This is the complete feature list, in one place, so the other pages can point here instead of
repeating it. Each feature links to the page that shows how to use it. Every row says where the feature comes from — Gardener, the open-source cluster
manager PaaSbox is built on, or PaaSbox, the layer on top — and which kind of cluster gets it.
Facts are as of 2026-09-06.
Two kinds of cluster exist: a test cluster (€49/month, one etcd and one API server) and a
production cluster (€99/month, a highly available control plane). Everything below is included
in both unless the tier column says otherwise. Pricing has the price side.
| Feature | What you get | From | Tier |
|---|
| Operated control plane | API server, etcd, scheduler and controllers run as managed components; nothing on your nodes or your Hetzner bill | Gardener | both |
| Highly available control plane | three etcd members and three API servers over three platform nodes; a platform node can fail without a pause | Gardener | production |
| Kubernetes versions | two current minor versions, 1.36 and 1.35; you pick at creation; patches roll automatically | Gardener | both |
| Provisioning time | about 10–15 minutes from token to kubectl get nodes | PaaSbox | both |
| API endpoint | a DNS name and TLS certificate per cluster, no per-cluster load balancer | Gardener | both |
| Secrets encrypted at rest | on by default; the key rotates automatically every 28 days | Gardener | both |
| Audit log on the API server | a default audit policy | Gardener | both |
| Short-lived credentials only | no static admin token exists anywhere | Gardener | both |
| Health conditions | API server, control plane, nodes and system components each report health; the console shows them with the last operation and its progress | Gardener + PaaSbox | both |
| Feature | What you get | From | Tier |
|---|
| Continuous etcd backups | delta snapshots every five minutes, a full snapshot daily, to object storage in Germany | Gardener | both |
| Retention | every snapshot of the last hour, hourly for a day, daily for a week, weekly for four weeks | Gardener | both |
| Automatic restore | etcd data loss is recovered from the latest snapshot without a ticket | Gardener | both |
| Recovery point | up to five minutes on a test cluster; zero for a single platform-node failure on a production cluster | Gardener | see text |
| Rebuild after total loss | about 30–40 minutes, drilled before every release | PaaSbox | both |
| Workloads during a control-plane outage | pods keep running and serving; what pauses is change | Gardener | both |
| Feature | What you get | From | Tier |
|---|
| Your own Hetzner project | nodes, load balancers and volumes are created in your project and billed by Hetzner to you | PaaSbox | both |
| Adopt grandfathered servers | servers you already own become worker nodes, rebuilt in place and never deleted, so their pre-2026 price survives | PaaSbox | both |
| Never-delete, structurally | the component that manages adopted servers has no delete path; Hetzner delete protection is the second guard | PaaSbox | both |
| Pooled and on-demand pools together | grandfathered baseline plus current-price burst in one cluster; the autoscaler fills the pool first | PaaSbox | both |
| Machine types | cpx22 to cpx62, ccx13 to ccx43; dedicated (Robot) servers on request | PaaSbox | both |
| Worker images | Garden Linux and Ubuntu 24.04, both maintained by the platform | Gardener | both |
| Cluster autoscaler | per pool between the minimum and maximum you set; the minimum is one node | Gardener | both |
| Self-healing nodes | an unhealthy on-demand node is replaced after a health timeout; an adopted server is rebuilt in place | Gardener + PaaSbox | both |
| Rolling updates | node rolls respect PodDisruptionBudgets; surge and unavailability are yours to set | Gardener | both |
| Labels, taints, kubelet settings, sysctls | per pool, validated before they reach the cluster | Gardener | both |
| Placement groups | spread a pool over separate hosts | PaaSbox | both |
| Node-critical readiness | new nodes take workload pods only once networking, storage and proxy are ready | Gardener | both |
| Vertical Pod Autoscaler, HPA, metrics-server | included and on | Gardener | both |
| Feature | What you get | From | Tier |
|---|
| CNI | Calico, IPv4, with a node range you choose | Gardener | both |
| Load balancers | Service type: LoadBalancer creates a Hetzner load balancer in your project | PaaSbox | both |
