Kubernetes on Hetzner in 2026: Every Way to Run It, Compared

Hetzner does not sell managed Kubernetes (checked on hetzner.com, 15 October 2026), so every Hetzner cluster is built by you or a third party. If you want someone else to run it, pick a managed service. Ankra builds the cluster in your own Hetzner project and also deploys and operates your applications, Syself Autopilot runs Cluster API clusters for you, Cloudfleet hosts the control plane and adds Hetzner nodes, and Edka sets up a k3s platform with add-ons in your account. If you want to own everything, the open source routes are kube-hetzner (Terraform), hetzner-k3s (a CLI), Talos Linux with Sidero Omni, and Rancher with the Cluster API provider for Hetzner.

What Hetzner does give you is the building blocks. It publishes an official cloud controller manager (so Kubernetes Services get Hetzner Load Balancers) and a CSI driver (so persistent volumes become Hetzner Volumes). The real difference is who installs, upgrades, backs up and watches everything around them.

The options at a glance

Option	What it is	Distribution	Who runs the control plane	Licence	Best for
Ankra	Platform that builds, deploys to and operates clusters	kubeadm (Cilium) or k3s	Servers in your Hetzner project, operated by Ankra	Commercial (CLI and Terraform provider open source)	Teams that want the cluster and the apps on it handled
Syself Autopilot	Managed Kubernetes built on Cluster API	Cluster API (Syself Cluster Stacks)	Machines in your Hetzner account, lifecycle run by Syself	Commercial, built on open source CAPH	Cluster API lifecycle with vendor support, bare metal
Cloudfleet	Hosted control plane with nodes on Hetzner and other clouds	CFKE (CNCF conformant)	Cloudfleet hosts it	Commercial	One cluster across Hetzner, hyperscalers and own servers
Edka	Platform that sets up k3s plus add-ons in your account	k3s	Your Hetzner Cloud account	Commercial	Small teams wanting add-ons and databases preinstalled
kube-hetzner	Terraform or OpenTofu module	k3s or RKE2 on Leap Micro	You	Open source (MIT)	Teams that already live in Terraform
hetzner-k3s	Command line tool	k3s	You	Open source (MIT)	Fast, simple clusters from one config file
Talos Linux + Omni	Immutable Kubernetes OS plus a fleet manager	Talos	You, with Omni handling OS and Kubernetes upgrades	Talos MPL-2.0, Omni commercial	Teams that want a locked-down OS and fleet upgrades
Rancher + Cluster API	Self-hosted multi-cluster manager	RKE2, k3s or what you import	You (and you run Rancher too)	Open source (Apache-2.0), paid Rancher Prime	Organisations already standardised on Rancher

Ankra

Ankra is an AI-powered platform that builds or imports Kubernetes clusters on the cloud you choose, deploys your applications from Git, and operates them afterwards. On Hetzner it creates a private network, a bastion, control plane servers and workers in your own Hetzner Cloud project, then installs kubeadm with Cilium (the default) or k3s. The bastion is the only server with a public IP. It is the SSH jump host and the NAT gateway for node egress. Hetzner bills you for the servers directly, and Ankra’s hosted control plane runs in the EU.

It is good at covering the layers other options leave to you. The Hetzner cloud controller manager and CSI driver are installed for you. Traefik, cert-manager and Let’s Encrypt come up behind a Hetzner Load Balancer by default, with a DNS subdomain so an ingress hostname gets its record and certificate automatically. Kubernetes upgrades go one node at a time, control plane first, with an etcd snapshot taken before the control plane moves and drains that respect PodDisruptionBudgets. Worker node groups can autoscale on Hetzner. Backups go to an S3-compatible bucket you own, Hetzner Object Storage included. Above the cluster, Ankra connects a GitHub repository, builds and scans it in pipelines that run in your cluster (Trivy, Semgrep and Checkov), deploys on every push, and gives pull requests their own preview environments. That suits teams shipping apps built with AI tools who want a live URL on servers they own. The Security Center ranks vulnerabilities by CISA KEV and EPSS, and an AI assistant explains failing pods and drafts fixes that wait for your approval.

Where it is a weaker fit is a cluster that must mix Hetzner nodes with AWS or Google Cloud nodes in one control plane. Each Ankra cluster stays on one provider, so Cloudfleet is built for that case. Pricing is per worker vCPU, control plane nodes are free, and the first 30 worker vCPU are free on every plan (see pricing). Enterprise customers can self-host Ankra or run it air-gapped.

Best for teams leaving AWS or another big cloud for Hetzner who want the cluster, the deploys and the day-2 work handled by one platform, without hiring a platform team. Details are on Kubernetes on Hetzner.

Syself Autopilot

Syself is a German company whose product, Syself Autopilot, is a managed Kubernetes platform built on Cluster API. Syself built and maintains the Cluster API Provider Hetzner (CAPH), the open source (Apache-2.0) way to run Cluster API on Hetzner. Your clusters run on machines in your own Hetzner account, and you create them through a management cluster that Syself provides.

