Hosted Control Plane
Early access
The hosted control plane and worker pools are live (see Worker Pools). Billing is not switched on yet — the system is built and the Pricing page is authoritative, but no payment provider is connected, so you cannot be charged today. The hosted path is in early access while it matures toward general availability.
Prefer to run everything yourself? The self-hosted path is fully available — you run the cluster on your own Hetzner account and kubehz gives you dashboard visibility. Start with KubeOne on Hetzner and Registration.
The idea
With a hosted control plane, kubehz runs the Kubernetes control-plane components (etcd, apiserver, scheduler, controller-manager) on kubehz infrastructure in Hetzner FSN1 (Falkenstein, Germany). You run only workers on your own Hetzner account. The goal is simple: you never operate — or even hold — a control plane. Throw away the kubeconfig babysitting; point workers at an endpoint we keep alive.
This is the hosting: hosted axis of the two-axis model. It is a different trade-off from self-hosting:
| Aspect | Self-hosted (available today) | Hosted control plane (early access) |
|---|---|---|
| Control plane | You run it | kubehz runs it |
| Workers | You run them | You run them |
| Hetzner token | Not needed for registered visibility | Optional — a Read & Write token unlocks worker provisioning |
| Data residency | Your account | kubehz infra in Hetzner FSN1 (EU) |
Cluster domains
Creating a hosted cluster starts with a domain — say cluster.example.com. The domain names the cluster: it is the cluster's identity, following the lok8s convention where everything keys on the cluster domain — the cluster.lok8s.yaml spec, the clusters/<domain>/ repo layout, heartbeat addressing.
No DNS setup is required to create a cluster. Nothing resolves the domain, and kubectl talks to a kubehz-managed endpoint — never to your domain.
DNS only becomes relevant later, for your workloads: when you run an ingress or gateway on your workers, you point records at it, at your own DNS provider.
The API enforces lowercase FQDN syntax (e.g. cluster.example.com).
The Hetzner token
Connecting a Hetzner Cloud API token is optional: without one you still see list pricing and can run a control-plane-only cluster, while a Read & Write token gives your account's exact pricing and unlocks worker provisioning. See The Hetzner token for the full model.
What's live today
- Control-plane reconciliation — the kubehz operator turns a hosted-cluster request into a Kubermatic (KKP) user cluster: live.
- Worker provisioning — creating and joining your workers to a hosted control plane: live for hosted clusters with a connected Hetzner token — see Worker Pools.
- Billing — built, not yet switched on: no payment provider is connected (see the Pricing page), so hosted plans are not billed today.
We call this early access: the platform is live; billing is built but not yet switched on, and the remaining pieces (managed upgrades, migration) roll out gradually rather than behind one big switch.
Pricing
The Pricing page is authoritative (billing is not switched on yet — you cannot be charged today). The list prices:
| Plan | Monthly cost |
|---|---|
| dev (1× API server) | 8 EUR/mo |
| starter (2× API server) | 12 EUR/mo |
| pro (3× API server, HA, monitoring included) | 24 EUR/mo |
| enterprise (custom) | let's talk — depends on what you need |
Backups are not a separate line item: scheduled etcd snapshots are included in every paid plan. Worker-node costs are paid directly to Hetzner based on the server types you choose. These prices are calculated from measured costs on our own fleet — not placeholders.
Data residency
Your hosted control plane runs in Hetzner FSN1 (Falkenstein, Germany) — all data within the EU.
Encrypted by default
Traffic inside a hosted cluster is WireGuard-encrypted by default — pod-to-pod and node-to-node, transparently at the network layer, at no extra cost and with nothing to configure. That covers your workloads' traffic as it crosses Hetzner's shared infrastructure, and the control plane's internals on our side run the same posture. (This complements — never replaces — TLS on traffic that leaves the cluster.)
Encryption is enforced platform policy, not a preference: the platform re-applies it on every reconcile, so it cannot be switched off per cluster — if your compliance posture requires plaintext pod traffic, hosted clusters are the wrong fit.
Next steps
- Worker Pools — pools, scaling, autoscaling, labels and taints on your hosted cluster.
- Add-ons — how to use each hosted add-on (dashboard, OPA, backups, audit, monitoring, logging, dedicated nodes).
- KubeOne on Hetzner — provision a production cluster on your own account (available now).
- Registration — connect that cluster to the dashboard for read-only health visibility (available now).
- How it works — the hosting × access model and where hosted fits.
Doc status
| Aspect | Detail |
|---|---|
| State | early access — control plane + workers live; billing built, not yet switched on |
| Last reviewed | 2026-07-19 |