// the find
syself/cluster-api-provider-hetzner
Cluster API Provider Hetzner :rocket: The best way to manage Kubernetes clusters on Hetzner, fully declarative, Kubernetes-native and with self-healing capabilities
CAPH is a Cluster API infrastructure provider for Hetzner, covering both their cloud VMs (hcloud) and dedicated bare-metal servers via the Robot API. It's for teams who want to run production Kubernetes on Hetzner without a managed service, using the standard CAPI declarative model. Maintained by Syself, a company that also sells a managed version on top of it.
The bare-metal support is genuinely unusual — most CAPI providers only handle VMs, but CAPH drives Hetzner Robot dedis through SSH and installimage, including a state machine for provisioning, wiping, and remediation. The CSR controller is a nice addition: kubelets get signed certs automatically, which means metrics-server works securely out of the box without extra manual steps. The remediation controllers for both hcloud and bare-metal handle unhealthy node recovery declaratively, which is the part that actually hurts in DIY clusters. CI coverage is serious — there are separate e2e workflows for basic, feature, bare-metal, upgrade paths, and periodic runs, not just unit tests.
The v1beta1-to-v1beta2 API migration is in-flight, with conversion webhooks and two parallel api/ trees — if you're adopting this now you're buying into that transition overhead, and the conversion code is non-trivial to follow. Bare-metal provisioning depends on SSH directly into rescue mode, which means your network must allow it and any firewall change during provisioning breaks the state machine in ways that are hard to debug. The managed-image story is weak for self-hosters: you have to build your own node images using kubernetes-sigs/image-builder, or use Syself's managed ones, with no middle ground. Documentation lives partly on syself.com (not in the repo), so if that domain goes away, you lose the quickstart and topic guides.