socket tax
- [Run virtual machines with KubeVirt](https://syself.com/docs/hetzner/apalla/workloads/specialized/run-virtual-machines): Run full virtual machines next to your containers with KubeVirt on bare-metal nodes, and plan for node churn so a VM disk backed by local NVMe survives

#### Secure workloads

- [Run a workload in a user namespace](https://syself.com/docs/hetzner/apalla/workloads/secure/run-in-a-user-namespace): Map container root onto an unprivileged host UID with one field, so a container escape does not land as root on the node
- [Run in the secure (Kata) runtime](https://syself.com/docs/hetzner/apalla/workloads/secure/run-in-the-secure-runtime): Run a pod in its own lightweight VM with its own kernel, so a kernel-level escape stays trapped inside the sandbox instead of reaching the host
- [Set security contexts on a workload](https://syself.com/docs/hetzner/apalla/workloads/secure/set-security-contexts): Where security contexts fit in the workload-hardening ladder, with a pointer to the security page that owns the fields, the restricted example, and Pod Security Standards enforcement

#### Configuration and delivery

- [Provide config with ConfigMaps and Secrets](https://syself.com/docs/hetzner/apalla/workloads/delivery/config-maps-and-secrets): Inject config and sensitive values into pods: env vars vs. files, live updates, and what a Secret actually protects
- [Pull images from a private registry](https://syself.com/docs/hetzner/apalla/workloads/delivery/pull-from-a-private-registry): Give pods credentials to pull from a private container registry, per namespace or per service account, and read your way out of ImagePullBackOff
- [Deploy an application with Helm](https://syself.com/docs/hetzner/apalla/workloads/delivery/deploy-with-helm): Install packaged applications with Helm on Syself Autopilot, with the storage class and load balancer values a chart needs to run here
- [Deploy an application with Kustomize](https://syself.com/docs/hetzner/apalla/workloads/delivery/deploy-with-kustomize): Adapt plain YAML to each environment without a template language, layering overlays over one base with built-in kubectl Kustomize
- [Deploy apps from Git with Argo CD](https://syself.com/docs/hetzner/apalla/workloads/delivery/deploy-apps-from-git-argo-cd): Make Git the source of truth for your manifests so a controller reconciles the cluster back to the repo on every merge, drain, and node replacement
- [Progressive delivery and canary releases](https://syself.com/docs/hetzner/apalla/workloads/delivery/progressive-delivery-and-canary): Send a new version to a slice of traffic first and promote or roll back on metrics, using Argo Rollouts

