v1.0.0

First stable release

A complete Karpenter CloudProvider for Hetzner Cloud: full drift detection, observability, supply-chain attestations, and adoption docs. Karpenter launches the cheapest Hetzner server that fits pending pods and consolidates idle nodes.

Added

• Image label selector: HCloudNodeClass.spec.imageSelector.selector filters Hetzner images by arbitrary labels, so you can pin the exact image (version plus baked extensions, e.g. a gVisor-Talos snapshot) instead of fuzzy description matching (#23).
• Wrong-arch guard: provisioning is rejected when the resolved image architecture does not match the architecture the NodeClaim requires (#23).
• Placement group creation and assignment: placementGroupStrategy: spread now actually creates and assigns a cluster-scoped Hetzner placement group (previously declared but a no-op) (#24).
• Location drift detection: servers whose Hetzner location is no longer in the NodeClass locations are flagged as drifted (#24).
• Label drift detection: servers whose labels no longer cover the NodeClass labels are flagged as drifted (#26).
• Structured logging across provider operations via the controller-runtime contextual logger (#26).
• seccompProfile: RuntimeDefault on the controller pod for PSS restricted compliance (#26).
• Prometheus metrics (karpenter_hetzner_*: server create/delete results and duration, hcloud API calls, drift detections, instance-type cache hits/misses) plus a Helm ServiceMonitor (#29).
• Warning Events from the nodeclass controller on every NotReady path, so kubectl describe hcloudnodeclass explains why a class is not Ready (#29).
• Examples (talos-nodeclass, ubuntu-nodeclass, nodepool-multiarch) and Talos and Ubuntu bootstrap guides (#28).

Security

• Cosign keyless signing of the release image using GitHub OIDC (no long-lived keys).
• SLSA provenance attestation (mode=max) attached in-registry via BuildKit.
• In-registry SBOM attestation (CycloneDX) attached via BuildKit.
• Standalone SPDX SBOM uploaded as a workflow artifact via anchore/sbom-action.

Artifacts: multi-arch image ghcr.io/paperclipinc/karpenter-provider-hetzner:1.0.0 and OCI chart oci://ghcr.io/paperclipinc/charts/karpenter-provider-hetzner:1.0.0.

v0.3.0 — userDataSecretRef

userDataSecretRef

Adds HCloudNodeClass.userDataSecretRef: source a node's userData from a Secret instead of inline, so secret bootstrap config (e.g. a Talos worker machine config — machine/bootstrap tokens + CA) stays out of the CR spec/status and out of a GitOps repo. Takes precedence over inline userData.

• New API field userDataSecretRef {namespace, name, key} + UserDataReady status condition gating Ready (a bad/missing ref keeps the NodeClass NotReady and blocks provisioning).
• The NodeClass controller validates the referenced Secret/key at reconcile; the cloud provider resolves it at server-create time. The secret value never appears in the CR, status, condition messages, logs, or errors.

Artifacts: multi-arch image ghcr.io/paperclipinc/karpenter-provider-hetzner:0.3.0 and OCI chart oci://ghcr.io/paperclipinc/charts/karpenter-provider-hetzner:0.3.0.

v0.2.0 — Karpenter 1.13

Upgrades to Karpenter v1.13.0 and re-validates the full e2e matrix on a real Hetzner + Talos cluster.

Changes

• sigs.k8s.io/karpenter 1.12.0 → 1.13.0 (+ operatorpkg, k8s 0.36.2, hcloud-go 2.43.0, Go 1.26.4). The operatorpkg status.Object interface gained StatusConditions(...status.ForOption); updated accordingly.
• Toolchain/action freshness: golangci-lint-action v9, checkout v6, setup-go v6, buildx v4, metadata v6, login v4.

Validation

All 5 e2e scenarios pass on karpenter 1.13 with zero-residue teardown: happy (provision→Talos join→pod→GC), fallback (cpx11→cpx22), invalid-nodeclass (gating), consolidation, drift.

Install

```bash
kubectl create secret generic hcloud-token -n kube-system --from-literal=token=$HCLOUD_TOKEN
helm install karpenter-provider-hetzner
oci://ghcr.io/paperclipinc/charts/karpenter-provider-hetzner --version 0.2.0
--namespace kube-system --set clusterName= --set auth.secretRef.name=hcloud-token
```
Image: `ghcr.io/paperclipinc/karpenter-provider-hetzner:0.2.0` (linux/amd64, linux/arm64). Requires Karpenter 1.13.x.

Status: alpha. Pin this tag.

v0.1.0 — first release

First release of the Karpenter cloud provider for Hetzner Cloud.

Validated end-to-end on a real Hetzner + Talos cluster across five scenarios: provision→node-join→pod, capacity/placement fallback, invalid-NodeClass gating, consolidation, and drift detection — each with clean teardown (zero residue).

Highlights

• Karpenter CloudProvider for Hetzner Cloud: CX/CPX/CAX/CCX (incl. ARM), cost-optimal scheduling from live net pricing, unavailable-offerings fallback.
• HCloudNodeClass CRD (cluster-scoped) with a status controller validating network, firewalls, SSH keys, and image family; Ready gates provisioning.
• Drift detection (image / network / firewall / server-type), multi-cluster-safe tagging via required CLUSTER_NAME, public-IPv4 cost control.
• Hardened Helm chart (full Karpenter-core RBAC, probes, metrics/health ports). CRD installs from the chart.

Install

```bash
kubectl create secret generic hcloud-token -n kube-system --from-literal=token=$HCLOUD_TOKEN
helm install karpenter-provider-hetzner
oci://ghcr.io/paperclipinc/charts/karpenter-provider-hetzner --version 0.1.0
--namespace kube-system --set clusterName= --set auth.secretRef.name=hcloud-token
```

Images: `ghcr.io/paperclipinc/karpenter-provider-hetzner:0.1.0` (linux/amd64, linux/arm64).

Status: alpha. Pin this tag, not `latest`.