Kubernetes on Hetzner
Production Kubernetes on Hetzner, in one command.
Ankra builds a private kubeadm cluster in your own Hetzner Cloud project, with a bastion, load balancers, ingress, TLS and DNS, then keeps operating it. Hetzner bills you for the servers. Ankra is free up to 30 worker vCPUs.
$ ankra cluster hetzner create --name prod-fsn1 --location fsn1 \ --credential-id $HCLOUD_CRED --ssh-key-credential-id $SSH_KEY \ --control-plane-count 3 --worker-count 3 --worker-server-type cpx32 Hetzner cluster 'prod-fsn1' created successfully! Cluster ID: 5b1e0c3a-7d2f-4e61-9a0b-2c8f6d4e1a77 $ ankra cluster select prod-fsn1 Selected cluster: prod-fsn1 is now active.$ ankra cluster operations list -w Watching executions (every 5s, press Ctrl+C to stop) network, bastion, control planes, workers, hcloud CCM and CSI, Traefik, DNS All executions have reached a terminal state. Stopping watch. $ ankra cluster kubeconfig add prod-fsn1 --use Added context "ankra-prod-fsn1" to ~/.kube/config$ kubectl get nodes NAME STATUS ROLES AGE VERSION prod-fsn1-cp-1 Ready control-plane 7m v1.34.1 prod-fsn1-cp-2 Ready control-plane 7m v1.34.1 prod-fsn1-cp-3 Ready control-plane 7m v1.34.1 prod-fsn1-worker-1 Ready <none> 5m v1.34.1 prod-fsn1-worker-2 Ready <none> 5m v1.34.1 prod-fsn1-worker-3 Ready <none> 5m v1.34.1Sample session. Commands, flags and output wording are the Ankra CLI's own. Names, IDs, ages and versions are examples.
What one command builds
A private cluster, not a pile of VMs.
Everything lands in your own Hetzner project. Only the bastion has a public IP. Pick server types or let Ankra pick the cheapest x86 type in stock that fits each role.
- 01Private networkA Hetzner network for every node, 10.0.0.0/16 unless you pass another range.
- 02BastionThe only public IP. SSH jump host and the NAT for node egress.
- 03Control planeskubeadm with Cilium, 1 or 3, stacked etcd or dedicated etcd servers.
- 04WorkersA default pool, plus node groups you add, scale and upgrade later.
- 05hcloud CCM and CSIHetzner Load Balancers for Services and the
hcloud-volumesStorageClass. - 06Ingress and TLSTraefik, cert-manager and Let's Encrypt behind a Hetzner Load Balancer. On by default.
- 07DNSA subdomain on ankra.cc, so an ingress hostname gets its record and certificate. On by default.
Step by step
From an API token to kubectl get nodes.
The same flow works in the dashboard and the API. These are the CLI steps from the Hetzner guide.
Prefer to ask? Your AI client can callcreate_hetzner_cluster through the Ankra MCP server.- 1
Store your Hetzner API token
Create a read and write token in the Hetzner Cloud console. The CLI prompts for it.
ankra credentials hetzner create --name hz - 2
Add an SSH key credential
Bring your own public key or let Ankra generate one. Save the private key it prints, it is shown once.
ankra credentials hetzner ssh-key create --name my-key --generate - 3
Check what is in stock
Stock differs per location. Skip this and leave server types out to let Ankra choose.
ankra credentials listshows the credential IDs.ankra cluster hetzner server-types --credential-id <id> \ --location fsn1 --available-only - 4
Create the cluster
Locations are fsn1, nbg1, hel1, ash, hil and sin. Add
--distribution k3sfor k3s.ankra cluster hetzner create --name my-cluster --location fsn1 \ --credential-id <id> --ssh-key-credential-id <key-id> \ --control-plane-count 3 --worker-count 3 - 5
Watch it come up, then use kubectl
The cluster turns Online once the Ankra Agent connects. Kubeconfig access goes through Ankra and needs a Cluster Access grant.
ankra cluster select my-cluster ankra cluster operations list -w ankra cluster kubeconfig add my-cluster --use kubectl get nodes
Options
Defaults that work. Flags when they don't.
Everything below is a flag on create, a field in the dashboard wizard or a later command.
kubeadm or k3s
kubeadm with Cilium is the default.
--distribution k3sfor k3s,--etcd-topology externalfor dedicated etcd servers.Node groups
ankra cluster hetzner node-group add,scaleandupgrade, each with its own server type. Groups move to larger types only.GitOps from day one
Pass a repository at create time and the cluster and its Stacks live in Git, synced by Ankra.
