Newsletter
Subscribe our newsletter
Get new infrastructure guides, comparison reports, and migration notes in your inbox.
Managed Kubernetes vs Kubernetes on Bare Metal: Cost, Control and Fit
Updated October 2026
Managed Kubernetes is a cloud service where the provider runs the control plane (API server, etcd, scheduler) and you run workloads on nodes. It suits teams that want clusters without operating them. Kubernetes on bare metal or an on-prem distribution suits large, steady or sovereignty-bound estates. As of October 2026 the big three charge $0.10 per cluster-hour for the control plane.
What is managed Kubernetes?
A Kubernetes cluster has two halves. The control plane decides what runs where and stores the cluster state. The worker nodes run your containers. In a managed service the provider builds, patches, backs up and spreads the control plane across zones. You choose the node types, the Kubernetes version and what to deploy.
The main services are Amazon EKS, Azure AKS and Google GKE. Smaller clouds such as DigitalOcean and Scaleway sell the same idea with fewer features. Modes such as EKS Auto Mode, AKS Automatic and GKE Autopilot also run the nodes.
Managed Kubernetes vs self-managed: side-by-side comparison
| Category | Managed Kubernetes | Self-managed or bare metal |
|---|---|---|
| Control plane | Provider runs and repairs the API server, etcd and scheduler | Your team, or a distribution vendor under contract |
| Upgrades | One call upgrades the control plane; nodes are still yours | You plan, test and run every upgrade |
| Cost model | Per-cluster hourly fee plus nodes, storage and traffic | Hardware, power, licences and staff, mostly fixed |
| Control | Standard APIs, fixed control plane choices | Full control of kernel, network, storage and GPUs |
| Skills | Kubernetes plus the provider's identity, network and storage | Kubernetes plus Linux, networking, storage and hardware |
| First cluster | Minutes | Days to weeks |
| Lock-in | Low for workloads, moderate for identity and storage classes | Low if you stay close to upstream |
Self-managed Kubernetes is the same open source software. The Ledger scores upstream Kubernetes at 65.5 in the Cloud Kubernetes Ledger 2026: full portability and no fee, paid for with operations.
Managed Kubernetes control plane cost
As of October 2026 Amazon EKS and Google GKE charge $0.10 per cluster-hour, which is about $73 a month at 730 hours (our arithmetic), and AKS charges the same on its Standard tier. Ten clusters cost about $730 a month before any node, so cluster sprawl is where the fee matters.
| Provider | Standard support | Extended or long term support | Free tier and extras |
|---|---|---|---|
| Amazon EKS | $0.10 per cluster-hour | $0.60 per cluster-hour | No free tier on the pricing page. Provisioned Control Plane tiers cost $1.65 to $13.90 per hour more. |
| Azure AKS | Free tier: no fee. Standard tier: $0.10 per cluster-hour | Long Term Support meter at $0.60 per cluster-hour (Premium tier) | The Free tier has no financially backed SLA. AKS Automatic lists a $0.16 per hour control plane meter. |
| Google GKE | $0.10 per cluster-hour, in every mode | $0.50 more: $0.60 per cluster-hour (Extended channel) | A $74.40 monthly credit per billing account covers one zonal or Autopilot cluster. |
Sources, checked October 2026: AWS EKS pricing, Azure AKS pricing (rates from the Azure retail price list, East US, USD) and Google GKE pricing. Prices vary by region.
Extended support is the fee to watch. A cluster left on an old version pays $0.60 per cluster-hour on EKS and GKE, six times the standard fee, or about $438 a month per cluster. The Ledger scores commercial risk out of 25 (lower is better): EKS 8.0, AKS 6.5, GKE 5.5. Source: Cloud Kubernetes Ledger 2026.
Bare metal has no per-cluster fee. Its cost sits in servers, power, networking, spare capacity and engineers. Owned hardware tends to win when load is large, steady and well forecast, and a managed service wins when load swings or the team is small. Test that with your own numbers.
Managed Kubernetes version upgrade support
Kubernetes ships a minor version about every four months, and each provider supports a version for a fixed window. A managed control plane upgrades with one call, but your nodes, add-ons and deprecated APIs still need testing. On EKS, node groups are not upgraded with the control plane.
| Provider | Support window per minor version | At the end of support |
|---|---|---|
| Amazon EKS | 14 months standard plus 12 months extended: 26 months | Control plane auto-upgraded; rollback within 7 days of an in-place upgrade |
| Azure AKS | About 12 months community, plus a year of Long Term Support (Premium) | 60-day grace period, then AKS upgrades the cluster |
| Google GKE | About 14 months standard plus about 10 months extended: up to 24 months | Control plane upgraded automatically |
Sources, October 2026: EKS version lifecycle, AKS supported versions and GKE versioning.
Never let a cluster reach the forced upgrade. AKS says its automatic upgrades ignore maintenance windows and can override a Pod Disruption Budget, and EKS gives no notice before it upgrades a control plane past extended support. A self-managed cluster runs the same upgrade treadmill with no provider to absorb the control plane half of it.
