Self-host K3s on Hetzner Cloud with Terraform: Under $25/month Production Kubernetes

Managed Kubernetes costs 5-10x what raw compute costs. You’re paying for someone else to run kubectl for you.

After pricing out a basic cluster on AWS and GKE—a few private services, a couple public endpoints, nothing exotic—the estimates landed north of $200/month before traffic costs. That moved managed Kubernetes out of my budget immediately. So I built the stack myself on Hetzner Cloud. Here’s the exact setup.

This guide gets you a production-ready K8s cluster on Hetzner Cloud for under $25/month. You’ll own every layer—compute, networking, storage, ingress. Spin up a private music server, self-hosted cloud storage, a side project API—whatever you want, whenever you want, no permission required. No vendor lock-in. No surprise bills.

Difficult Easy – Time to deploy ~20 minutes

Init

What You Need

Shell

# Install everything via Homebrew (MacOS/Linux/WSL)
brew install terraform kubectl k9s hcloud packer coreutils

Hetzner Cloud account — Login/Sign-up here
Terminal fluency — You live here now
20 minutes — That’s it

Following along?

The ZipOps newsletter publishes the next articles in this series: TLS automation, observability stack, and deploying real applications. No spam, just infrastructure guides for developers who'd rather own their stack.

Get Your API Key

Hetzner needs to trust your Terraform commands. Create a project in Hetzner Cloud Console, go to Security > API Tokens, generate a token with Read & Write permissions.

hcloud-api-key-read-write-draw

This key is root access to your cloud. Treat it like a password.

Build Base Images

Hetzner spins up nodes from snapshots. This script creates them—a temporary VM builds the OS image, then self-destructs. Takes ~6 minutes. Costs pennies.

Bash cli

Shell

tmp_script=$(mktemp) && \
curl -sSL -o "${tmp_script}" https://raw.githubusercontent.com/kube-hetzner/terraform-hcloud-kube-hetzner/master/scripts/create.sh && \
chmod +x "${tmp_script}" && \
"${tmp_script}" && \
rm "${tmp_script}"

Fish cli

Shell

set tmp_script (mktemp) && \
curl -sSL -o "$tmp_script" https://raw.githubusercontent.com/kube-hetzner/terraform-hcloud-kube-hetzner/master/scripts/create.sh; 
chmod +x "$tmp_script" && \
bash "$tmp_script" && \
rm "$tmp_script"

Expected output

Shell

==> Builds finished. The artifacts of successful builds are:
--> hcloud.microos-x86-snapshot: 'OpenSUSE MicroOS x86 by Kube-Hetzner' (ID: *********)
--> hcloud.microos-arm-snapshot: 'OpenSUSE MicroOS ARM by Kube-Hetzner' (ID: *********)

⚠️ If VM tier/location miss

Sometimes selected VM tier are not available anymore, or it's not available in predefined cluster location. After the process completed, double check Server --> Snapshot and make sure you have exactly 2 images:

OpenSUSE MicroOS x86 by Kube-Hetzner
OpenSUSE MicroOS ARM by Kube-Hetzner

hetzner-snapshots

If something is missing, update kube.tf as well as hcloud-microos-snapshots.pkr.hcl updating location and/or server_type with actually valid values and run the same script again.

If process completed successfully and you have both snapshots in your project, safe delete temporary files

Shell

rm hcloud-microos-snapshots.pkr.hcl kube.tf

Generate SSH Keys

You need password-less SSH access to your nodes. This is your backdoor when things break. Do not lose this key

Shell

# Press Enter twice (no passphrase)
mkdir -p cred/terra && \
ssh-keygen -t ed25519 -f cred/terra/hetzner-key -C "your-email@example.com"

Guard This Key

Lose this key and you lose SSH access to your nodes. I've seen teams locked out of production because someone ran rm -rf in the wrong directory. Store it in a password manager. Back it up encrypted. This is your break-glass access.

Your file tree now looks like this

Shell

project-folder/
└── cred/
    └── terra/
        ├── hetzner-key        # Private. Never share. Don't lose.
        └── hetzner-key.pub    # Public. Goes to Hetzner.

Apply

Define Your Cluster

This is where you decide: how many nodes, what size, which datacenter. The kube.tf file IS your infrastructure. Version control it.

📐 Quick Architecture Context

Control Plane Nodes — Run the API server, scheduler, and etcd (cluster state database). Lose etcd without backups = lose your cluster. Run 3 for production HA, 1 is fine for dev & budget projects.

Worker Nodes — Run your application pods. Scale these horizontally. One dying shouldn't cripple you.

Cilium — Replaces kube-proxy with eBPF. Faster networking, built-in ingress, egress control. This config is production-ready.

