Running production Kubernetes in-house costs more than the cluster bill. The real cost is the platform team: enough engineers to cover a 24/7 on-call rotation, keep up with three Kubernetes releases a year, and patch CVEs across a dozen add-ons. For most organizations without a dedicated platform team, a managed Kubernetes provider is cheaper.
We run 100+ clusters for teams across healthcare, fintech, logistics and the public sector. Many of them started by running Kubernetes themselves. This is what we see when they do the math.
What does it take to run production Kubernetes?
Spinning up a cluster takes an afternoon. Running it in production is a permanent job. The work falls into four buckets:
- Lifecycle. Kubernetes ships a new minor version roughly every four months, and each version gets about a year of patches. Every upgrade means checking deprecated APIs, upgrading add-ons in the right order, and rolling node pools without breaking workloads.
- Platform components. Gateway API (Envoy Gateway), cert-manager, monitoring, GitOps, backups, policy enforcement. Each one has its own release cadence, its own CVEs and its own breaking changes.
- Operations. Alerts, incidents, capacity planning, cost control, restore tests, access requests from developers.
- Security and compliance. CVE triage, audit evidence for ISO 27001, access reviews, network policy changes.
None of this ships a feature, but all of it has to happen.
How many engineers does a 24/7 on-call rotation need?
This is where most in-house cost estimates break down. One Kubernetes engineer is not a platform team. They are a single point of failure who can never go on vacation.
Google’s Site Reliability Engineering book puts the minimum for a single-site 24/7 on-call team at eight engineers. Smaller teams do make it work with fewer people, but below four the rotation burns people out: each engineer is on call every second or third week.
On top of salaries come the costs that don’t show up in a headcount sheet:
- Recruitment. Experienced Kubernetes engineers are scarce in the Dutch market. Vacancies stay open for months.
- Training and certification. CKA, CKS and keeping up with the CNCF landscape take time away from operations.
- Tooling. Paging, monitoring storage, backup storage, security scanning.
- Knowledge risk. When the one engineer who built the cluster leaves, the knowledge leaves with them.
What are the hidden costs of running Kubernetes yourself?
The biggest hidden cost is opportunity cost. Every week your best engineers spend on cluster upgrades is a week they don’t spend on your product.
The second is deferred maintenance. Teams under feature pressure skip upgrades. A year later they are three minor versions behind, on an unsupported release, and the catch-up upgrade becomes a project of its own. We regularly take over clusters in exactly this state.
The third is incident cost. A team running one cluster meets each failure mode for the first time, in production. A provider running a hundred has usually seen it before, and has the runbook ready.
When is an in-house platform team the better choice?
Managed Kubernetes is not always cheaper. Build your own platform team when:
- The platform is your product. If you sell a platform or run Kubernetes at very large scale, platform engineering is core to your business. Keep it in-house.
- You already have the team. If you have eight or more experienced platform engineers with a working on-call rotation, outsourcing buys you little.
- Your requirements are very unusual. Custom kernels, exotic hardware, or a platform that deliberately diverges from upstream Kubernetes.
Many organizations land in between: a small internal platform team that owns the developer experience, with a managed provider underneath that owns the clusters and the night shifts. That split works well.
What does a managed Kubernetes fee cover?
At Guida, you pay a fixed monthly fee based on the number of clusters and environments. It covers:
- Design and build of the cluster and the full platform stack
- Kubernetes and add-on upgrades
- Monitoring and incident response, 24/7, backed by an SLA
- CVE triage and remediation for the platform
- Backups and restore tests
- Direct access to our engineers in a shared Slack or Microsoft Teams channel
What it doesn’t cover: your cloud provider bill and your applications. Your team still owns its code, container images and deployment manifests. We help you set those up well.
How do you compare the two?
Put both options side by side over three years, not one:
| Cost item | In-house | Managed |
|---|---|---|
| Engineers for build and operations | Salaries, recruitment, training | Included |
| 24/7 on-call | On-call allowances, burnout risk | Included |
| Upgrades and CVEs | Engineer time | Included |
| Tooling | Licenses and storage | Mostly included |
| Knowledge risk | High with small teams | Low, spread across a team |
| Cloud infrastructure | Your bill | Your bill |
The bottom line
If Kubernetes is a means to an end, you are paying a platform team to solve problems that hundreds of other teams have already solved. A managed provider spreads that cost across many clusters.
If you want to see the numbers for your situation, talk to us. We’ll tell you honestly whether running it yourself is the better deal. See also what’s included in Guida managed Kubernetes and why Day-2 operations matter.