Open-Source DevOps · syself

cluster-api-provider-hetzner

Cluster API Provider Hetzner (CAPH) is a Kubernetes operator that lets you declare and manage Kubernetes clusters on Hetzner's infrastructure using standard Kubernetes resources. It automates cluster provisioning, scaling, and self-healing without vendor lock-in, making Hetzner a viable alternative to managed cloud providers.

Talk to DEV.co Discuss Implementation

Source: GitHub — github.com/syself/cluster-api-provider-hetzner

1.1k

GitHub stars

105

Forks

Primary language

Apache-2.0

License (OSI-approved)

Key facts

Objective fields from the source. Values we can't verify are shown as “Unknown” rather than guessed.

Field	Value
Repository	syself/cluster-api-provider-hetzner
Owner	syself
Primary language	Go
License	Apache-2.0 — OSI-approved
Stars	1.1k
Forks	105
Open issues	183
Latest release	v1.1.7 (2026-06-17)
Last updated	2026-07-08
Source	https://github.com/syself/cluster-api-provider-hetzner

What cluster-api-provider-hetzner is

CAPH extends the Kubernetes API with Custom Resource Definitions (CRDs) to declaratively provision and manage bare-metal and cloud infrastructure on Hetzner. Built in Go, it integrates with Cluster API (CAPI) standards, supports self-healing via controller reconciliation, and includes a CSR controller for secure kubelet certificate management.

Quickstart

Get the cluster-api-provider-hetzner source

Clone the repository and explore it locally.

terminalbash

1git clone https://github.com/syself/cluster-api-provider-hetzner.git2cd cluster-api-provider-hetzner3# follow the project's README for install & configuration

Need it deployed, integrated, or customized instead? DEV.co ships production installs.

Best use cases

Cost-optimized multi-cluster deployments

Organizations seeking to reduce infrastructure costs by running Kubernetes on Hetzner's bare-metal and cloud offerings while maintaining declarative, GitOps-friendly cluster management.

On-premises or private-cloud Kubernetes

Teams needing full infrastructure control, audit trails, and data residency compliance who want declarative Kubernetes-native tooling without managed cloud provider constraints.

Self-managed Kubernetes at scale

Infrastructure teams with DevOps expertise who want automation, self-healing, and repeatable cluster provisioning via Cluster API standards without locked-in proprietary APIs.

Implementation considerations

Requires a bootstrap cluster (e.g., Kind) and Cluster API/CAPH controllers running before provisioning workload clusters; plan for initial setup overhead.
Custom OS images must pre-install container runtime, kubelet, kubeadm, and other prerequisites, or use kubeadm config scripts; reference images from kubernetes-sigs/image-builder recommended.
CSR controller for secure kubelet certificates is available but requires additional configuration; validate certificate rotation and metrics-server integration in your security model.
Provider is independent from Hetzner; monitor release cadence and community activity; v1.1.7 is latest (June 2026) with active development, but no guaranteed long-term support.
Compatibility matrix between CAPH, Cluster API, and Kubernetes versions is tied to CAPI versioning; plan version upgrades carefully and test in staging.

When to avoid it — and what to weigh

Require fully managed/hands-off Kubernetes — If your team lacks Kubernetes operations expertise or needs zero operational overhead, a managed service like EKS, GKE, or AKS is more appropriate. CAPH requires active cluster management.
Need multi-cloud or hybrid-cloud portability — While CAPH follows Cluster API standards, it is Hetzner-specific. If you require easy migration across AWS, Azure, or GCP, consider multi-cloud providers or broader CAPI implementations.
Enterprise support or SLA guarantees required — CAPH is community-maintained by Syself; there is no official Hetzner backing. Organizations requiring vendor-backed SLAs and guaranteed support should use mainstream managed services.
Minimal Kubernetes expertise in-house — Operator requires understanding of Kubernetes CRDs, kubeadm, kubelet, container runtimes, and infrastructure automation. Unsuitable for teams new to Kubernetes operations.

License & commercial use

Licensed under Apache License 2.0 (Apache-2.0), a permissive OSI-approved open-source license.

Apache-2.0 permits commercial use, modification, and distribution without license restrictions. However, the project itself is community-maintained by Syself (a separate commercial entity offering a managed service). No warranty or indemnification is provided under the open-source license; commercial users should evaluate liability and support implications independently. Syself offers a commercial "batteries-included" managed platform, but CAPH itself carries no commercial support contract.

DEV.co evaluation signals

Editorial assessment — not user reviews. Directional, with an explicit confidence level.

Signal	Assessment
Maintenance	Active
Documentation	Strong
License clarity	Clear
Deployment complexity	High
DEV.co fit	Good
Assessment confidence	High

Security considerations

CAPH uses standard Kubernetes RBAC, CRDs, and webhooks. CSR controller enables secure kubelet certificate management and metrics-server authentication. Hetzner API credentials must be securely managed (e.g., sealed secrets, external secret stores). No formal security audit, penetration test results, or CVE disclosure policy stated in available data. Custom node images must include security patches; image-builder usage recommended. Network policies, pod security standards, and secrets management are the operator's responsibility.

Alternatives to consider

Kubeadm + manual Hetzner provisioning

Full control but requires shell scripts, Terraform, or similar IaC; no Kubernetes-native declarative management or self-healing.

Cluster API on AWS/Azure/GCP (AWS, Azure, GCP providers)

Multi-cloud or hybrid-cloud portability, broader ecosystem, and vendor-backed tooling; higher infrastructure costs and less flexibility for bare-metal deployments.

Managed Kubernetes (EKS, GKE, AKS, or Hetzner Kubernetes Service if available)

Hands-off operations, guaranteed SLAs, vendor support; no infrastructure control, higher per-node costs, potential lock-in.

Software development agency

Build on cluster-api-provider-hetzner with DEV.co software developers

Review the compatibility matrix and quickstart guide. Assess your team's Kubernetes operations maturity. For enterprise support, consider Syself's managed platform.

Talk to DEV.co

Related open-source tools

Surfaced by semantic similarity across the DEV.co open-source index.

hetzner-k3s krr ContainerSSH

Related on DEV.co

Explore the category and the services that help you build with it.

Open-Source DevOps DevOps Cloud Deployment API Development Talk to DEV.co

cluster-api-provider-hetzner FAQ

Is CAPH an official Hetzner project?

No. CAPH is independently maintained by Syself and the Kubernetes community. It is not an official Hetzner project. Support and updates depend on community engagement.

Can I use CAPH for production workloads?

Yes, if your team has Kubernetes operations expertise. CAPH is actively maintained and follows Cluster API standards. However, you are responsible for security, upgrades, and troubleshooting; no commercial SLA is guaranteed.

What infrastructure does CAPH provision?

Bare-metal servers and cloud instances on Hetzner (hcloud). It manages the Kubernetes control plane and worker nodes, networking, and self-healing via Cluster API controllers.

How does CAPH differ from Syself's managed platform?

CAPH is open-source and self-managed (you run the controllers, manage upgrades, handle incidents). Syself's commercial platform is a managed service with pre-configured images, dedicated support, and hands-off operations.

Work with a software development agency

DEV.co is a software development agency delivering custom software development services to companies building on open source. Our software developers and web developers design, integrate, and ship production systems — spanning web development, APIs, AI, data, and cloud. If cluster-api-provider-hetzner is part of your open-source devops roadmap, our team can implement, customize, migrate, and maintain it.

Ready to manage Kubernetes on Hetzner?

Review the compatibility matrix and quickstart guide. Assess your team's Kubernetes operations maturity. For enterprise support, consider Syself's managed platform.

Talk to DEV.co Schedule a Consultation