It is good at lifecycle discipline. Syself ships the OS, cluster topology and in-cluster components together as one versioned Cluster Stack, and replaces nodes on upgrade rather than patching them in place. It supports bare metal as well as cloud servers, says it gives you full ownership of your clusters including control planes, and lists managed databases where it handles setup, backup and updates.

It is a weaker fit if you want application delivery, pipelines or vulnerability ranking in the same product. Those stay with your own tools, and Syself’s public pages do not describe general cluster backups.

Best for teams that like the Cluster API model, want Hetzner bare metal in the picture, and want the people who maintain CAPH to run it for them.

Cloudfleet

Cloudfleet is a Berlin company that runs a managed Kubernetes control plane and adds worker nodes on Hetzner, AWS and Google Cloud. Your Hetzner project holds only the nodes. Cloudfleet hosts the control plane, handles its upgrades and security patches, and auto-provisions Hetzner Cloud servers when workloads need them.

Its standout feature is mixing infrastructure in one cluster. Hetzner Dedicated servers can join as self-managed nodes next to cloud servers, and so can machines from AWS, Google Cloud, Azure or your own data centre. It includes an OCI container registry (Hetzner has none of its own), creates load balancers for LoadBalancer Services, and has a Helm charts marketplace in preview. Plans are per cluster. Basic shares its control plane with other customers on best-effort uptime, Pro has a dedicated control plane with a 99.95% SLA, and Enterprise is 99.99%.

It is a weaker fit if you want the control plane on servers you own, or want delivery, GitOps, backups and image scanning in the same product. Those are left to you. We wrote up the differences in Ankra vs Cloudfleet.

Best for teams that want a hosted control plane with an SLA and need one cluster to span Hetzner and a hyperscaler or their own hardware.

Edka

Edka is a newer platform from Edka Digital S.L. in Barcelona that provisions a k3s-based Kubernetes platform inside your own Hetzner Cloud account. Hetzner is its only supported provider today, and you keep full access to the cluster with your own tools.

It is good at getting a small team to a working platform quickly. It installs a curated set of add-ons (Gateway API controllers, certificate management, metrics and logs with VictoriaMetrics and VictoriaLogs, operators), lets you run PostgreSQL, MySQL, Valkey and ClickHouse next to your apps, and can attach Hetzner dedicated servers as workers over a vSwitch.

It is a weaker fit if you need providers beyond Hetzner. The Hetzner Community tutorial for Edka shows jobs that stay with you, such as pointing DNS at the ingress load balancer, providing the external bucket for database backups, and checking that deleted clusters left nothing behind in your Hetzner project.

Best for small teams that want a k3s cluster with databases and observability preinstalled on Hetzner and do not plan to use other clouds.

kube-hetzner

kube-hetzner is an MIT-licensed Terraform and OpenTofu module that builds k3s or RKE2 clusters on Hetzner Cloud. It runs on openSUSE Leap Micro by default.

It is good at giving you a production-shaped cluster from one Terraform apply. You get a choice of Flannel, Calico or Cilium, an odd-numbered control plane quorum, node pools across locations, Cluster Autoscaler node pools, private-only networking with NAT, CSI storage, ingress, and integrated OS and Kubernetes upgrades.

It is a weaker fit if nobody on the team wants to own Terraform state and Kubernetes internals. Backups, monitoring, application delivery and incident response are yours to design, and when an upgrade goes wrong, the fix is yours too.

Best for infrastructure teams that already manage everything in Terraform and want a well-trodden module rather than a vendor.

hetzner-k3s

hetzner-k3s is an MIT-licensed command line tool by Vito Botta that creates k3s clusters on Hetzner Cloud from a single cluster.yaml file. Its README reports a three-node HA cluster in two to three minutes.

It is good at speed and simplicity. It installs the Hetzner cloud controller manager and CSI driver, the System Upgrade Controller for k3s upgrades, and the Cluster Autoscaler. Traefik, ServiceLB and metrics-server are optional add-ons.

It is a weaker fit once the cluster is up. The tool creates and scales clusters, and the rest is up to you. That includes ingress choices beyond the optional Traefik, monitoring, backups, secrets and deployments.

Best for developers and small teams who want a real k3s cluster on Hetzner in minutes and are comfortable running it themselves.

Talos Linux with Sidero Omni

Talos Linux is an immutable, API-managed operating system built only to run Kubernetes, made by Sidero Labs and open source under MPL-2.0. Omni is Sidero’s fleet manager for Talos clusters, offered as SaaS or self-hosted. Hetzner Cloud offers a public Talos ISO.

It is good at security and repeatable upgrades. Talos has no SSH, no shell and no package manager, and Omni rolls out Talos and Kubernetes upgrades across a fleet with health checks and automatic rollback. Omni has a free Hobby plan for small setups. Its source code is under the Business Source License, so self-hosting it in production needs a commercial licence.

It is a weaker fit if you want Hetzner servers created for you. Omni’s Hetzner guide has you build a Talos image with Packer and create the servers yourself. The Hetzner cloud controller manager, CSI driver, ingress, monitoring, backups and application delivery are also yours to add.

