Hosted control plane
Hosted
The hosted control plane and worker pools are live (see Worker Pools). Nothing is charged before 1 November 2026. The Pricing page is authoritative, and every hosted feature is free until that date. The hosted path is available now, with no waiting list.
Prefer to run everything yourself? The self-hosted path is fully available: you run the cluster on your own Hetzner account and kubehz gives you dashboard visibility. Start with KubeOne on Hetzner and Registration.
The idea
With a hosted control plane, kubehz runs the Kubernetes control-plane components (etcd, apiserver, scheduler, controller-manager) on kubehz infrastructure in Hetzner FSN1 (Falkenstein, Germany). You run only workers on your own Hetzner account. The goal is simple: you never operate (or even hold) a control plane. Throw away the kubeconfig babysitting; point workers at an endpoint we keep alive.
This is the hosting: hosted axis of the two-axis model. It is a different trade-off from self-hosting:
| Aspect | Hosted control plane | Self-hosted (available today) |
|---|---|---|
| Control plane | kubehz runs it | You run it |
| Workers | You run them | You run them |
| Hetzner token | Optional for a control-plane-only cluster. Connect a Read & Write token at creation to unlock worker pools (the provisioning mode is fixed then) | Not needed for registered visibility |
| Data residency | kubehz infra in Hetzner FSN1 (EU) | Your account |
Cluster domains
Creating a hosted cluster starts with a domain, say cluster.example.com. The domain names the cluster: it is the cluster’s identity, following the lok8s convention. Everything keys on the cluster domain: the cluster.lok8s.yaml spec, the clusters/<domain>/ repo layout, heartbeat addressing.
No DNS setup is required to create a cluster. Nothing resolves the domain, and kubectl talks to a kubehz-managed endpoint, never to your domain.
DNS only becomes relevant later, for your workloads: when you run an ingress or gateway on your workers, you point records at it, at your own DNS provider.
The API enforces lowercase FQDN syntax (e.g. cluster.example.com).
The Hetzner token
Connecting a Hetzner Cloud API token is optional: without one you still see list pricing and can run a control-plane-only cluster, while a Read & Write token gives your account’s exact pricing and unlocks worker provisioning. See The Hetzner token for the full model.
What’s live today
- Control-plane reconciliation is live: the kubehz operator turns a hosted-cluster request into a Kubermatic (KKP) user cluster.
- Worker provisioning is live for hosted clusters with a connected Hetzner token: creating and joining your workers to a hosted control plane. See Worker Pools.
- Billing starts 1 November 2026: hosted control planes are free until that date (see the Pricing page).
- Migration out (eject) is live: moving your hosted control plane onto your own infrastructure, identity intact. See Migration.
The platform is live and everything is free until 1 November 2026. Managed upgrades are the one piece still rolling out; everything else on this page is available today.
Pricing
The Pricing page is authoritative (nothing is charged before 1 November 2026). There is no plan: you set the shape, and the meter prices the three units below, per hour.
€0 until 1 November 2026
| Unit | Per hour | Monthly cap |
|---|---|---|
| Control plane: 1 API server, the datastore, scheduled backups, the first 2 GB of state | €0.016/h | €11.68/mo |
| Each extra API server, up to 3 | €0.008/h | €5.84/mo |
| State above 2 GB, per GB held | €0.0005/h | €0.37/mo |
An enterprise shape is priced on your workload: talk to us.
Backups are not a separate line item: scheduled etcd snapshots are included in every hosted control plane. Add-ons are metered the same way, see Add-ons. Worker-node costs are paid directly to Hetzner based on the server types you choose. These prices are calculated from measured costs on our own fleet, not placeholders.
Create a hosted cluster (€0 today)
Data residency
Your hosted control plane runs in Hetzner FSN1 (Falkenstein, Germany): all data within the EU.
Encrypted by default
Traffic inside a hosted cluster is WireGuard-encrypted by default: pod-to-pod and node-to-node, transparently at the network layer, at no extra cost and with nothing to configure. That covers your workloads’ traffic as it crosses Hetzner’s shared infrastructure, and the control plane’s internals on our side run the same posture. (This complements TLS on traffic that leaves the cluster; it never replaces it.)
Encryption is enforced platform policy, not a preference: the platform re-applies it on every reconcile, so it cannot be switched off per cluster. If your compliance posture requires plaintext pod traffic, hosted clusters are the wrong fit.
Next steps
- The Hetzner token: what a token unlocks, how to scope it, and what happens if you connect it later.
- Connecting with kubectl: download the OIDC kubeconfig and reach the cluster from your terminal.
- Worker Pools: pools, scaling, autoscaling, labels and taints on your hosted cluster.
- Add-ons: how to use each hosted add-on (dashboard, OPA, backups, audit, monitoring, logging, dedicated nodes).
- How it works: the hosting × access model and where hosted fits.
Doc status
| Aspect | Detail |
|---|---|
| State | Live: control plane + workers live; billing starts 1 November 2026 |
| Last reviewed | 19 July 2026 |