How it is built on Gardener
PaaSbox is a thin layer over Gardener, the open-source Kubernetes cluster manager from SAP. Gardener is the fleet technology behind SAP’s own Kubernetes service, STACKIT and several other public offerings; it has managed tens of thousands of clusters for years. Every PaaSbox cluster is a real Gardener cluster, and you can export its definition as YAML at any time.
Three places
Section titled “Three places”| Where | What runs there | Whose account |
|---|---|---|
| The garden | Gardener’s own API and controllers — the inventory of every cluster | PaaSbox |
| The seed | your cluster’s control plane as pods: API server, etcd, scheduler, controllers, and on a production cluster its monitoring stack | PaaSbox |
| Your project | worker nodes, load balancers, volumes, and on a private cluster the NAT gateway | yours, billed by Hetzner to you |
The garden and the seed share one three-node cluster in Nuremberg, on servers PaaSbox owns at price-locked rates. The garden itself is highly available. Every customer control plane on the seed gets its own etcd on local NVMe, backed up every five minutes to object storage in Germany and escrowed into a bucket in your project. The control plane reaches your nodes over a tunnel the nodes open outbound, so no inbound port is needed on any worker.
Versions
Section titled “Versions”| Component | Version (as of 2026-09-06) |
|---|---|
| Gardener | v1.150 |
| Kubernetes offered to clusters | 1.36 and 1.35 |
| Worker images | Garden Linux 2150, Ubuntu 24.04 |
| CNI | Calico |
Two minor versions are offered at any time; a version that reaches end of life is force-upgraded in your maintenance window after a warning in the console — see maintenance & upgrades.
The Hetzner stack, and who may use it
Section titled “The Hetzner stack, and who may use it”Gardener needs a provider integration per cloud. PaaSbox maintains the Hetzner one. The components are open source so that your cluster never depends on code only we can run; that is what makes leaving a real option rather than a promise.
| Component | What it does | Licence |
|---|---|---|
| provider-hcloud | infrastructure, control plane and worker reconciliation on Hetzner Cloud; private egress and the NAT gateway | Apache-2.0 |
| machine-controller-manager provider | creates, replaces and, for adopted servers, rebuilds in place | Apache-2.0 |
| dnsrecord-hcloud | API endpoint records in Hetzner DNS | Apache-2.0 |
| backupbucket-hcloud | etcd backups to Hetzner Object Storage | Apache-2.0 |
| cert-manager webhook for Hetzner DNS | certificates for the platform’s own endpoints | Apache-2.0 |
| Node images | the Garden Linux build and the Ubuntu snapshot for Hetzner | Apache-2.0 |
| Garden and seed bootstrap | one script that stands up a garden and seed in any Hetzner project; the exit kit uses it | Apache-2.0 |
| Pool stack | adopting grandfathered servers as nodes that are never deleted | source available; included in the exit kit so adopted servers keep working after you leave |
The repositories are on GitHub. Container images are published on a public registry under the same version as the platform runs.
What PaaSbox adds
Section titled “What PaaSbox adds”- The console and the API, the only write path to Gardener. They enforce the billing gate, the never-delete invariant for adopted servers and the fair-use footprint; see what you bring & what we run.
- The pool: adopting servers you already own as worker nodes that are rebuilt in place and never deleted — adopt your servers.
- Private egress: one NAT gateway per cluster in your project, with allow-lists, a host firewall on every node and a self-healing ladder — private clusters.
- Escrow and the exit kit — leaving.
- Operations: the maintenance, drills, upgrades and recovery that keep the platform current, run by one person and their agents — operated in the open.
What is deliberately not exposed
Section titled “What is deliberately not exposed”Gardener can do more than PaaSbox offers. Zone-spread control planes, multi-zone node pools, dual-stack networking, ARM nodes, root-volume sizing, custom audit policies, the deprecated add-ons and a web terminal are not exposed; the exact list is at the end of what’s included. Everything that is exposed is exposed in Gardener’s own schema, so nothing you configure is PaaSbox-specific — Gardener settings & export.
Why Gardener, for a one-person company
Section titled “Why Gardener, for a one-person company”Gardener reconciles a cluster’s whole definition, continuously, from one object. That makes every change a thing that can be drilled: a new provider version, a Kubernetes minor, a gateway image is applied to a throwaway landscape, the drill catalogue runs against it, and only a green run reaches a customer. It is the property that lets agents do the build and validation work safely while a human stays in the driver’s seat — see operated in the open.