Skip to content
Mengi Cloud Mengi Cloud Docs

Hetzner BYOC Setup

This guide walks you through connecting your own Hetzner Cloud account to Mengi Cloud as a BYOC (“Bring Your Own Cloud”) credential. When you use BYOC, Mengi provisions and manages a Kubernetes cluster inside your own Hetzner Cloud project, billed directly by Hetzner. Mengi only charges a management fee instead of the full infrastructure cost.

You will:

  1. Create a dedicated project in the Hetzner Cloud Console.
  2. Generate a Read & Write API token for that project.
  3. Store the credential in Mengi Cloud and create a cluster.

The whole process is done in the Hetzner Cloud Console — no CLI required.

What Mengi creates in your project

When you provision a BYOC cluster, Mengi creates the following in your chosen project:

ResourceHetzner product
A private network and subnetNetworks
Control-plane and worker nodesServers
A NAT gateway for outbound trafficServers
A load balancer for the clusterLoad Balancers
An SSH key for emergency accessSSH Keys

The servers, load balancer and volumes are created and billed in your project. You can delete everything at any time from the Mengi dashboard (which cleanly tears down the infrastructure) or from the Hetzner Cloud Console.

Unlike the managed-Kubernetes providers, Hetzner has no managed control plane — the Kubernetes control plane runs on servers in your project, so there is no separate control-plane fee; you pay only for the servers.

Required permissions

Hetzner Cloud API tokens are scoped to a single project and have one of two permission levels. Mengi needs:

Token permissionWhy it’s needed
Read & WriteCreate and manage networks, servers, the load balancer and SSH keys

Least privilege: A Hetzner token can only touch the one project it was created in. Dedicate a project to Mengi so the token can never affect resources in your other projects.

Prerequisites

  • A Hetzner Cloud account with a valid payment method (servers and load balancers incur Hetzner charges in your project).

Part 1 — Hetzner Cloud Console setup

1. Create a dedicated project

A separate project keeps Mengi’s resources isolated and makes the token easy to scope and revoke.

  1. Sign in to the Hetzner Cloud Console.
  2. From the project list, click + New project.
  3. Name it e.g. mengi-byoc and open it.

2. Generate an API token

  1. Inside the mengi-byoc project, open Security → API tokens → Generate API token.
  2. Add a description like “Mengi Cloud BYOC”.
  3. Set the permission to Read & Write.
  4. Click Generate API token.
  5. Copy the token now — it is shown only once (a 64-character string).

You now have the single value Mengi needs:

ValueWhere it came from
API TokenThe project’s Read & Write API token (shown once)

No CLI for this step. Hetzner’s CLI (hcloud) authenticates with an API token but cannot create projects or mint tokens — those are Console-only actions. So the credential itself must be created in the Console as above; hcloud is only useful afterwards for read-only inspection.

Part 2 — Store the credential in Mengi Cloud

  1. Sign in to the Mengi Cloud dashboard and open Cloud Credentials from the left-hand menu.
  2. Click Add Credential.
  3. Fill in the form:
    • Credential Name — any label, e.g. hetzner-byoc.
    • Cloud Provider — select Hetzner Cloud.
    • API Token — paste your Read & Write token.
  4. Click Add Credential.

The credential is stored encrypted and starts in Pending Validation. Mengi validates it against the Hetzner Cloud API; once the token checks out the status turns to Ready. If it shows Invalid, re-check that you copied the full token and that it has Read & Write permission.

Part 3 — Create a BYOC cluster

  1. Start a new cluster/deployment in the Mengi dashboard.
  2. Choose Hetzner as the provider and select a location: fsn1 (Falkenstein), nbg1 (Nuremberg), hel1 (Helsinki), ash (Ashburn, USA), hil (Hillsboro, USA) or sin (Singapore).
  3. Enable Use my own cloud account (BYOC) and select the hetzner-byoc credential.
  4. Pick a cluster type — Dedicated (1 node) or Dedicated HA (3 nodes, with SLA) — and create the cluster.

Mengi provisions the private network, NAT gateway, servers and load balancer in your project. The cluster moves through pending → provisioning → running. Deleting it from Mengi tears the infrastructure back down in your project.

BYOC is not available on the Development type — those are virtual clusters on Mengi’s own shared host infrastructure. Use Dedicated or Dedicated HA.

Rotating the API token

  1. In the Hetzner Cloud Console, generate a new Read & Write API token in the mengi-byoc project (Part 1, Step 2).
  2. In Mengi, edit the hetzner-byoc credential, paste the new token, then re-validate.
  3. Once the new token is Ready, delete the old token in the console.

Revoking access

To cut Mengi off entirely, delete the API token in the Hetzner Cloud Console. Delete any running BYOC clusters from the Mengi dashboard first so the infrastructure is cleaned up — once the token is gone, Mengi can no longer tear those resources down for you.

Security notes

  • The API token is shown only once at creation — store it securely and never commit it to version control.
  • Keep Mengi in a dedicated project so the token can never touch your other Hetzner projects.
  • Mengi stores BYOC credentials encrypted, not in plaintext.
  • Rotate the token periodically.