### Security

- [Security architecture](https://syself.com/docs/hetzner/apalla/security/security-architecture): The whole security picture on one page: the layers Syself locks down by default, the layers you own, and where the line sits
- [Threat model](https://syself.com/docs/hetzner/apalla/security/threat-model): What each attacker position must achieve to win, which controls block and detect them, and which risks stay open, from internet scanners to supply-chain attacks
- [What Syself can and cannot do in your cluster](https://syself.com/docs/hetzner/apalla/security/what-syself-can-access): The automation provisions and reconciles your cluster and touches none of your data or workloads, with concrete limits you can verify yourself
- [Zero Trust in Kubernetes](https://syself.com/docs/hetzner/apalla/security/zero-trust-on-public-networks): How Zero Trust principles apply to Kubernetes, and the controls Syself Autopilot gives you to build a Zero Trust architecture
- [Node and OS security](https://syself.com/docs/hetzner/apalla/security/node-and-os-security): How every server running your workloads is protected: a sealed OS that cannot change at runtime, a default-deny firewall, key-only SSH, and a BSI C5 audit trail
- [Verify node integrity](https://syself.com/docs/hetzner/apalla/security/verify-node-integrity): How to trust that a Syself Linux node runs exactly the OS image Syself built, how the platform verifies this at boot with dm-verity, and how to read tamper signals from the Kubernetes API
- [Respond to a tampered node](https://syself.com/docs/hetzner/apalla/security/respond-to-a-tampered-node): What to do when a node raises NodeTampered, SealedOSTampered, or VerityCorruption, preserve evidence first, rotate exposed credentials, then reprovision the node
- [Manage access and tenancy](https://syself.com/docs/hetzner/apalla/security/manage-access-and-tenancy): How to give users and teams exactly the Kubernetes access they need, without handing out admin rights. Covers the hardened API server, least-privilege RBAC bound to OIDC, and per-cluster isolation
- [Multi-tenant isolation for agencies](https://syself.com/docs/hetzner/apalla/security/multi-tenant-isolation-for-agencies): How to keep one client's cluster provably unable to reach another's, and how to isolate tenants inside a shared cluster when you must
- [Run a dedicated management cluster in your own account](https://syself.com/docs/hetzner/apalla/security/dedicated-management-cluster): For regulated and high-assurance environments, run the management cluster in your own Hetzner account so no control plane, and no key, ever leaves your boundary
- [KubeGate: restrict API server access](https://syself.com/docs/hetzner/apalla/security/restrict-api-server-access): Limit which clients reach the Kubernetes API server through the load balancer with a KubeGate source-CIDR policy, and verify a blocked client is denied
- [Restrict SSH access](https://syself.com/docs/hetzner/apalla/security/restrict-ssh-access): Narrow SSH access on your Syself nodes from open to every source on port 100 down to a single bastion host, or block it entirely using a Cilium deny policy
- [Network Policies with Cilium](https://syself.com/docs/hetzner/apalla/security/segment-with-network-policies): Use Cilium Network Policies to secure Kubernetes workloads, implement Zero Trust networking, and control traffic between applications
- [Control pod egress (and the FQDN limitation)](https://syself.com/docs/hetzner/apalla/security/control-egress-with-fqdn-policy): Restrict what your pods can call out to with Cilium egress policy, and understand that FQDN and DNS rules are rejected at apply time, so you use address, port, and identity rules instead
- [Encrypt pod traffic with WireGuard](https://syself.com/docs/hetzner/apalla/security/encrypt-pod-traffic-with-wireguard): Enable WireGuard transparent encryption in Cilium so cross-node pod traffic is encrypted at the kernel level with no changes to your applications or workloads
- [Workload runtimes and isolation](https://syself.com/docs/hetzner/apalla/security/workload-runtimes-and-isolation): How the standard runtime, user namespaces, and the secure Kata runtime isolate workloads on Syself Autopilot, and which pod security controls you must configure
- [Security Contexts](https://syself.com/docs/hetzner/apalla/security/set-security-contexts): Set pod and container Security Contexts to drop privileges and harden workloads on Syself Autopilot
- [Use AppArmor](https://syself.com/docs/hetzner/apalla/security/use-apparmor): Every non-privileged container on Syself Linux runs under an enforcing AppArmor profile by default. What the profile blocks, how to change it per pod, where SELinux stands, and how it fits the full workload hardening stack
- [Enforce Pod Security Standards](https://syself.com/docs/hetzner/apalla/security/enforce-pod-security-standards): Roll out Pod Security Standards on a Kubernetes namespace without breaking running workloads: audit first, then enforce the baseline or restricted level
- [Control admission](https://syself.com/docs/hetzner/apalla/security/control-admission): How the platform's admission protection prevents a broken webhook from locking your cluster, what it restricts tenant webhooks and Cilium network policies from doing, and how to write hard-block rules safely
- [Use Kyverno policies](https://syself.com/docs/hetzner/apalla/security/use-kyverno-policies): Install Kyverno on a Syself workload cluster, configure failurePolicy correctly, and pick the right rule type for mutations, generation, validation, and image signing
- [OPA Gatekeeper as an alternative](https://syself.com/docs/hetzner/apalla/security/opa-gatekeeper-alternative): If your organization standardizes on OPA Gatekeeper and Rego, it fits the same webhook-guard contract as Kyverno, with these trade-offs
- [Supply-chain security](https://syself.com/docs/hetzner/apalla/security/supply-chain-security): How the Syself Linux node image is built from hash-pinned sources with a reproducible seal, what the SPDX SBOM and VEX verdicts let you verify, and exactly what is and is not signed or attested
- [Verify image signatures](https://syself.com/docs/hetzner/apalla/security/verify-image-signatures): Require cryptographically signed container images in your Syself workload clusters using Kyverno verifyImages or sigstore policy-controller, with safe rollout steps
- [Scan workload images for vulnerabilities](https://syself.com/docs/hetzner/apalla/security/scan-workload-images): Scan the images your workloads pull for known CVEs with Trivy or Grype, in CI and again inside the cluster, and gate on the results
- [Security evidence a release produces](https://syself.com/docs/hetzner/apalla/security/security-evidence-per-release): The machine-readable evidence every release produces, the SPDX SBOM with VEX verdicts, the stack security report, the CVE feed, the patch SLA ladder, and the audit evidence a running cluster emits
- [Manage application secrets](https://syself.com/docs/hetzner/apalla/security/manage-application-secrets): How to handle Kubernetes Secrets safely: encrypt etcd first, keep secret material out of Git with Sealed Secrets or External Secrets, restrict RBAC, mount secrets as files, and rotate on custody change
- [etcd Encryption](https://syself.com/docs/hetzner/apalla/security/encrypt-etcd): Encrypt Kubernetes Secrets at rest in etcd on Syself Autopilot
- [Encrypt data disks (volume encryption)](https://syself.com/docs/hetzner/apalla/security/encrypt-data-disks): Encrypt the data disks under your local volumes with LUKS so a stolen or decommissioned disk gives up nothing, following the recommended design by hand
- [Data at rest and key custody](https://syself.com/docs/hetzner/apalla/security/data-at-rest-and-key-custody): What is encrypted at rest on Syself Autopilot and what is not: node disks, PersistentVolumes, and etcd. Who holds each key, from the etcd encryption key to the module-signing key and the verity root hash
- [Meet compliance requirements](https://syself.com/docs/hetzner/apalla/security/meet-compliance-requirements): Shared-responsibility model, control-family mapping across BSI C5, CIS Kubernetes, SOC 2, and ISO 27001, and the actionable checklist for your side of the line
- [Run a CIS Kubernetes benchmark with kube-bench](https://syself.com/docs/hetzner/apalla/security/run-cis-benchmark-with-kube-bench): Run kube-bench against a cluster to produce CIS benchmark evidence, and read the results against what the platform already hardens
- [Retrieve audit logs](https://syself.com/docs/hetzner/apalla/security/retrieve-audit-logs): How to read the host auditd log, the Kubernetes API audit log, and the KubeGate audit log from a Syself Linux node over SSH or kubectl, and how to ship them off-node into write-once storage for compliance
- [Ship audit logs to a SIEM](https://syself.com/docs/hetzner/apalla/security/ship-audit-logs-to-a-siem): A copy-paste Grafana Alloy DaemonSet that tails the host auditd, Kubernetes API, and KubeGate audit logs on every Syself Linux node and forwards them to Loki, a SIEM, or write-once object storage
- [Runtime threat detection](https://syself.com/docs/hetzner/apalla/security/runtime-threat-detection): Deploy Falco or an equivalent to catch what the preventive controls miss, then wire it into a detect-and-respond loop for a compromised workload

