Worker Pools (Hosted)
For a hosted cluster, kubehz runs the control plane and provisions your worker pools on your own Hetzner account, using the Hetzner API token you connected. The worker servers appear in your Hetzner project like any other server: you pay Hetzner directly for them, at Hetzner's prices — kubehz bills only the control plane. There is no kubehz markup on workers.
You manage pools in the dashboard — when creating the cluster, or later on the cluster's detail page.
Self-hosted?
On a self-hosted cluster, lok8s provisions workers on your account without kubehz in the loop — see KubeOne on Hetzner.
Requirements
- A connected Hetzner API token with Read & Write permission — worker pools are exactly the delegation step of the trust boundary: kubehz creates servers on your account, so it needs a token that can do that. See The Hetzner token.
- A hosted cluster created with the token already connected. The provisioning mode is fixed at creation: a hosted cluster created without a connected token can not gain worker pools later — connect a token, then recreate the cluster.
What you can do
- Add and remove pools — at cluster creation or any time after. Up to 4 pools per cluster, each with 0–20 nodes.
- Scale a pool's node count up or down.
- Autoscale a pool — set a minimum and maximum instead of a fixed count, and the cluster-autoscaler sizes the pool to demand. While autoscaling is on, the autoscaler owns the node count; manual scaling is rejected. This requires the cluster-autoscaler addon running in the cluster — without it the bounds have no effect.
- Labels and taints per pool, to steer workloads onto the right pool (reserved
kubernetes.io//k8s.io/label prefixes are not allowed). - Change a pool's machine type. Be clear about what this means: every node in the pool is replaced with new servers, rolling, and your workloads reschedule. The dashboard asks you to confirm exactly that before it starts.
What you can't do
- Per-pool region — every pool runs in the cluster's region. If you need another region, that is another cluster.
- Per-pool disk size — the disk follows the Hetzner server type you pick, as on any Hetzner server.
We would rather list these here than have you discover them in an error message.
Next steps
- Hosted control plane — the hosted path overall
- How it works — the trust boundary: what your token is used for
- Pricing — what kubehz charges and why
Doc status
| Aspect | Detail |
|---|---|
| State | available — hosted clusters with a connected Hetzner token |
| Last reviewed | 2026-07-10 |