Syself Autopilot is fully managed Kubernetes that runs on your own Hetzner servers. You describe a cluster as one Kubernetes object and apply it to the Kubernetes API. Syself then builds the cluster, keeps it healthy, and upgrades it. Your apps run on standard upstream Kubernetes, on machines rented in an account owned by you. So it's a managed service, on servers and an account that stay yours.
Syself has run Kubernetes on Hetzner in production since 2020, with a team of over twenty engineers who maintain and contribute to upstream Kubernetes and who build cluster-api-provider-hetzner, the open-source Cluster API provider for Hetzner and the most-starred Cluster API provider on GitHub, ahead of the AWS and Azure providers. In 2023 we won the public tender for the Kubernetes-as-a-Service part of the Sovereign Cloud Stack, a German government initiative, with the best concept, and implemented the Cluster Stack approach there. Since then we've managed thousands of nodes for agencies, enterprises, and startups.
We build the node operating system, test it, watch it, heal it when it breaks, and upgrade it. You don't set up nodes by hand or patch them over time. A node is never repaired in place. When something needs to change, a fresh, tested node replaces the old one.
The node OS, the cluster topology, and the components that run inside the cluster ship together as one Cluster Stack, under a single version number. We test the whole stack as a unit before any node boots, so an upgrade rolls out as one tested version, not separate parts that you need to piece together and hope they fit.
The node OS in that stack is Syself Linux: a small, sealed, immutable image the kernel checks block by block. See Immutable Kubernetes node OS and what a Cluster Stack is.
You own the servers, the Hetzner account they live in, and the data on the cluster. You pick the region, and control all the data.
Syself sits outside your data-processing scope. Our staff have no standing access to your cluster. The infrastructure is yours; we operate on top of it, not inside your data.
| You own | Syself operates |
|---|---|
| The servers and Hetzner account | Building, healing, and upgrading nodes |
| The data on the cluster | The node OS and platform components |
| The choice of region | The tested Cluster Stack and its versions |
| The role of data controller | Provisioning and scaling |
These articles go deeper on the individual pieces that make up the platform.
Vanilla Kubernetes, operated through the normal Kubernetes API. Your manifests, your Helm charts, and your data are standard Kubernetes with no Syself dialect, so they move to any conformant cluster unchanged. You get a managed platform on Hetzner without giving up the Kubernetes you already know.
No. Your cluster stands on its own. It runs entirely on your Hetzner servers, with its own API server and control plane, and nothing it needs to keep serving traffic runs through Syself.
Syself runs a separate operations layer to build, heal, and move your cluster to new versions. It's built on Cluster API, the Kubernetes project for managing clusters and the machines under them, and your apps never run in it. So if that layer is ever unreachable, your cluster keeps running as before. You just can't provision, scale, or move to a new version until it's back.
More on how Syself operates your cluster: management and workload clusters.
You get your own control plane, and Syself operates it. In most managed Kubernetes solutions, the control plane is hidden from you. In Syself Autopilot, it runs on your own servers, and you talk to it directly. Syself provisions it, heals it, and moves it to new tested versions when you decide to, so you use it as an ordinary Kubernetes cluster and never touch the control-plane machines by hand.
You keep the servers, the account, and the data; Syself runs everything that keeps the cluster healthy. If that's how you want to run production on Hetzner, this is built for it.
Start with a 14-day free trial, and our step-by-step guides will walk you through your first cluster deployment in minutes.
Tags
In Syself Autopilot 1.36, a node-local proxy handles control-plane failover on every worker, so a load-balancer outage no longer marks the whole fleet NotReady.
Syself Autopilot 1.36 ships its own reverse tunnel so kubectl logs, exec, and pod metrics work—each node dials out, and the control plane never dials in.
KubeGate is Syself Autopilot 1.36's single front door to the Kubernetes API server—it controls who reaches the control plane and preserves the real client IP.