### Reference

- [Cluster variables](https://syself.com/docs/hetzner/apalla/reference/cluster-variables): Complete reference for every cluster variable you can set under spec.topology.variables on a Hetzner cluster in Syself Autopilot, including defaults and what each one does
- [Node labels and annotations](https://syself.com/docs/hetzner/apalla/reference/node-labels-and-annotations): All labels and annotations on a Syself Autopilot node, who sets each one, and what reads it. Covers role, topology, hardware, bootstrap, and health annotation
- [Ports and listeners](https://syself.com/docs/hetzner/apalla/reference/ports-and-listeners): Every port a Syself Linux node opens, the address it binds to, and which hosts can reach it. Covers control-plane, worker, shared, Cilium, and intentionally disabled ports
- [Node health conditions](https://syself.com/docs/hetzner/apalla/reference/node-health-conditions): All NodeConditions the health daemon can set on a Syself Autopilot node, what triggers each, their disposition, and which conditions cause automatic machine replacement
- [Node resources and limits](https://syself.com/docs/hetzner/apalla/reference/node-resources-and-limits): How Syself Autopilot allocates CPU and memory on each node, sets pod limits, and protects node stability with eviction thresholds. All limits from one reference page
- [Server types and sizing](https://syself.com/docs/hetzner/apalla/reference/server-types-and-sizing): Which Hetzner server types work with Syself Autopilot, how to choose the right size for control planes and workers, and sizing guidance for common workloads
- [Auditd rules](https://syself.com/docs/hetzner/apalla/reference/auditd-rules): How the immutable auditd ruleset on Syself Linux records privileged activity, which compliance frameworks it supports evidence for, and how the audit log leaves the node
- [Metrics reference](https://syself.com/docs/hetzner/apalla/reference/metrics): The Prometheus metrics Syself Autopilot node components expose, the port each one binds, and what it tells you. Health-daemon metrics, loopback component endpoints, and how to scrape a host-network node
- [Cluster API resources](https://syself.com/docs/hetzner/apalla/reference/cluster-api-resources): The upstream Cluster API objects a Syself Autopilot cluster is built from (Cluster, ClusterClass, MachineDeployment, MachineSet, Machine, and the Hetzner infrastructure objects), with the fields you edit and the fields the platform owns
- [FAQ](https://syself.com/docs/hetzner/apalla/support/faq): Answers to the most common questions about Syself Autopilot: what it is, how billing works, and how upgrades work

### Support

- [Where to start troubleshooting](https://syself.com/docs/hetzner/apalla/support/where-to-start): Match a symptom to the runbook that owns it, read a Machine or Cluster event, and know when to stop and contact Syself
- [Get support](https://syself.com/docs/hetzner/apalla/support/get-support): When to open a support case, the channel to reach Syself on, and what a good first message contains
- [What to collect first](https://syself.com/docs/hetzner/apalla/support/what-to-collect-first): Gather these details and files before you write to support so the first reply moves your case forward
- [Support channels and SLAs](https://syself.com/docs/hetzner/apalla/support/channels-and-slas): Reach Syself support by email or a shared Slack channel, see how support ranks a case by severity, and read the CVE patch windows Syself commits to by severity
- [Collect logs with the log collector](https://syself.com/docs/hetzner/apalla/support/collect-logs-with-the-log-collector): Run the built-in syself-log-collector on a Syself Autopilot node, then get the bundle off it over SSH with scp, or with kubectl alone when you have no SSH access, so support can investigate a node-level problem
- [Grant Syself bare-metal access](https://syself.com/docs/hetzner/apalla/support/grant-syself-baremetal-access): Put a Hetzner bare-metal server into maintenanceMode, create a temporary Hetzner Robot admin login for Syself support, then revoke it and let the server rejoin the cluster

