Kubernetes on Hetzner
Production Kubernetes on Hetzner, in one command.
Ankra builds a private kubeadm cluster in your own Hetzner Cloud project, with a bastion, load balancers, ingress, TLS and DNS, then keeps operating it.
Hetzner bills you for the servers. Ankra is free up to 30 worker vCPUs.
$ ankra cluster hetzner create --name prod-fsn1 --location fsn1 \ --credential-id $HCLOUD_CRED --ssh-key-credential-id $SSH_KEY \ --control-plane-count 3 --worker-count 3 --worker-server-type cpx32 Hetzner cluster 'prod-fsn1' created successfully! Cluster ID: 5b1e0c3a-7d2f-4e61-9a0b-2c8f6d4e1a77 $ ankra cluster select prod-fsn1 Selected cluster: prod-fsn1 is now active.$ ankra cluster operations list -w Watching executions (every 5s, press Ctrl+C to stop) network, bastion, control planes, workers, hcloud CCM and CSI, Traefik, DNS All executions have reached a terminal state. Stopping watch. $ ankra cluster kubeconfig add prod-fsn1 --use Added context "ankra-prod-fsn1" to ~/.kube/config$ kubectl get nodes NAME STATUS ROLES AGE VERSION prod-fsn1-cp-1 Ready control-plane 7m v1.34.1 prod-fsn1-cp-2 Ready control-plane 7m v1.34.1 prod-fsn1-cp-3 Ready control-plane 7m v1.34.1 prod-fsn1-worker-1 Ready <none> 5m v1.34.1 prod-fsn1-worker-2 Ready <none> 5m v1.34.1 prod-fsn1-worker-3 Ready <none> 5m v1.34.1Sample session. Commands, flags and output wording are the Ankra CLI's own. Names, IDs, ages and versions are examples.
What one command builds
A private cluster, not a pile of VMs.
Everything lands in your own Hetzner project. Only the bastion has a public IP. Pick server types or let Ankra pick the cheapest x86 type in stock that fits each role.
Yours
Your Git repositories
Desired state for clusters, stacks and applications.
Ankra
Control plane
UI, API and orchestration at platform.ankra.app. Holds metadata, not your workloads.
Your Hetzner project
Kubernetes cluster
- Bastion
- Control planes
- Workers
Ankra agent, one per cluster
- Private networkA Hetzner network for every node, 10.0.0.0/16 unless you pass another range.
- BastionThe only public IP. SSH jump host and the NAT for node egress.
- Control planeskubeadm with Cilium, 1 or 3, stacked etcd or dedicated etcd servers.
- WorkersA default pool, plus node groups you add, scale and upgrade later.
- hcloud CCM and CSIHetzner Load Balancers for Services and the
hcloud-volumesStorageClass. - Ingress and TLSTraefik, cert-manager and Let's Encrypt behind a Hetzner Load Balancer. On by default.
- DNSA subdomain on ankra.cc, so an ingress hostname gets its record and certificate. On by default.
Step by step
From an API token to kubectl get nodes.
The same flow works in the dashboard and the API. These are the CLI steps from the Hetzner guide.
Prefer to ask? Your AI client can callcreate_hetzner_cluster through the Ankra MCP server.Store your Hetzner API token
Create a read and write token in the Hetzner Cloud console. The CLI prompts for it.
ankra credentials hetzner create --name hzAdd an SSH key credential
Bring your own public key or let Ankra generate one. Save the private key it prints, it is shown once.
ankra credentials hetzner ssh-key create --name my-key --generateCheck what is in stock
Stock differs per location. Skip this and leave server types out to let Ankra choose.
ankra credentials listshows the credential IDs.ankra cluster hetzner server-types --credential-id <id> \ --location fsn1 --available-onlyCreate the cluster
Locations are fsn1, nbg1, hel1, ash, hil and sin. Add
--distribution k3sfor k3s.ankra cluster hetzner create --name my-cluster --location fsn1 \ --credential-id <id> --ssh-key-credential-id <key-id> \ --control-plane-count 3 --worker-count 3Watch it come up, then use kubectl
The cluster turns Online once the Ankra Agent connects. Kubeconfig access goes through Ankra and needs a Cluster Access grant.
ankra cluster select my-cluster ankra cluster operations list -w ankra cluster kubeconfig add my-cluster --use kubectl get nodes
Options
Defaults that work. Flags when they don't.
Everything below is a flag on create, a field in the dashboard wizard or a later command.
Run the numbers
Two invoices, one workload.
Drag the slider to your cluster size. Prices are list prices, and the caveats sit under the result. The repricing math is in Hetzner Repriced.
