Gardener-managed Kubernetes on your own Hetzner account.
PaaSbox manages the control plane; your workloads stay in your Hetzner project. It is operated in the open by one person and their agents. If you outgrow it, you can migrate to your own Gardener landscape.
Test cluster €49 a month or €0.15 an hour · Production cluster with a highly available control plane €99 a month
Hetzner raised prices on 15 June 2026. Adopted servers keep the old rate — how.
How it is built
Section titled “How it is built”Gardener
A garden, a seed, and your project
Gardener is the open-source Kubernetes cluster manager from SAP, the fleet technology behind SAP’s own Kubernetes service and STACKIT. PaaSbox runs one garden and one seed on a three-node cluster in Nuremberg. Each customer cluster’s control plane runs as pods on that seed. Its worker nodes, load balancers, volumes and, on a private cluster, its NAT gateway run in the customer’s own Hetzner project.
- Gardener v1.150, Kubernetes 1.36 and 1.35 (as of 2026-09-06)
- The Hetzner extension stack is open source — provider, machine controller, DNS records, backups, node images: how it is built
- Two bills — our flat fee per cluster, Hetzner’s for your nodes, directly, at your rate. PaaSbox never resells compute.
- Backups every five minutes, escrowed in your project — the basis of leaving
What you get
Section titled “What you get”Every feature of a PaaSbox cluster, by component. Everything is in both kinds of cluster unless it carries a badge: production for production clusters only, test only for the test cluster only. Feature names link to the page that shows how to use it; the same table with what comes from Gardener and what PaaSbox adds is on what’s included.
Control plane
| Feature | What you get |
|---|---|
| The control plane itself | |
| Operated control plane | API server, etcd, scheduler and controllers as managed components on the seed; nothing on your nodes or your Hetzner bill |
| Kubernetes versions | 1.36 and 1.35 as of 2026-09-06; you pick at creation, patches roll automatically |
| Provisioning time | about 10–15 minutes from token to kubectl get nodes |
| API endpoint | a DNS name and TLS certificate per cluster, no per-cluster load balancer |
| Highly available control planeproduction | three etcd members and three API servers over three platform nodes; a platform node fails and nothing pauses |
| Zero-downtime authentication changesproduction | switching or updating your identity provider rolls the API servers one at a time |
| API server and security | |
| Secrets encrypted at rest | on by default; the key rotates automatically every 28 days |
| Audit log on the API server | a default audit policy |
| Short-lived credentials only | no static admin token exists anywhere |
| Health conditions | API server, control plane, nodes and system components each report health, shown in the console with the last operation |
Backups and recovery
| Feature | What you get |
|---|---|
| Backups | |
| Continuous etcd backups | delta snapshots every five minutes, a full snapshot daily, to object storage in Germany |
| Retention | every snapshot of the last hour, hourly for a day, daily for a week, weekly for four weeks |
| Escrow in your project | snapshots and cluster keys copied continuously, encrypted to your key, into a bucket you own |
| Recovery | |
| Automatic restore | etcd data loss is recovered from the latest snapshot without a ticket |
| Rebuild after total loss | about 30–40 minutes, drilled before every release |
| Workloads during a control-plane outage | pods keep running and serving; what pauses is change |
| Recovery point up to five minutes | the backup chain is what a restore uses |
| Zero recovery point for a platform-node lossproduction | etcd quorum survives one node; nothing to restore |
Nodes and node pools
| Feature | What you get |
|---|---|
| Node pools | |
| Your own Hetzner project | nodes, load balancers and volumes are created in your project and billed by Hetzner to you |
| Pooled and on-demand pools together | grandfathered baseline plus current-price burst; the autoscaler fills the pool first |
| Machine types | cpx22 to cpx62, ccx13 to ccx43 |
| Worker images | Garden Linux and Ubuntu 24.04, both maintained by the platform |
| Cluster autoscaler | per pool between the minimum and maximum you set; the minimum is one node |
| Labels, taints, kubelet settings, sysctls | per pool, validated before they reach the cluster |
| Placement groups | spread a pool over separate hosts |
| Vertical Pod Autoscaler, HPA, metrics-server | included and on |
| Adopted servers | |
| Adopt grandfathered servers | servers you already own become worker nodes; the price you locked in before 15 June 2026 survives |
| Never deleted, structurally | the component that manages adopted servers has no delete path; Hetzner delete protection is the second guard |
| Rebuilt in place on upgrades | the same server gets a fresh OS and rejoins, one at a time |
| Wipe on enroll and on release | an OS reinstall each time a server joins or leaves your fleet |