### Accounts and Organization

- [How to Add Users to Your Organization](https://syself.com/docs/hetzner/apalla/platform/add-users): Add users to your organization from the Syself ID console
- [Changing User Permissions in Syself Autopilot](https://syself.com/docs/hetzner/apalla/platform/roles-and-permissions): Grant a user the read-only or admin Syself Autopilot role from the Authorizations tab
- [Where your management cluster runs](https://syself.com/docs/hetzner/apalla/platform/where-your-management-cluster-runs): By default Syself hosts your management cluster. You can also run it in your own Hetzner account, with Syself still operating it

#### Billing

- [How Syself Billing Works](https://syself.com/docs/hetzner/apalla/platform/billing/how-billing-works): How Syself calculates the provider usage
- [Getting Hetzner Invoice CSV](https://syself.com/docs/hetzner/apalla/platform/billing/get-the-hetzner-csv): How to get Hetzner invoice as a CSV file for Syself billing
- [Automate Hetzner Invoice Sending](https://syself.com/docs/hetzner/apalla/platform/billing/automate-the-invoice): How to automatically send the Hetzner invoice to Syself

## CAPH (Cluster API Provider Hetzner) — Open Source

The open-source Cluster API infrastructure provider for Hetzner that Syself maintains, usable standalone without Syself Autopilot.

- [Introduction](https://syself.com/docs/caph/getting-started/introduction): Cluster API Provider Hetzner automates the lifecycle and provisioning of Kubernetes clusters on cloud or bare metal
- [Hetzner project preparation](https://syself.com/docs/caph/getting-started/preparation): Learn how to do the necessary steps for creating your first workload cluster on Hetzner with Cluster API
- [SSH key management](https://syself.com/docs/caph/topics/managing-ssh-keys): Details about SSH keys and its importance with regards to clusters managed by CAPH
- [High availability setup](https://syself.com/docs/caph/topics/HA-setup): How to achieve high availability in clusters managed by CAPH
- [Node Images](https://syself.com/docs/caph/topics/node-image): Build custom Node Images for CAPH using Packer on Hetzner Cloud. Create, configure, and snapshot servers with all necessary components for Kubernetes
- [Upgrading the Kubernetes Cluster API Provider Hetzner](https://syself.com/docs/caph/topics/upgrading-caph): How to upgrade Cluster API and Cluster API Provider Hetzner
- [Object Reference](https://syself.com/docs/caph/reference/introduction): Overview of the naming conventions of objects specific to the CAPH integration
- [HetznerCluster](https://syself.com/docs/caph/reference/hetzner-cluster): In HetznerCluster you can define everything related to the general components of the cluster as well as those properties, which are valid cluster-wide
- [HCloudMachineTemplate](https://syself.com/docs/caph/reference/hcloud-machine-template): In HCloudMachineTemplate you can define all important properties for HCloudMachines, which are reconciled by the `HCloudMachineController`, responsible for creating and deleting servers in Hetzner Cloud
- [HCloudRemediationTemplate](https://syself.com/docs/caph/reference/hcloud-remediation-template): RemediationStrategyTypes define remediation strategy, timeouts and retries
- [HetznerBareMetalHost](https://syself.com/docs/caph/reference/hetzner-bare-metal-host): The HetznerBareMetalHost has a one-to-one relationship to a Hetzner dedicated server. It's used to make bare metal servers available to your clusters
- [HetznerBareMetalMachineTemplate](https://syself.com/docs/caph/reference/hetzner-bare-metal-machine-template): In HetznerBareMetalMachineTemplate you can define all important properties for the HetznerBareMetalMachines
- [HetznerBareMetalRemediationTemplate](https://syself.com/docs/caph/reference/hetzner-bare-metal-remediation-template): With this remediation, you can define a custom method for how Machine Health Checks treats unhealthy HetznerBareMetalMachine objects
- [Annotations](https://syself.com/docs/caph/reference/annotations): Full list of annotation you can set to instruct the Syself CAPH Controller to modify its behavior
- [Developing Cluster API Provider Hetzner](https://syself.com/docs/caph/developers/development-guide): Learn how to set up an environment to develop the Cluster API Provider Hetzner, using Tilt and kind
- [Reference of Tilt](https://syself.com/docs/caph/developers/tilt): Full list of available Tilt configuration values and their description
- [Release Process](https://syself.com/docs/caph/developers/releasing): Documentation on the CAPH release process, describing the necessary steps and how to version
- [Updating Kubernetes Version](https://syself.com/docs/caph/developers/updating-kubernetes-version): All the steps needed when adding a new supported Kubernetes version to CAPH
- [pre-provision-command](https://syself.com/docs/caph/developers/pre-provision-command): Documentation on the CAPH pre-provision-command
- [image-url-command](https://syself.com/docs/caph/developers/image-url-command): Documentation on the CAPH image-url-command