Hetzner + Ankra vs AWS EKS
Same worker vCPUs, two invoices
Hetzner worker type
Hetzner + Ankra
- 3 × CX43 workers (8 vCPU / 16 GB)
- €47.97
- Control plane (CX33)
- €8.49
- Bastion host + IPv4
- €8.00
- Ankra platform fee (inside the 30 vCPU free allowance)
- €0
AWS EKS
- EKS control plane
- $73
- 6 × m6a.xlarge workers (4 vCPU / 16 GB)
- $756
- NAT gateways, 3 availability zones
- $98
- Application load balancer
- $22
about €822 at the ECB rate
Same worker vCPUs, roughly
12.8x cheaperList prices: Hetzner Germany/Finland monthly caps excluding VAT, checked September 2026, and EKS on-demand in us-east-1 as of August 2026, before storage, egress, and observability. The multiple converts at the ECB rate of 2026-09-15, $1.1539 per €1. Shared Hetzner cores versus dedicated EC2 cores, one region versus three availability zones: this compares invoices, not SLAs. Savings plans and spot pricing narrow the gap, at the price of commitment or interruptions.
Compared
EKS, DIY on Hetzner, or Hetzner with Ankra.
Three honest ways to run Kubernetes when the budget matters.
| Compared on | AWS EKS | DIY on Hetzner | Hetzner + Ankra |
|---|---|---|---|
| Monthly invoice, 24 worker vCPUs | ~$950 before storage and egress | ~€65 in servers, plus your evenings | ~€65 all in |
| Control plane | $73/mo per cluster | Yours to babysit | Included, never billed |
| Getting to a cluster | An afternoon of VPC and IAM wiring | Days of Terraform and scripts | One command or the wizard |
| Ingress, TLS and DNS | Assemble it yourself | Assemble it yourself | On by default |
| Upgrades | Managed control plane, nodes are yours | Your runbook | ankra cluster upgrade |
| When it breaks at 3am | Support tiers and ticket queues | You, with kubectl and coffee | AI analysis with a drafted fix |
Know before you build
Hetzner specifics.
- Hetzner disks cannot shrink, so a node group only moves to larger server types. For smaller nodes, add a new group and delete the old one.
- Stock varies per location and server type. Run
server-types --available-only, or leave types out and Ankra picks one in stock. - The bastion is the only server with a public IP and carries node egress. Restrict SSH to it with
--bastion-allowed-ips. - Hetzner raised cloud prices on June 15, 2026. Existing servers keep their old price until they are resized.
FAQ
Common questions
Does Hetzner offer managed Kubernetes?
No. Hetzner sells compute, networking and load balancers, but no managed Kubernetes product. Ankra provides that layer: it builds and operates kubeadm (or k3s) clusters in your own Hetzner Cloud project, so the servers stay yours and the compute invoice stays Hetzner's.
kubeadm or k3s on Hetzner?
kubeadm is the default and always runs Cilium, with stacked etcd or dedicated etcd servers. Pass --distribution k3s for a lighter cluster. Both are certified Kubernetes, so your manifests do not change.
What does production Kubernetes on Hetzner cost?
A 24 worker vCPU baseline lands around €65 a month all in: three CX43 workers, a CX33 control plane, a bastion and IPv4 addresses at post June 2026 list prices, with the Ankra fee at €0 inside the 30 vCPU free allowance. The same footprint on AWS EKS is roughly $950 a month before storage and egress. The calculator on this page runs the numbers for your size.
What happened to Hetzner prices in June 2026?
On June 15, 2026 Hetzner raised cloud prices: shared CX and Arm CAX lines went up roughly a third, while CPX and dedicated CCX families doubled or more. Existing servers keep their old price until resized. Even after the increase, Hetzner is by a comfortable margin the cheapest serious place to run Kubernetes in Europe.
What if I want to leave Hetzner later?
Your platform layer lives in Stacks, so the same setup can be cloned to a cluster on OVHcloud or UpCloud, with variables resolved per cluster and secrets reconfigured per environment.
How does Ankra pricing work on top of Hetzner?
Ankra bills on worker vCPUs only. Control planes are never billed, every plan includes 30 worker vCPUs free, and a small trial needs no card; adding one unlocks full access and €59 of welcome credit. Hetzner bills you directly for the servers.
Ankra is an independent platform and is not affiliated with or endorsed by Hetzner Online GmbH. Hetzner and AWS prices on this page are list prices as of August 2026 and can change. Product details were checked against the Ankra documentation and CLI in October 2026.
Your next chapter
Your first Hetzner cluster fits in the free allowance.
30 worker vCPUs included, control planes never billed, a small trial without a card. Bring your Hetzner project.
From something you built to something people use.
- Deploy from your repository
- Run on infrastructure you choose
- Operate with your team and agents