| Volumes | Hetzner volumes as the default StorageClass, expandable, up to 16 per server | PaaSbox | both |
| Managed CoreDNS and node-local DNS | DNS inside the cluster is operated and autoscaled for you | Gardener | both |
| Private workers | pools without public addresses | PaaSbox | both |
| Private clusters with a NAT gateway | one gateway per cluster in your project: a stable egress IP, allow-lists by CIDR and name, an audit mode, logs to your own collector, self-healing | PaaSbox | both |
| Host firewall on every node | kubelet, proxy and SSH closed on public addresses; SSH only from networks you allow | PaaSbox | both |
| Bring your own network | attach workers to an existing Hetzner network; it is never created or deleted by us | PaaSbox | both |
| No inbound ports required | the control plane reaches nodes over an outbound tunnel | Gardener | both |
| Feature | What you get | From | Tier |
|---|
| Cluster-admin kubeconfig | minted on demand, valid 1, 4 or 8 hours, never stored, issuance audited | Gardener + PaaSbox | both |
| Bring your own identity provider | your OIDC issuer and groups in the cluster API; your RBAC | Gardener + PaaSbox | both |
| Teams, roles, invitations, scoped API keys | one team owns clusters, connections, fleet and billing | PaaSbox | both |
| Token custody | your Hetzner token is validated once, stored encrypted, never shown again, rotatable | PaaSbox | both |
| Activity log | every change to a cluster, who made it and when | PaaSbox | both |
| Escrow | your cluster’s etcd snapshots and keys copied continuously, encrypted to your key, into a bucket in your project | PaaSbox | both |
| Exit kit | open source; bootstraps a garden and seed in your project and restores your control plane from the escrow, nodes reconnecting without a restart | PaaSbox | both |
| Wind-down promise | six months’ notice, migration help at no charge, prices frozen, everything public | PaaSbox | both |
| Feature | What you get | From | Tier |
|---|
| Cluster composer | invalid combinations are shown greyed with the reason, not rejected after submit | PaaSbox | both |
| REST API | declarative, with an OpenAPI schema and a TypeScript client | PaaSbox | both |
| Gardener settings in Gardener’s schema | an allow-listed set of settings per cluster and per pool, validated server-side | PaaSbox | both |
| Export as Gardener YAML | the exact cluster definition, redacted of secrets, at any time | PaaSbox | both |
| Status passthrough | Gardener’s last operation, errors and warnings, verbatim, with error codes turned into what to do | PaaSbox | both |
| Cost and savings view | the PaaSbox fee next to your Hetzner spend and what your adopted servers save | PaaSbox | both |
| Feature | What you get | From | Tier |
|---|
| Monitoring stack for the cluster | metrics and dashboards the platform uses to operate your cluster, which your own monitoring can federate | Gardener | production |
| NAT gateway metrics and alerts | the gateway’s metrics scraped inside your cluster, with alerts for gateway down, denials and conntrack pressure | PaaSbox | production |
| Health in the console | conditions, last operation, hibernation state, for every cluster, even when the cluster itself is down | PaaSbox | both |
More on what the test cluster deliberately does not have is on monitoring & alerts.
| Feature | What you get | From | Tier |
|---|
| Flat fee per cluster | no per-node fees, no seats, no user limits | PaaSbox | both |
| Hourly pay-as-you-go | €0.15 per awake hour, a 4-hour minimum per active period, €0 while hibernated, never more than the monthly price | PaaSbox | test |
| Included footprint | up to 10 worker nodes, about 500 pods, about 50 attached volumes per cluster | PaaSbox | both |
| Spend caps | €200 a month on a new account, raised with billing history; at the cap clusters hibernate, never delete | PaaSbox | both |
| Data location | control planes and backups in Hetzner data centres in Germany; Hetzner is the only sub-processor | PaaSbox | both |
| Support boundary | warranty is free, assistance is billable; the exact line is on pricing | PaaSbox | both |
The platform does not expose everything Gardener can do. Not offered: zone-spread control planes
(one zone per cluster), multi-zone node pools, dual-stack networking, ARM nodes, root-volume sizing,
the deprecated Gardener add-ons, and a web terminal. The smallest node pool is one node. If one of
these decides your choice, tell us.