### Quickstart

- [Prerequisites](https://syself.com/docs/caph/getting-started/quickstart/prerequisites): Automate provisioning, upgrading, and operating Kubernetes clusters on Hetzner infrastructure with Cluster API for a production-ready setup
- [Management cluster setup](https://syself.com/docs/caph/getting-started/quickstart/management-cluster-setup): Bootstrap a cluster, install and configure all the necessary components to make it function as a Cluster API management cluster
- [Creating the workload cluster](https://syself.com/docs/caph/getting-started/quickstart/creating-a-workload-cluster): Provision a Kubernetes workload cluster with essential components for a secure deployment, including CNI, CCM, and optional CSI integration
- [Next steps](https://syself.com/docs/caph/getting-started/quickstart/next-steps): How to move the Cluster API components out of your bootstrap cluster, and into the newly created cluster on Hetzner

### Bare Metal

- [Hetzner bare metal](https://syself.com/docs/caph/topics/baremetal/introduction): Explanation of the Hetzner offerings, and the available cluster flavors with bare metal servers
- [Management cluster setup for bare metal](https://syself.com/docs/caph/topics/baremetal/management-cluster): Learn how to provision a management cluster ready to manage bare metal servers
- [Creating a workload cluster with bare metal servers](https://syself.com/docs/caph/topics/baremetal/creating-workload-cluster): Create workload clusters on Hetzner using bare metal servers as nodes in an automated way, using CAPI custom resources
- [Using constant hostnames](https://syself.com/docs/caph/topics/baremetal/constant-hostnames): Utilize fixed node names for bare metal servers, useful for local storage persistence across reprovisionings
- [Bare metal control planes and the load balancer](https://syself.com/docs/caph/topics/baremetal/load-balancer-targets): Select the address family CAPH uses when it attaches a bare metal control plane server to the control plane load balancer

### Advanced

- [CSR controller](https://syself.com/docs/caph/topics/advanced/csr-controller): Explore advanced Certificate Signing Request options like using a custom CSR controller in Kubernetes clusters managed by CAPH
- [Rate limits](https://syself.com/docs/caph/topics/advanced/rate-limits): Information about Hetzner Cloud rate limits, and what to expect when you are affected
- [Multi tenancy](https://syself.com/docs/caph/topics/advanced/multi-tenancy): Information about multi tenancy, i.e. running multiple Kubernetes clusters in the same Hetzner cloud project
- [Machine Health Checks with Custom Remediation Template](https://syself.com/docs/caph/topics/advanced/custom-templates-mhc): Learn about the default Machine Health Checks and Bare Metal Server Remediation Templates, and how to configure them

## Kubernetes Versions

Syself maintains several Kubernetes minor versions at once. Each one runs its own track of Cluster Stack releases, updated on its own schedule.

- [Maintained Kubernetes Versions](https://syself.com/versions): Every Kubernetes minor version Syself maintains, with the Cluster Stack releases on each track
- [Kubernetes 1.36](https://syself.com/versions/1-36): Cluster Stack releases, component versions, and release notes for the Kubernetes 1.36 track
- [Kubernetes 1.35](https://syself.com/versions/1-35): Cluster Stack releases, component versions, and release notes for the Kubernetes 1.35 track
- [Kubernetes 1.34](https://syself.com/versions/1-34): Cluster Stack releases, component versions, and release notes for the Kubernetes 1.34 track
- [Kubernetes 1.33](https://syself.com/versions/1-33): Cluster Stack releases, component versions, and release notes for the Kubernetes 1.33 track

## Resource Center

Long-form articles on how Syself Autopilot works internally, at https://syself.com/resources.