Best for teams that value a locked-down OS and fleet-wide upgrades, often across bare metal and cloud, and have the skills to assemble the rest.

Rancher with Cluster API

Rancher, from SUSE, is a self-hosted multi-cluster management server, open source under Apache-2.0 with a paid Rancher Prime edition. On Hetzner, teams either build clusters with another tool and register them in Rancher, or provision them through Cluster API using CAPH. Rancher Turtles is SUSE’s extension that brings Cluster API into Rancher.

It is good at managing many clusters from one place, with RBAC and authentication. Registered k3s and RKE2 clusters can have their Kubernetes versions upgraded from Rancher.

It is a weaker fit for a small team on Hetzner. You operate Rancher itself on top of your clusters, Hetzner is not among the Turtles certified providers (so CAPH runs as a community provider), and the older Hetzner node driver for Rancher is a community project. Backups, ingress, monitoring and delivery are add-ons you choose and run.

Best for organisations that already run Rancher elsewhere and want Hetzner clusters in the same console.

Moving from EKS or AWS to Hetzner

Your manifests and Helm charts mostly move as they are. The work is in the parts that were AWS services. Hetzner raised its cloud prices in 2026, so model the new bill on today’s prices before you commit (our worked numbers show how).

• Load balancers. AWS Load Balancer Controller annotations do nothing on Hetzner. Services of type LoadBalancer get a Hetzner Load Balancer through the cloud controller manager, which reads its own load-balancer.hetzner.cloud/* annotations.
• Storage classes. EBS gp2 and gp3 classes become the Hetzner CSI class (for example hcloud-volumes). Hetzner Volumes are block storage that attach to one server at a time, so anything that used EFS for shared read-write storage needs another design, such as object storage or an in-cluster storage system.
• Identity. IRSA and EKS Pod Identity have no Hetzner equivalent. Hetzner Cloud API tokens are created per project, so workloads that called AWS APIs with IAM roles need their own credentials in Kubernetes Secrets.
• Managed databases. Hetzner Cloud does not list a managed PostgreSQL or MySQL service. Your choices are a database operator inside the cluster (CloudNativePG is common for PostgreSQL), a managed platform that provides one (Syself and Edka both list databases), or a database provider outside Hetzner.
• Everything else from AWS. ECR, CloudWatch, Secrets Manager, Route 53 and ACM each need a replacement, typically a registry, Prometheus and a log store, SOPS or an external secrets store, external-dns, and cert-manager.

Velero can back up workloads and volumes from EKS and restore them on the new cluster. With Ankra, you can import the EKS cluster, then clone its stacks onto a new Hetzner cluster in one step. Provider pieces such as the cloud controller and networking stacks are swapped for the Hetzner versions, and secrets are left for you to re-enter. Review any stack that still pins an EBS storage class or AWS load balancer annotation. Volume data and logical database dumps can be restored from a backup bucket you own.

How to choose

• If you want the cluster, deployments, security scanning and day-2 operations from one platform on servers you own, pick Ankra.
• If you want Cluster API with the CAPH maintainers on call, and bare metal in the mix, pick Syself.
• If you want a hosted control plane with an SLA and nodes from Hetzner plus a hyperscaler in one cluster, pick Cloudfleet.
• If you are a small team that only uses Hetzner and wants databases and observability preinstalled on k3s, look at Edka.
• If your team lives in Terraform and wants to own every layer, pick kube-hetzner.
• If you want a k3s cluster in minutes from a single file, pick hetzner-k3s.
• If OS hardening and fleet upgrades matter most and you can build the rest, pick Talos with Omni.
• If Rancher is already your standard, register your Hetzner clusters in it.

To try Ankra before connecting your Hetzner account, start a playground cluster.

Frequently asked questions

What is the best way to get managed Kubernetes on Hetzner?

Hetzner has no managed Kubernetes of its own, so “managed” means a third party. Ankra, Syself and Edka run clusters inside your own Hetzner account, while Cloudfleet hosts the control plane and adds Hetzner nodes. Ankra adds pipelines with security scanning, previews and AI operations on top of the cluster.

How should I set up production Kubernetes on Hetzner Cloud?

Use at least three control plane nodes, keep nodes on a private network, and install the Hetzner cloud controller manager and CSI driver. Then add ingress with TLS, monitoring, backups to object storage, and a tested upgrade process. Open source tools give you the cluster, and a managed option such as Ankra or Syself also takes on upgrades and the work around them.

How can we move off AWS to Hetzner without building our own platform team?

Pick an option that owns day-2 work, not only cluster creation. A platform that handles upgrades, ingress, backups and deployments replaces most of what EKS gave you. Plan for the load balancer, storage class, IAM and database changes listed above before you move production.

What are the best tools to migrate from EKS to Kubernetes on Hetzner or OVHcloud?

Velero is the common open source choice for moving workloads and volumes between clusters. Ankra can import an EKS cluster and clone its stacks onto a new cluster it builds on Hetzner or OVHcloud, swapping in that provider’s cloud controller, after which you review values that still point at AWS. Whichever tool you use, rewrite IAM-based access and replace AWS managed services first.