Longhorn — Distributed storage. Pods request volumes, Longhorn replicates across nodes. Node dies, data survives in volumes.

k8s-cluster-nodes

Create kube.tf in your project root

HCL

# === INPUT VARIABLES ===
locals {
  cluster_ipv4_cidr = "10.42.0.0/16"
}

variable "hcloud_token" { 
  description = "Hetzner Cloud API token"
  sensitive = true
}
variable "cluster_name" { default = "prod-cluster" }
variable "server_location" { default = "fsn1" }    # Falkenstein, Germany
variable "control_node_type" { default = "cx23" }  # 2 vCPU, 4GB RAM, ~$5/mo
variable "worker_node_type" { default = "cx33" }   # 4 vCPU, 8GB RAM, ~$15/mo
variable "control_node_count" { default = 1 }
variable "worker_node_count" { default = 1 }

# === OUTPUTS ===
output "kubeconfig" {
  value     = module.kube-hetzner.kubeconfig
  sensitive = true
}

data "hcloud_floating_ips" "all" {
  depends_on = [module.kube-hetzner]
}

output "floating_ip" {
  description = "Your public IP—point DNS here"
  value       = data.hcloud_floating_ips.all.floating_ips[0].ip_address
}

# === PROVIDER ===
provider "hcloud" {
  token = var.hcloud_token
}

terraform {
  required_version = ">= 1.5.0"
  required_providers {
    hcloud = {
      source  = "hetznercloud/hcloud"
      version = ">= 1.51.0"
    }
  }
}

# === CLUSTER ===
module "kube-hetzner" {
  providers    = { hcloud = hcloud }
  hcloud_token = var.hcloud_token
  source       = "kube-hetzner/kube-hetzner/hcloud"

  ssh_public_key  = file("./cred/terra/hetzner-key.pub")
  ssh_private_key = file("./cred/terra/hetzner-key")

  # Control plane: the brain
  control_plane_nodepools = [
    {
      name        = "control-plane",
      server_type = var.control_node_type,
      location    = var.server_location,
      labels      = [],
      taints      = [],
      count       = var.control_node_count,
    }
  ]

  # Workers: the muscle
  agent_nodepools = [
    {
      name                 = "worker",
      server_type          = var.worker_node_type,
      location             = var.server_location,
      labels               = [],
      taints               = [],
      count                = var.worker_node_count,
      floating_ip          = true,
      longhorn_volume_size = 100
    }
  ]

  # Storage: Longhorn for persistent volumes
  enable_longhorn = true
  longhorn_fstype = "ext4"

  # Security: encrypted etcd
  k3s_exec_server_args = "--secrets-encryption"

  # No Hetzner LB—we use Cilium
  load_balancer_type     = ""
  load_balancer_location = ""

  # Cluster settings
  enable_klipper_metal_lb           = "false"
  allow_scheduling_on_control_plane = false
  automatically_upgrade_os          = false
  automatically_upgrade_k3s         = false
  cluster_name                      = var.cluster_name
  use_cluster_name_in_node_name     = false

  # Networking: Cilium with eBPF
  cni_plugin                    = "cilium"
  disable_kube_proxy            = true
  disable_network_policy        = true
  cilium_hubble_enabled         = true
  enable_cert_manager           = true
  cilium_routing_mode           = "native"
  cluster_ipv4_cidr             = local.cluster_ipv4_cidr
  cilium_egress_gateway_enabled = true
  ingress_controller            = "none"

  cilium_values = <<EOT
MTU: 1450
k8sServiceHost: 127.0.0.1
k8sServicePort: "6444"
kubeProxyReplacement: true
routingMode: native
ipv4NativeRoutingCIDR: "10.0.0.0/8"
auto-direct-node-routes: true
endpointRoutes:
  enabled: true
ipam:
  mode: kubernetes
  operator:
    clusterPoolIPv4PodCIDRList:
    - 10.42.0.0/16
ingressController:
  enabled: true
  default: true
  loadbalancerMode: shared
  externalTrafficPolicy: Local
bpf:
  masquerade: true
  lbExternalClusterIP: true
EOT

  # Firewall: explicit allow only
   # Hetzner firewall configuration
  extra_firewall_rules = [

    # SSH
    {
      description     = "Allow Outbound TCP Ssh Communication"
      destination_ips = [
        "0.0.0.0/0",
        "::/0",
      ]
      source_ips      = []
      direction       = "out"
      port            = "22"
      protocol        = "tcp"
    },

    # Nodeport range
    {
      description     = "Allow Inbound NodePort Range"
      source_ips = [
        "0.0.0.0/0",
        "::/0",
      ]
      destination_ips = []
      direction       = "in"
      port            = "30000-32767"
      protocol        = "tcp"
    },