- [Resource Center](https://syself.com/resources): Articles, videos, white papers and more
- [Fast Kubernetes Node Provisioning Before First Boot](https://syself.com/resources/fast-kubernetes-node-provisioning): Fast Kubernetes node provisioning in Syself Autopilot 1.36: each node is built in the rescue system before it boots, with real progress reported and a node ready ~60% faster
- [How Syself Tests Every Cluster Stack Release](https://syself.com/resources/how-syself-tests-a-clusterstack-release): How Syself tests every Cluster Stack release, from fast file checks to chaos on real clusters, why you upgrade one Kubernetes minor at a time, and what the tests do not cover
- [Verifiable, Immutable OS for Kubernetes Nodes: Syself Linux](https://syself.com/resources/immutable-kubernetes-node-os): Syself Autopilot 1.36 runs an immutable Kubernetes node OS, built from source and then sealed and verified block by block, so you can prove what a node runs
- [Access Control for the Kubernetes API Server Using KubeGate](https://syself.com/resources/kubernetes-api-server-access-control): KubeGate is Syself Autopilot 1.36's single front door to the Kubernetes API server—it controls who reaches the control plane and preserves the real client IP
- [The Syself Reverse Tunnel: From the Kubernetes API Server to the Nodes](https://syself.com/resources/kubernetes-api-server-node-tunnel): Syself Autopilot 1.36 ships its own reverse tunnel so kubectl logs, exec, and pod metrics work—each node dials out, and the control plane never dials in
- [Kubernetes Audit Logs With the Real Client IP](https://syself.com/resources/kubernetes-audit-logs-real-client-ip): Syself Autopilot 1.36 produces four Kubernetes audit signals on every node, including the real client IP in the API server audit log, ready to ship to a SIEM
- [Kubernetes Control-Plane Failover That Keeps Workers Online](https://syself.com/resources/kubernetes-control-plane-failover): In Syself Autopilot 1.36, a node-local proxy handles control-plane failover on every worker, so a load-balancer outage no longer marks the whole fleet NotReady
- [Kubernetes Node Health Monitoring and Self-Healing](https://syself.com/resources/kubernetes-node-health-monitoring): Kubernetes node health monitoring on Syself Autopilot. Syself Health watches every node in real time, reports problems as node conditions, and runs the reboot-or-replace loop that keeps a cluster healthy
- [How We Secure Kubernetes Nodes Without a Private Network](https://syself.com/resources/kubernetes-nodes-public-internet): How Syself keeps Kubernetes nodes secure with a layered design—host firewall, policy, and identity—instead of a private network, and why that holds up
- [How Syself Builds a Secure Kubernetes Node OS](https://syself.com/resources/secure-kubernetes-node-os): Syself Linux is a purpose-built, sealed node OS where we govern every input, so you know exactly what runs on a node. Browse its full bill of materials in the version hub, and check any node's integrity state straight from the Kubernetes API
- [What Is a Cluster Stack? A Versioned Kubernetes Bundle](https://syself.com/resources/what-is-a-clusterstack): A Cluster Stack is a versioned Kubernetes bundle that pins the node OS, the cluster topology, and the in-cluster components together, built and tested as one release
- [What Is Syself Autopilot? Managed Kubernetes You Own](https://syself.com/resources/what-is-syself-autopilot): Syself Autopilot is fully managed Kubernetes on your own Hetzner servers. You declare one object; Syself builds, heals, and upgrades the cluster
- [What's New in Syself Autopilot 1.36](https://syself.com/resources/whats-new-syself-autopilot-1-36): 1.36 rebuilds the node OS as Syself Linux, installs nodes with a new provisioner, and runs Syself's own failover proxy, tunnel, and KubeGate for the control-plane path. Read the highlights, the full notes by area, and the upgrade steps

## Features

- [Features Overview](https://syself.com/features): Comprehensive breakdown across infrastructure, simplification, automation, security, and flexibility
- [Bare-Metal Kubernetes](https://syself.com/features/bare-metal-kubernetes): Automated lifecycle management of Hetzner bare-metal servers with higher performance and lower cost
- [Kubernetes Autoscaling](https://syself.com/features/kubernetes-autoscaling): Dynamic node autoscaling with official Kubernetes Cluster Autoscaler; combine VMs and bare metal
- [Self-Healing Clusters](https://syself.com/features/kubernetes-self-healing-clusters): Continuous reconciliation unlike Terraform/Ansible — infrastructure always matches desired state
- [Lifecycle Management](https://syself.com/features/lifecycle-management): End-to-end automation from provisioning to scaling, upgrading, and decommissioning
- [Flexible Updates](https://syself.com/features/kubernetes-updates): Zero-downtime rolling upgrades on your schedule with guaranteed compatibility testing
- [Declarative Configuration](https://syself.com/features/declarative-configuration): kubectl apply for infrastructure — consistent, version-controlled, GitOps-compatible
- [GitOps Deployment](https://syself.com/features/gitops-deployment): Full compatibility with Argo CD and Flux; Git as single source of truth for infrastructure
- [Native Kubernetes](https://syself.com/features/native-kubernetes): Manage Kubernetes with Kubernetes — kubectl, Helm, operators, and controllers
- [Pre-configured Clusters](https://syself.com/features/preconfigured-clusters): Production-ready clusters in minutes with tested best-practice defaults
- [GPU Support](https://syself.com/features/kubernetes-gpu-support): Nvidia GPU integration on bare-metal with auto-detection and driver installation
- [AI/ML Kubernetes](https://syself.com/features/kubernetes-machine-learning-ai-ml): Scalable GPU-accelerated infrastructure for training, inference, and ML pipelines
- [ARM Support](https://syself.com/features/arm-support-kubernetes-nodes): Cost-efficient Ampere ARM64 nodes (CAX21/31/41) with managed node images
- [Infrastructure Ownership](https://syself.com/features/kubernetes-ownership): Full control with BYOK — Syself has no access to your clusters or data
- [OS Hardening](https://syself.com/features/os-hardening): Pre-configured, end-to-end tested, frequently updated managed node images
- [GDPR Compliance](https://syself.com/features/gdpr-compliance): Compliant by default; European hosting on Hetzner; DPA available
- [Open-Source Foundation](https://syself.com/features/open-source): Built on Cluster API and Kubernetes with community-driven innovation
- [Dedicated Operational Mode](https://syself.com/features/dedicated): Self-host Syself Autopilot within your own infrastructure for maximum isolation
- [Dedicated Support](https://syself.com/features/dedicated-solutions): Expert Kubernetes support with strong SLAs, 24/7 assistance, 30-minute response time
- [Feature Requests](https://syself.com/features/feature-requests): Collaborative user-driven feature development with transparent progress tracking