Stop and start
ankra cluster hetzner stoptakes an encrypted etcd snapshot and deletes the servers.startre-provisions and restores it. Volumes are kept and still billed.Costs you can see
Cloud Cost estimates spend per cluster, namespace and stack from live inventory and public pricing.
AI operations
A failing pod gets an analysis from its logs, events and deploy history, with a drafted fix for you to approve.
Six locations
Falkenstein, Nuremberg, Helsinki, Ashburn, Hillsboro and Singapore, listed in the Hetzner reference.
Portable stacks
Ingress, monitoring and your apps live in Stacks you can clone to a cluster on OVHcloud or UpCloud.
Run the numbers
Two invoices, one workload.
Drag the slider to your cluster size. Prices are list prices, and the caveats sit under the result. The repricing math is in Hetzner Repriced.
Hetzner + Ankra vs AWS EKS
Same worker vCPUs, two invoices
Same worker vCPUs, roughly
12.8x cheaperList prices: Hetzner Germany/Finland monthly caps excluding VAT, checked September 2026, and EKS on-demand in us-east-1 as of August 2026, before storage, egress, and observability. The multiple converts at the ECB rate of 2026-09-15, $1.1539 per €1. Shared Hetzner cores versus dedicated EC2 cores, one region versus three availability zones: this compares invoices, not SLAs. Savings plans and spot pricing narrow the gap, at the price of commitment or interruptions.
Compared
EKS, DIY on Hetzner, or Hetzner with Ankra.
Three honest ways to run Kubernetes when the budget matters.
| AWS EKS | DIY on Hetzner | Hetzner + Ankra | |
|---|---|---|---|
| Monthly invoice, 24 worker vCPUs | ~$950 before storage and egress | ~€65 in servers, plus your evenings | ~€65 all in |
| Control plane | $73/mo per cluster | Yours to babysit | Included, never billed |
| Getting to a cluster | An afternoon of VPC and IAM wiring | Days of Terraform and scripts | One command or the wizard |
| Ingress, TLS and DNS | Assemble it yourself | Assemble it yourself | On by default |
| Upgrades | Managed control plane, nodes are yours | Your runbook | ankra cluster upgrade |
| When it breaks at 3am | Support tiers and ticket queues | You, with kubectl and coffee | AI analysis with a drafted fix |
Know before you build
Hetzner specifics.
- Hetzner disks cannot shrink, so a node group only moves to larger server types. For smaller nodes, add a new group and delete the old one.
- Stock varies per location and server type. Run
server-types --available-only, or leave types out and Ankra picks one in stock. - The bastion is the only server with a public IP and carries node egress. Restrict SSH to it with
--bastion-allowed-ips. - Hetzner raised cloud prices on June 15, 2026. Existing servers keep their old price until they are resized.
FAQ
Does Hetzner offer managed Kubernetes?
No. Hetzner sells compute, networking and load balancers, but no managed Kubernetes product. Ankra provides that layer: it builds and operates kubeadm (or k3s) clusters in your own Hetzner Cloud project, so the servers stay yours and the compute invoice stays Hetzner's.
kubeadm or k3s on Hetzner?
kubeadm is the default and always runs Cilium, with stacked etcd or dedicated etcd servers. Pass --distribution k3s for a lighter cluster. Both are certified Kubernetes, so your manifests do not change.
What does production Kubernetes on Hetzner cost?
A 24 worker vCPU baseline lands around €65 a month all in: three CX43 workers, a CX33 control plane, a bastion and IPv4 addresses at post June 2026 list prices, with the Ankra fee at €0 inside the 30 vCPU free allowance. The same footprint on AWS EKS is roughly $950 a month before storage and egress. The calculator on this page runs the numbers for your size.
What happened to Hetzner prices in June 2026?
On June 15, 2026 Hetzner raised cloud prices: shared CX and Arm CAX lines went up roughly a third, while CPX and dedicated CCX families doubled or more. Existing servers keep their old price until resized. Even after the increase, Hetzner is by a comfortable margin the cheapest serious place to run Kubernetes in Europe.
What if I want to leave Hetzner later?
Your platform layer lives in Stacks, so the same setup can be cloned to a cluster on OVHcloud or UpCloud, with variables resolved per cluster and secrets reconfigured per environment.
How does Ankra pricing work on top of Hetzner?
Ankra bills on worker vCPUs only. Control planes are never billed, every plan includes 30 worker vCPUs free, and the free tier needs no credit card. Hetzner bills you directly for the servers.
Your first Hetzner cluster fits in the free allowance.
30 worker vCPUs included, control planes never billed, no credit card. Bring your Hetzner project.
Ankra is an independent platform and is not affiliated with or endorsed by Hetzner Online GmbH. Hetzner and AWS prices on this page are list prices as of August 2026 and can change. Product details were checked against the Ankra documentation and CLI in October 2026.