| Dedicated (Robot) servers | bare-metal servers as worker nodes, set up with you during onboarding |
| Node lifecycle | |
| Self-healing nodes | an unhealthy on-demand node is replaced after ten minutes; an adopted server is rebuilt in place |
| Rolling updates | node rolls respect PodDisruptionBudgets; surge and unavailability are yours to set |
| Node-critical readiness | new nodes take workload pods only once networking, storage and proxy are ready |
Networking and storage
| Feature | What you get |
|---|---|
| Networking | |
| CNI | Calico, IPv4, with a node range you choose |
| Load balancers | Service type LoadBalancer creates a Hetzner load balancer in your project |
| Managed CoreDNS and node-local DNS | DNS inside the cluster is operated and autoscaled for you |
| No inbound ports required | the control plane reaches nodes over an outbound tunnel |
| Bring your own network | attach workers to an existing Hetzner network; it is never created or deleted by us |
| NAT gateway and private clusters | |
| Private workers | no public address on any node |
| One NAT gateway per cluster | in your project, created and retired by the platform, on your Hetzner bill |
| Stable egress IP | one address your partners can allow-list; node rolls do not change it |
| Egress allow-lists | destinations by network or by name, with an audit mode before enforcing |
| The gateway as the nodes' resolver | what is allowed by name is exactly what the nodes were told |
| Gateway OS lifecycle | Debian 13 or Ubuntu 24.04; daily security updates, reboots only in your window; replaced, never patched in place, on image updates |
| Self-healing gateway | probed every 30 s; powered on, hard-reset at two minutes, replaced at six |
| Gateway logs stay with you | firewall and flow logs go only to a collector in your network; the platform keeps counts |
| Gateway metrics inside your cluster | exported on the private address for any Prometheus you run |
| Gateway alertsproduction | gateway down, firewall not enforcing, connection table above 80 %, denials, stale allow-list |
| Host firewall | |
| Host firewall on every node | kubelet, proxy and SSH closed on public addresses, in public and private clusters alike |
| SSH allow-list | SSH only from networks you list; empty means none |
| Storage | |
| Hetzner volumes | the default StorageClass, expandable, up to 16 per server |
Lifecycle
| Feature | What you get |
|---|---|
| Maintenance | |
| Maintenance window | you pick it; patches, image updates and restarts happen inside it |
| Automatic patch and OS image updates | on by default, each switchable |
| Forced upgrades off expired versions | no cluster is left on end-of-life Kubernetes; the console warns first |
| Run maintenance now, reconcile, retry | one button, one API call |
| Confine rollouts to the window | batch risky changes into your change window |
| Hibernation | |
| Hibernate and wake | on-demand nodes go, adopted servers return to your fleet; about five minutes down, six up |
| Scheduled hibernation | cron with a time zone; maintenance still lands on schedule |
| State and volumes survive | everything you deployed is still defined when the cluster wakes |
| Credentials | |
| Credential rotation | CA, service-account key, etcd key and SSH key rotate on schedule or on request |
| Expiry warnings | a certificate nearing its date or a version about to expire is flagged long before it matters |
Access and identity
| Feature | What you get |
|---|---|
| Access | |
| Cluster-admin kubeconfig | minted on demand, valid 1, 4 or 8 hours, never stored, issuance audited |
| Bring your own identity provider | your OIDC issuer and groups in the cluster API; your RBAC |
| Teams, roles, invitations, scoped API keys | one team owns clusters, connections, fleet and billing |
| Token custody | your Hetzner token is validated once, stored encrypted, never shown again, rotatable |
| Activity log | every change to a cluster, who made it and when |
Console and API
| Feature | What you get |
|---|---|
| Console and API | |
| Cluster composer | invalid combinations are shown greyed with the reason, not rejected after submit |
| REST API | declarative, with an OpenAPI schema and a TypeScript client |
| Gardener settings in Gardener's schema | an allow-listed set of settings per cluster and per pool, validated server-side |
| Export as Gardener YAML | the exact cluster definition, redacted of secrets, at any time |
| Status passthrough | Gardener's last operation, errors and warnings, verbatim, with error codes turned into what to do |
| Cost and savings view | the PaaSbox fee next to your Hetzner spend and what your adopted servers save |
Monitoring
| Feature | What you get |
|---|---|
| Monitoring | |
| Health in the console | conditions, last operation and hibernation state for every cluster, even when the cluster itself is down |
| Monitoring stack for the clusterproduction | Prometheus and dashboards the platform uses to operate your cluster |
