diff --git a/kubernetes/apps/kube-system/hccm/app/externalsecret.yaml b/kubernetes/apps/kube-system/hccm/app/externalsecret.yaml
new file mode 100644
index 0000000..c629077
--- /dev/null
+++ b/kubernetes/apps/kube-system/hccm/app/externalsecret.yaml
@@ -0,0 +1,18 @@
+---
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: hcloud
+  namespace: kube-system
+spec:
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: onepassword-connect
+  target:
+    name: hcloud
+    creationPolicy: Owner
+  data:
+    - secretKey: network
+      remoteRef:
+        key: hetzner
+        property: cloud-api-token
diff --git a/kubernetes/apps/kube-system/hccm/app/helmrelease.yaml b/kubernetes/apps/kube-system/hccm/app/helmrelease.yaml
new file mode 100644
index 0000000..1d4d1ef
--- /dev/null
+++ b/kubernetes/apps/kube-system/hccm/app/helmrelease.yaml
@@ -0,0 +1,21 @@
+# yaml-language-server: $schema=https://raw.githubusercontent.com/fluxcd-community/flux2-schemas/main/helmrelease-helm-v2beta1.json
+---
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
+kind: HelmRelease
+metadata:
+  name: hccm
+  namespace: kube-system
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: hcloud-cloud-controller-manager
+      version: v1.18.0
+      sourceRef:
+        kind: HelmRepository
+        name: hetzner
+        namespace: flux-system
+      interval: 30m
+  values:
+    metrics:
+      enabled: true
diff --git a/kubernetes/apps/kube-system/hccm/app/kustomization.yaml b/kubernetes/apps/kube-system/hccm/app/kustomization.yaml
new file mode 100644
index 0000000..749cbd1
--- /dev/null
+++ b/kubernetes/apps/kube-system/hccm/app/kustomization.yaml
@@ -0,0 +1,7 @@
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization.json
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: kube-system
+resources:
+  - ./helmrelease.yaml
diff --git a/kubernetes/apps/kube-system/hccm/ks.yaml b/kubernetes/apps/kube-system/hccm/ks.yaml
new file mode 100644
index 0000000..916a824
--- /dev/null
+++ b/kubernetes/apps/kube-system/hccm/ks.yaml
@@ -0,0 +1,16 @@
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: cluster-apps-hetzner-hccm
+  namespace: flux-system
+  labels:
+    substitution.flux.home.arpa/enabled: "true"
+spec:
+  interval: 10m
+  path: "./kubernetes/apps/kube-system/hccm/app"
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: valinor
+  wait: true
diff --git a/kubernetes/apps/kube-system/kustomization.yaml b/kubernetes/apps/kube-system/kustomization.yaml
index a8875ab..2318d64 100644
--- a/kubernetes/apps/kube-system/kustomization.yaml
+++ b/kubernetes/apps/kube-system/kustomization.yaml
@@ -1,3 +1,4 @@
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization.json
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
diff --git a/kubernetes/apps/kube-system/metrics-server/app/kustomization.yaml b/kubernetes/apps/kube-system/metrics-server/app/kustomization.yaml
index 1c3fdb0..749cbd1 100644
--- a/kubernetes/apps/kube-system/metrics-server/app/kustomization.yaml
+++ b/kubernetes/apps/kube-system/metrics-server/app/kustomization.yaml
@@ -1,3 +1,4 @@
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization.json
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
diff --git a/kubernetes/flux/repositories/helm/hetzner.yaml b/kubernetes/flux/repositories/helm/hetzner.yaml
new file mode 100644
index 0000000..668285e
--- /dev/null
+++ b/kubernetes/flux/repositories/helm/hetzner.yaml
@@ -0,0 +1,10 @@
+---
+apiVersion: source.toolkit.fluxcd.io/v1beta2
+kind: HelmRepository
+metadata:
+  name: hetzner
+  namespace: flux-system
+spec:
+  interval: 30m
+  url: https://charts.hetzner.cloud
+  timeout: 3m
diff --git a/kubernetes/flux/repositories/helm/kustomization.yaml b/kubernetes/flux/repositories/helm/kustomization.yaml
index deddf11..1ba2b62 100644
--- a/kubernetes/flux/repositories/helm/kustomization.yaml
+++ b/kubernetes/flux/repositories/helm/kustomization.yaml
@@ -1,3 +1,4 @@
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization.json
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
@@ -12,6 +13,7 @@ resources:
  - external-secrets.yaml
  - fairwinds.yaml
  - grafana.yaml
+ - hetzner.yaml
  - ingress-nginx.yaml
  - jahanson.yaml
  - jetstack.yaml