Worker Pools (Hosted)
For a hosted cluster, kubehz runs the control plane and provisions your worker pools on your own Hetzner account, using the Hetzner API token you connected. The worker servers appear in your Hetzner project like any other server: you pay Hetzner directly for them, at Hetzner’s prices; kubehz bills only the control plane. There is no kubehz markup on workers.
Concretely: a cx33 worker costs exactly Hetzner’s list price for a cx33; kubehz adds €0. Your Hetzner invoice is the whole worker bill.
You manage pools in the dashboard: when creating the cluster, or later on the cluster’s detail page.
Self-hosted?
On a self-hosted cluster, lok8s provisions workers on your account without kubehz in the loop; see KubeOne on Hetzner.
Requirements
- A connected Hetzner API token with Read & Write permission. Worker pools are exactly the delegation step of the trust boundary: kubehz creates servers on your account, so it needs a token that can do that. See The Hetzner token.
- A hosted cluster created with the token already connected. The provisioning mode is fixed at creation: a hosted cluster created without a connected token can not gain worker pools later. Connect a token, then recreate the cluster.
What you can do
- Add and remove pools: at cluster creation or any time after. Up to 4 pools per cluster, each with 0–20 nodes.
- Scale a pool’s node count up or down.
- Autoscale a pool: set a minimum and maximum instead of a fixed count, and the cluster-autoscaler sizes the pool to demand. While autoscaling is on, the autoscaler owns the node count; manual scaling is rejected. This requires the cluster-autoscaler addon running in the cluster; without it the bounds have no effect.
- Labels and taints per pool, to steer workloads onto the right pool (reserved
kubernetes.io//k8s.io/label prefixes are not allowed). - Change a pool’s machine type. Be clear about what this means: every node in the pool is replaced with new servers, rolling, and your workloads reschedule. The dashboard asks you to confirm exactly that before it starts.
What you can’t do
- Per-pool region: every pool runs in the cluster’s region. If you need another region, that is another cluster.
- Per-pool disk size: the disk follows the Hetzner server type you pick, as on any Hetzner server.
We would rather list these here than have you discover them in an error message.
Static nodes
A static pool holds worker nodes that you bring yourself: bare metal, another cloud, or a VM that already exists. kubehz does not create, replace, or rotate these servers. The CLI does the join for you, on the machine itself:
# on the machine you are adding (needs KUBEHZ_TOKEN)
lo kubehz node join --pool static
# behind NAT, or with a name of your own
lo kubehz node join --pool static --name edge-1 --node-ip 203.0.113.7
# see the kubeadm join line and run nothing
lo kubehz node join --pool static --print-only--pool names the static pool (it can be omitted when the cluster has only one), --name defaults to the machine’s short hostname, --node-ip is the address other nodes reach it on, --kubelet-version overrides what the CLI reads from the machine, and --cluster-id targets a cluster other than the active domain’s. lo kubehz node status lists the nodes you brought; lo kubehz node remove --name <node> takes one out and frees its slot.
A static node costs €0.50 per node per month. kubehz bills every started hour in full, for as long as the node is registered. The hourly charges never go above €0.50 in a month, also in a 31-day month, because the monthly price is a cap. A NotReady node is the one exception: kubehz never bills it, so a dead node costs nothing. Remove the node to stop the charge.
The same rules apply to the control plane and to every add-on. See Pricing.
The no-markup rule above still holds: kubehz adds nothing to the price of any server you buy from Hetzner. The static-node price pays for the load each extra node puts on your hosted control plane.
Static pools open per account during the rollout. If your cluster does not offer them, ask in chat.
Next steps
- Hosted control plane: the hosted path overall
- How it works: the trust boundary and what your token is used for
- Pricing: what kubehz charges and why
Doc status
| Aspect | Detail |
|---|---|
| State | Available: hosted clusters with a connected Hetzner token |
| Last reviewed | 5 September 2026 |