    # HTTP/HTTPS
    {
      description     = "Allow Inbound HTTP Communication"
      source_ips = [
        "0.0.0.0/0",
        "::/0",
      ]
      destination_ips = []
      direction       = "in"
      port            = "80"
      protocol        = "tcp"
    },
    {
      description     = "Allow Outbound HTTP Communication"
      destination_ips = [
        "0.0.0.0/0",
        "::/0",
      ]
      source_ips      = []
      direction       = "out"
      port            = "80"
      protocol        = "tcp"
    },
    {
      description     = "Allow Inbound HTTPS Communication"
      source_ips = [
        "0.0.0.0/0",
        "::/0",
      ]
      destination_ips = []
      direction       = "in"
      port            = "443"
      protocol        = "tcp"
    },
    {
      description     = "Allow Outbound HTTPS Communication"
      destination_ips = [
        "0.0.0.0/0",
        "::/0",
      ]
      source_ips      = []
      direction       = "out"
      port            = "443"
      protocol        = "tcp"
    },
    {
      description     = "Allow Inbound HTTPS Communication for API"
      source_ips = [
        "0.0.0.0/0",
        "::/0",
      ]
      destination_ips = []
      direction       = "in"
      port            = "9090"
      protocol        = "tcp"
    },
    {
      description     = "Allow Outbound HTTPS Communication for API"
      destination_ips = [
        "0.0.0.0/0",
        "::/0",
      ]
      source_ips      = []
      direction       = "out"
      port            = "9090"
      protocol        = "tcp"
    },

    # DNS
    {
      description     = "Allow Outbound DNS Communication"
      destination_ips = [
        "0.0.0.0/0",
        "::/0",
      ]
      source_ips      = []
      direction       = "out"
      port            = "53"
      protocol        = "udp"
    },
    {
      description     = "Allow Outbound DNS over TCP Communication"
      destination_ips = [
        "0.0.0.0/0",
        "::/0",
      ]
      source_ips      = []
      direction       = "out"
      port            = "53"
      protocol        = "tcp"
    },

    # In claster TCP/UDP
    {
      description = "Allow all TCP between cluster nodes"
      destination_ips = []
      source_ips  = ["10.42.0.0/16"]
      direction   = "in"
      port        = "1-65535"
      protocol    = "tcp"
    },
    {
      description = "Allow all UDP between cluster nodes"
      destination_ips = []
      source_ips  = ["10.42.0.0/16"]
      direction   = "in"
      port        = "1-65535"
      protocol    = "udp"
    },

    # Ping rules
    # keep during first installation
    {
      description = "Allow all ICMP"
      destination_ips = []
      source_ips  = ["0.0.0.0/0"]
      direction   = "in"
      port        = ""
      protocol    = "icmp"
    },
    {
      description = "Allow all ICMP"
      destination_ips = ["0.0.0.0/0"]
      source_ips  = []
      direction   = "out"
      port        = ""
      protocol    = "icmp"
    },
  ]
}

Why These Specific Cilium Settings?

This config isn't arbitrary. kubeProxyReplacement: true eliminates iptables overhead—measurable latency improvement under load. routingMode: native with ipv4NativeRoutingCIDR avoids VXLAN encapsulation between nodes. The ingressController block replaces Traefik (k3s default) with Cilium's eBPF-based ingress. I burned a month debugging packet drops before landing on this combination.

Server tier and location

Same rule apply as before: sometimes tier are not available anymore or not available in a given location. Eventually update row 8 to 10 for cluster location, control panel tier and worker node tier, then apply again.

K8s will handle any broken installation on its own.

Set Your API Token

Never hardcode secrets. Export the token, so Terraform can read it without storing it in files.

Shell

# bash
export TF_VAR_hcloud_token="your-api-token-here"

# fish
set -xg TF_VAR_hcloud_token "your-api-token-here"

Deploy

One command. Terraform reads your config, diffs against reality, and creates what’s missing.

Shell

terraform init && terraform apply

Review the plan. Type yes to confirm. Watch your cluster materialize.

Shell

Plan: 36 to add, 0 to change, 0 to destroy.
Do you want to perform these actions?
  Enter a value: yes

hetzner-console-node-spin-up-process

~8 minutes later

Shell

Apply complete! Resources: 36 added, 0 changed, 0 destroyed.

Outputs:
kubeconfig = <sensitive>
floating_ip = "X.X.X.X"

#Self-host K3s on Hetzner Cloud with Terraform: Under $25/month Production Kubernetes

#Init

#What You Need

#Get Your API Key

#Build Base Images

#Bash cli

#Fish cli

#Generate SSH Keys

#Apply

#Define Your Cluster

#Set Your API Token

#Deploy

Self-host K3s on Hetzner Cloud with Terraform: Under $25/month Production Kubernetes

Init

What You Need

Get Your API Key

Build Base Images

Bash cli

Fish cli

Generate SSH Keys

Apply

Define Your Cluster

Set Your API Token

Deploy