## Solutions

- [Enterprise](https://syself.com/solutions/enterprise): Reliable, secure, compliant Kubernetes for regulated industries with full infrastructure ownership
- [Startups](https://syself.com/solutions/startup): Production-ready managed Kubernetes for startups — deploy instantly, no expertise required
- [SMBs](https://syself.com/solutions/small-and-medium-sized-companies): Modern cloud infrastructure with automated management, high availability, and predictable, usage-based pricing
- [SaaS Companies](https://syself.com/solutions/saas): Scalable, secure managed Kubernetes on European infrastructure — focus on product, not infrastructure
- [Agencies](https://syself.com/solutions/agency): Enterprise-grade managed Kubernetes to onboard clients effortlessly and reduce operational overhead
- [MSPs](https://syself.com/solutions/msp): API-driven Kubernetes that eliminates infrastructure overhead; no Kubernetes expertise required
- [Public Sector](https://syself.com/solutions/public-sector): Sovereign, compliant Kubernetes with zero-trust security, full data control, and audit trails
- [AI & Machine Learning](https://syself.com/solutions/ai-machine-learning): GPU-accelerated bare-metal Kubernetes for demanding workloads at a predictable cost
- [Gaming & Entertainment](https://syself.com/solutions/gaming-entertainment): High-performance autoscaling with NVMe local storage for massive traffic spikes
- [Cloud Modernization](https://syself.com/solutions/cloud-modernization): Migrate from legacy infrastructure to cloud-native Kubernetes with Infrastructure as Software
- [Cost Optimization](https://syself.com/solutions/cost-optimization): Bare-metal base load + cloud autoscaling for high performance at a predictable cost
- [Application Deployment](https://syself.com/solutions/application-deployment): Deploy to production-ready clusters using Kubernetes manifests and GitOps — no Terraform needed
- [Development Environments](https://syself.com/solutions/development-environment): 100% repeatable dev environments matching production in minutes
- [Internal Platforms](https://syself.com/solutions/internal-platforms): Build developer platforms on Syself with managed databases and OIDC federation
- [Kubernetes on Bare Metal](https://syself.com/solutions/kubernetes-bare-metal): Hetzner bare-metal with automated lifecycle, local NVMe, and confidential computing

## Case Studies

- [LanguageTool](https://syself.com/case-studies/languagetool): AI writing assistant — 250 GPU bare-metal servers, 20,000 req/s, dedicated Syself Autopilot for compliance
- [eKool](https://syself.com/case-studies/ekool): Estonian edtech serving 70% of schools — 70% cost reduction, API latency from 110ms to 52ms
- [Hesse.ai](https://syself.com/case-studies/hesse-ai): AI study platform — migrated from Azure AKS to Syself on Hetzner, similar cost with managed databases
- [Maxroll](https://syself.com/case-studies/maxroll): Gaming platform — ARM nodes, bare-metal, GitOps; more flexible than Rancher, more polished than Sidero
- [CCSolutions.io](https://syself.com/case-studies/ccsolutions): Tech agency — 50+ clusters, significantly easier than Rancher, reduced operational overhead