| Federation into your own Prometheusproduction | control-plane metrics pulled into your Prometheus, Grafana or SaaS monitoring |
| Email alertsproduction | to the addresses you enter for the cluster |
Commercial, support and leaving
| Feature | What you get |
|---|---|
| Pricing | |
| Flat fee per cluster | no per-node fees, no seats, no user limits |
| Included footprint | up to 10 worker nodes, about 500 pods, about 50 attached volumes per cluster |
| Spend caps | €200 a month on a new account, raised with billing history; at the cap clusters hibernate, never delete |
| Annual, pay 10 get 12 | €490 a year for a test cluster, €990 for a production cluster |
| Hourly pay-as-you-gotest only | €0.15 per awake hour, a four-hour minimum per active period, €0 while hibernated, never more than €49 a month |
| Leaving | |
| Exit kit | open source; bootstraps a garden and seed in your project and restores your control plane from the escrow, nodes reconnecting without a restart |
| Your own API domain | the cluster's API name under a domain you own, so a take-over needs nothing from us |
| Wind-down promise | six months' notice, migration help at no charge, prices frozen, everything public |
| Support and trust | |
| Data location | control planes and backups in Hetzner data centres in Germany; Hetzner is the only sub-processor |
| Support boundary | warranty is free, assistance is billable; same business day for unreachable or losing data |
| Operated in the open | an external status page, monthly numbers, the agent charter, published drills |
Control plane
API server, etcd, scheduler and controllers run on the seed, operated for you, with Kubernetes 1.36 and 1.35. Production clusters get three etcd members and three API servers. More →
Backups and recovery
etcd snapshots every five minutes and daily, escrowed into your own project. Restore is automatic, a full rebuild is drilled, and your pods keep serving while a control plane is down. More →
Nodes and node pools
On-demand pools and your adopted grandfathered servers in one cluster, in your own Hetzner project. Adopted servers are rebuilt in place and never deleted. More →
Networking and storage
Calico, Hetzner load balancers and volumes. Private clusters get one NAT gateway in your project with a stable egress IP, allow-lists, and a host firewall on every node. More →
Lifecycle
A maintenance window you choose, automatic patch and image updates, hibernation by hand or on a schedule, and credentials rotated for you. More →
Access and identity
A cluster-admin kubeconfig minted on demand, your own identity provider, teams with scoped API keys, and a Hetzner token stored encrypted and never shown again. More →
Console and API
A composer that explains what it refuses, a declarative REST API, Gardener settings in Gardener's own schema, and your cluster as exportable YAML. More →
Monitoring
Health for every cluster in the console, even when the cluster is down. Production clusters carry a monitoring stack you can federate, with alerts by email. More →
Commercial, support and leaving
A flat fee per cluster with an included footprint and spend caps, a support boundary that says what is free, and an exit kit so you can leave without asking. More →
Operated in the open
Section titled “Operated in the open”I run PaaSbox, with agents that build, validate, patch, drill and investigate. I decide, I take the pages in business hours, and I am the only one who touches the live landscape. The numbers are public and measured by someone else:
- Availability of a canary production cluster, the console and a daily cluster creation, probed by an external monitor from three regions, on the status page.
- A monthly report: availability per cluster, incidents and time to recover, what healed itself and what needed a human, platform cost against revenue.
- The agent charter: what my agents may do, what only I do, and the drills every change runs before it reaches a customer.
Leaving
Section titled “Leaving”You can leave without asking. Your nodes and volumes are in your project. Adopted servers are never deleted. Your cluster’s etcd snapshots and keys are escrowed, encrypted to your key, in a bucket you own. The exit kit is open source: it bootstraps a garden and seed in your project, restores your control plane from the escrow, and your nodes reconnect while your workloads keep serving. If PaaSbox ever winds down, you get six months’ notice and migration help at no charge.
Pricing
Section titled “Pricing”| Test cluster | Production cluster | |
|---|---|---|
| Control plane | one etcd, one API server | three etcd members, three API servers |
| Monitoring stack | none | included |
| Monthly | €49 / $65 | €99 / $129 |
| Annual, pay 10 get 12 | €490 / $650 | €990 / $1,290 |
| Hourly | €0.15 per awake hour, capped at €49 | — |
Everything else is the same. Pricing in full →
Run Kubernetes on Hetzner.Keep your servers, your prices, and your exit.
Stay in the loop
Follow new releases and guides via the blog RSS feed, on X or GitHub. An email newsletter is coming with launch.