Kubernetes on Hetzner Germany: K8s IaaS Guide
Hetzner is a strong platform for a cost-conscious, self-managed Kubernetes cluster when a team already owns control-plane upgrades, networking, storage, observability, and incident response. It is not a managed equivalent to EKS, GKE, or AKS. Selecting a German location can satisfy a data-location requirement, but neither Hetzner nor Kubernetes alone guarantees GDPR compliance or data sovereignty.
Design around locations and failure domains
Hetzner Cloud currently operates in Falkenstein, Nuremberg, Helsinki, Ashburn, Hillsboro, and Singapore, as listed in the official location documentation. Choose Nuremberg or Falkenstein only when the workload must remain in Germany, and verify that every required server type, volume, load balancer, snapshot, and backup feature is available there. A label such as “eu-central” is not evidence that each copy remains in the selected city.
Run at least three control-plane members for production and decide whether they occupy one location for low latency or multiple locations for facility resilience. Cross-location latency and network partitions can damage etcd availability, so measure rather than assume. Document how the API endpoint, quorum, and workloads recover after losing a server, rack, network path, and complete location.
Integrate cloud resources without surrendering cluster state
The official Hetzner Cloud Controller Manager connects Kubernetes node and load-balancer behavior to the Cloud API. The official CSI driver dynamically provisions Hetzner Cloud volumes. Pin compatible versions, give each component the minimum API permissions possible, and test rotation of its credentials.
A cloud volume is not a backup and may be constrained to a location. Stateful services need topology rules, application-consistent backups, an independent restore target, and tested rescheduling. Keep etcd snapshots outside the cluster and verify a full control-plane restore. For networking, distinguish Cloud private networks from the vSwitch feature used to connect dedicated servers; protect the Kubernetes API and node ports with explicit firewalls.
Price the missing managed service
Compare worker, control-plane, load balancer, public IPv4, volume, snapshot, backup, egress, monitoring, support, and engineering on-call costs. A small virtual-machine bill can still be the expensive option if upgrades consume specialist days or incidents extend recovery. Conversely, a stable platform team can reuse automation and make self-management economical.
Before production, rehearse a Kubernetes minor upgrade, node replacement, certificate renewal, CSI and controller upgrade, region outage, secret rotation, ransomware restore, and capacity spike. Review Hetzner's current contractual and privacy terms and map controllers, processors, subprocessors, support access, encryption keys, logs, and backups. Infrastructure location is one input to compliance; governance and tested operations are what make the deployment defensible.
Published · Updated