## News

- [Syself Announces CAPH v1.0 for Hetzner Kubernetes](https://syself.com/news/syself-announces-general-availability-of-caph-v1-0): Syself announces the general availability of CAPH v1.0 — the Cluster API Provider for Hetzner
- [Syself Adds GPU Support to Hetzner Bare Metal](https://syself.com/news/syself-brings-gpu-support-to-hetzner-bare-metal-servers): Syself now enables GPU support on Hetzner Bare Metal servers, allowing teams to easily deploy and scale AI, ML, and HPC workloads
- [Syself Enables Local Storage on Hetzner Kubernetes](https://syself.com/news/syself-introduces-local-storage-support-for-kubernetes-on-bare-metal): Syself now supports local storage on Hetzner bare metal for Kubernetes
- [Syself Launches Dedicated Autopilot on Hetzner](https://syself.com/news/syself-launches-dedicated-autopilot-on-hetzner): Syself announces Dedicated Autopilot on Hetzner, a Kubernetes management solution built for security and compliance
- [KCD Rio 2025: Scaling Kubernetes Without Monitoring](https://syself.com/news/kcd-rio-2025-how-syself-manages-thousands-of-kubernetes-clusters): At KCD Rio 2025, Syself revealed its approach to scaling thousands of Kubernetes clusters without Prometheus, Grafana, or Alertmanager
- [Syself Launches Public Beta of Autopilot](https://syself.com/news/syself-launches-public-beta-of-syself-autopilot): Syself announces the public beta of Autopilot, built on SCS Cluster Stacks, to simplify Kubernetes automation
- [Syself Launches Autopilot Kubernetes Beta](https://syself.com/news/syself-launches-private-beta-of-its-kubernetes-management-platform-syself-autopilot): Syself Autopilot simplifies Kubernetes operations with automation and self-healing
- [Cluster API Provider Supports Hetzner Dedicated Servers](https://syself.com/news/cluster-api-provider-supports-hetzner-dedicated-servers): Cluster API Provider Hetzner (CAPH) now supports Hetzner Dedicated Servers, making it simple for developers and companies to run Kubernetes on bare metal without unnecessary complexity
- [Syself Wins SCS VP-05 Tender for Kubernetes-as-a-Service](https://syself.com/news/syself-awarded-scs-vp-05-tender-to-develop-kubernetes-as-a-service-for-sovereign-cloud-stack): Syself has been awarded the SCS VP-05 tender to build a Kubernetes-as-a-Service (KaaS) platform for the Sovereign Cloud Stack
- [Syself Co-Founder Elected SCS Forum Deputy Spokesperson](https://syself.com/news/syself-co-founder-janis-kemper-elected-deputy-spokesperson): Janis Kemper, co-founder of Syself, has been elected Deputy Spokesperson of the Sovereign Cloud Stack (SCS) Forum at the Open Source Business Alliance (OSBA)
- [Syself Joins SCS Forum to Advance Cloud Standards](https://syself.com/news/syself-becomes-a-founding-member-of-the-scs-forum): Syself proudly joins the Sovereign Cloud Stack (SCS) Forum as a founding member under the Open Source Business Alliance (OSBA)
- [Syself Joins OSBA to Strengthen European Open Source](https://syself.com/news/syself-joins-the-open-source-business-alliance): Syself, a leader in Kubernetes automation and open-source infrastructure, joins the Open Source Business Alliance (OSBA) to bolster Europe’s open-source ecosystem and support the Sovereign Cloud Stack and Kubernetes Cluster API
- [Mitigant and Syself Partner to Enhance Security for Managed Kubernetes Services](https://syself.com/news/mitigant-and-syself-partner-to-enhance-security-for-managed-kbernetes-services): Mitigant and Syself join forces to enhance Kubernetes security for EU businesses, delivering automated protection, compliance, and resilience for containerized environments
- [Syself & Hivelocity Expand Kubernetes with Cluster API](https://syself.com/news/syself-and-hivelocity-join-forces-to-expand-kubernetes): Syself releases an open-source Cluster API Provider for Hivelocity, enabling automated Kubernetes lifecycle management on bare metal
- [Syself & Hivelocity Release Alpha Cluster API](https://syself.com/news/syself-and-hivelocity-announce-alpha-release-of-cluster-api-provider): Syself and Hivelocity announce the alpha release of a Cluster API Provider for bare-metal Kubernetes
- [Syself Launches MVP Cluster Stacks for Kubernetes](https://syself.com/news/syself-introduces-mvp-cluster-stacks): Syself announces its new Minimum Viable Product (MVP) Cluster Stacks, simplifying Kubernetes automation
- [Syself Launches Affiliate and Partner Programs](https://syself.com/news/syself-launches-affiliate-and-partner-programs): Syself introduces its new Affiliate and Partner Programs to grow Kubernetes adoption

## Managed Services

- [Managed Databases](https://syself.com/managed-databases): PostgreSQL, MariaDB, ClickHouse, MongoDB on bare-metal NVMe — eliminates external DBaaS costs
- [Kubernetes on Hetzner](https://syself.com/hetzner): Enterprise-grade managed Kubernetes on Hetzner Cloud and dedicated servers with full lifecycle automation

## Pricing

- [Pricing Plans](https://syself.com/pricing): Free plan (1 cluster, 5 nodes); paid plans with base fee + percentage of Hetzner spend; 14-day free trial
- [Pricing Calculator](https://syself.com/pricing/calculator): Estimate costs based on infrastructure configuration and cloud provider usage

## Company

- [About Syself](https://syself.com/about): Syself GmbH, Eschborn, Germany; remote-first team across 4 continents; powering infrastructure for 100M+ daily users in 28 countries
- [Platform Overview](https://syself.com/platform): Detailed automated Kubernetes cluster management platform overview
- [Contact](https://syself.com/contact): contact@syself.com, +49 6196 586 9180, or book a demo
- [Support](https://syself.com/support): support@syself.com, phone support, or documentation
- [Book a Demo](https://syself.com/demo): Personalized 30-minute demo with Kubernetes experts

## Optional

- [Brand Assets](https://syself.com/brand): Brand guidelines, media kit, logos, and co-branding resources
- [Terms of Service](https://syself.com/legal/terms-of-service): 99.5% SLA, usage-based pricing, data protection, German law jurisdiction
- [Privacy Policy](https://syself.com/legal/privacy-policy): GDPR-compliant privacy notice; Cloudflare hosting, analytics details, data subject rights
- [Demo Policy](https://syself.com/legal/demo-policy): Privacy policy for demo booking via Zoho
- [Imprint](https://syself.com/legal/imprint): Syself GmbH, Alfred-Herrhausen-Allee 3-5, 65760 Eschborn; HRB 129924 Frankfurt am Main
- [Legal Overview](https://syself.com/legal): Index of every Syself legal document