Managed Kubernetes SLA and uptime
Each big provider publishes a financially backed uptime commitment for the control plane. It covers the API endpoint, so a node outage or a bad deployment of yours does not count. AWS and Google pay a missed target as credits against future bills.
| Provider | Control plane SLA | What it covers |
|---|---|---|
| Amazon EKS | 99.95% standard, 99.99% with Provisioned Control Plane | The Kubernetes API endpoint. Nodes fall under the EC2 SLA. |
| Azure AKS | 99.95% with availability zones, 99.9% without (Standard and Premium) | The API server. The Free tier has no financially backed SLA. |
| Google GKE | 99.95% regional Standard and Autopilot control plane, 99.5% zonal | The control plane. Autopilot pods across zones have a separate 99.9%. |
Sources, checked October 2026: AWS EKS SLA, AKS pricing tiers and uptime SLA and Google GKE SLA. Some GKE regions carry lower targets, so read the region section.
A 99.95% commitment allows about 22 minutes of control plane downtime in a 30-day month (our arithmetic). Running workloads keep running while the API is down, but you cannot deploy or scale. On bare metal you set your own target and pay for it with three control plane nodes and tested etcd backups.
Managed Kubernetes security and compliance
Managed Kubernetes works on a shared responsibility model. The provider secures and patches the control plane. You secure what runs on it: images, RBAC, network policies, secrets, admission rules and, in most modes, the worker node operating system and its patches.
Provider compliance reports cover the provider's side only. A permissive RBAC role or an open load balancer is your configuration. For audits, ask each provider for its current attestations and the regions they cover, then map your own controls on top.
Bare metal moves every item into your column. That helps when a regulator wants named hardware, an air gap or a specific country, and you then carry the audit evidence for the control plane and the site.
Managed Kubernetes lock-in and portability
The Kubernetes API is portable, and the big three are conformant. The lock-in sits around it: identity, load balancers, storage classes, network plugins and provider add-ons. The Ledger scores technical lock-in out of 25, where lower is better: GKE 8.0, AKS 9.5 and EKS 10.0. The Ledger also records that the three waive data transfer fees for customers who leave (EKS on request, AKS only when leaving Azure completely), which lowers the exit cost. Source: Cloud Kubernetes Ledger 2026.
To keep the option open, use standard manifests or Helm, keep infrastructure in Terraform, back up with a portable tool such as Velero, and avoid provider-only custom resources.
Managed Kubernetes on-premises vs cloud: where bare metal fits
Cloud managed Kubernetes and bare metal are the two ends of a range. In between sit on-prem distributions that give a managed-style experience on your own hardware, and cloud vendors that reach into your data center: EKS Hybrid Nodes and EKS Anywhere, AKS on Azure Local and Google Distributed Cloud. In the Ledger records, the EKS managed control plane stays in AWS, while Azure and Google both offer first-party hybrid paths.
Bare metal fits large, steady load, GPUs or storage you want to own, egress-heavy bills and sovereignty rules. In the On-Prem Kubernetes Ledger 2026, Red Hat OpenShift leads with a Ledger Index of 80.9, followed by SUSE Rancher Prime at 77.5 and Spectro Cloud Palette at 68.0. Upstream Kubernetes with kubeadm and Cluster API scores 66.3 and Sidero Talos 61.2. Read the OpenShift, Rancher and Talos scorecards for the trade-offs.
Bare metal fits less well with a very small platform team or spiky demand. Many companies run both: cloud clusters for variable web load and on-prem clusters for steady data and AI jobs. New to the basics? Read the Kubernetes definition. For distributions see the Kubernetes distributions report, and for GPU planning read AI and GPU workloads on Kubernetes.
Which managed Kubernetes service is best?
In the Cloud Kubernetes Ledger 2026, Google GKE ranks first with a Ledger Index of 82.4, Azure AKS second with 80.8 and Amazon EKS third with 80.7. The gap is small, so the cloud where your identity, data and skills already live matters more than the rank. Fourth place, Alibaba Cloud ACK, scores 74.4.
| Service | Ledger Index | Capability /100 | Lock-in /25 (lower is better) | Fits |
|---|---|---|---|---|
| Google GKE | 82.4 | 92.0 | 8.0 | AI and very large fleets, the most complete managed feature set, modest lock-in |
| Azure AKS | 80.8 | 86.8 | 9.5 | Microsoft estates, free entry tier, long term support option |
| Amazon EKS | 80.7 | 86.0 | 10.0 | AWS-centred companies, the fastest version cadence of the three, no free tier |
Source: Cloud Kubernetes Ledger 2026 (edition 2026-10-13), which ranks 20 services.
GKE has the broadest managed feature set and the lowest lock-in score, but charges for every cluster beyond the free credit and for extended support. AKS has a free entry tier and a long term support option, with slower version uptake than EKS. EKS has the fastest version cadence and the deepest AWS integration, with no free tier and growing add-on fees. For your own workloads, run the Cloud Kubernetes Advisor, which ranks the Ledger products against your budget, region and workload.
Managed Kubernetes for a small startup
A startup should buy the control plane and spend its time on the product. Start with one cluster and use namespaces for staging and production, because every extra cluster adds about $73 a month before nodes. Pick the cloud your team already knows.
GKE credits one zonal or Autopilot cluster fee, AKS has a Free tier for development, and smaller clouds such as Scaleway (Ledger Index 62.2) and DigitalOcean (61.9) trade features for simplicity. With EU data rules or a tight budget, the Cloud Kubernetes Advisor narrows the shortlist in a few minutes.