Adopt OpenCost native hcloud provider for per-instance Hetzner pricing (blocked on opencost#3710) #1784

🤖 Generated with Claude Code, at the maintainer's request.

Goal

Switch OpenCost from the current flat customPricing to the native hcloud provider for exact, per-instance, per-location Hetzner pricing pulled from the Hetzner Cloud API.

Why

Today opencost/helm-release.yaml uses a single CX33-derived customPricing (CPU 0.9441, RAM 0.4720 USD/month, 50/50 split). That's exact for the six CX33 control-plane/worker nodes, but a single per-CPU/per-GB rate can't capture Hetzner's economy-of-scale across instance types:

So autoscale nodes that aren't CX33 are priced a few % off. The native provider reads each node's hcloud://<id> providerID and looks up the real per-instance/per-location rate, eliminating the approximation.

Blocker (why this is a tracking issue, not a PR)

opencost#3710 (the hcloud provider) is still open — based on develop, not merged, and not present in the deployed OpenCost 1.120.3 (chart 2.5.x). Swapping provider/relying on hcloud:// auto-detection now would leave OpenCost with no matching provider and break the cost model. Adopt only once #3710 merges and ships in an OpenCost release.

Already in place

• Hetzner API token is seeded into OpenBao (vault-seed/seed-hcloud.yaml) and materialized as the hcloud Secret for CCM/CSI — so exposing it to the opencost namespace is a small ESO step.

Steps when #3710 ships in a release

1. Bump the opencost HelmRelease chart to the version whose appVersion includes the hcloud provider.
2. Add an ESO ExternalSecret materializing a read-only HCLOUD_TOKEN into the opencost namespace from the OpenBao path (don't reuse the CCM/CSI Secret cross-namespace).
3. Set opencost.exporter.env HCLOUD_TOKEN (fallback CLOUD_PROVIDER_API_KEY); the provider auto-detects from hcloud:// providerIDs.
4. Remove the customPricing block.
5. Re-derive the Coroot blended per-CPU/per-GB rate (the #1783 coroot-custom-cloud-pricing CronJob) from the new authoritative per-instance numbers so the two cost views stay consistent — Coroot's model is per-CPU/per-GB only and can't consume the provider directly.
6. Validate (kubectl kustomize prod+local, ksail --config ksail.prod.yaml workload validate) and open a draft PR.

Refs

• Coroot side of the same cost-accuracy fix: fix(coroot): price Hetzner nodes correctly instead of the ~16x GCP-C4 fallback #1783
• opencost#3710 (native hcloud provider), opencost#3523 (Hetzner cost tracking discussion)

Blocker: opencost/opencost#3710 | upstream | last-verified 2026-09-13: not shipped — the OpenCost cloud-provider configuration docs (opencost.io) list AWS, Azure, GCP, OCI, Open Telekom Cloud, On-Premises, STACKIT and OVHcloud, with Alibaba and Scaleway marked "documentation needed"; no Hetzner/hcloud provider (the only "hcloud" substrings are inside "OVHcloud"). Newest release in the opencost-helm-chart index is chart 2.5.31 / app 1.121.2 (2026-09-11).