EKS, AKS and GKE

Managed Kubernetes Services for SMBs and Startups

Your cloud provider runs part of Kubernetes. The rest is still your job: upgrades three times a year, patching, security settings, cost and the 3 a.m. alerts. PlatOps does that work so your app stays up, for companies with 10–200 employees and funded startups that have no platform team.

And if a small team would be better off on ECS, Cloud Run or App Service, we will tell you before you build a cluster you don't need.

Book a free 1-hour call Prefer a written review?

What we run for you

In your cloud account, from your repositories

Control plane, node and add-on upgrades
Pod security, RBAC and workload identity
Right-sized requests and autoscaling
GitOps deployments with Argo CD or Flux
Cluster alerts and on-call
Backups with tested restores

Not on Kubernetes? We operate ECS, Cloud Run and App Service too.

Do you actually need Kubernetes?

Kubernetes solves real problems for teams running many services. For a small team it can also be the most expensive way to run three containers. Here is how we weigh it against the simpler managed platforms.

Platform	Fits when	What you pay for	Our view
Kubernetes (EKS, AKS, GKE)	Many services with different scaling needs, a platform you want to run the same way on more than one cloud, or tooling that only ships as Kubernetes operators.	A per-cluster control plane fee on EKS and on the paid AKS and GKE tiers, plus nodes, plus the people time to upgrade three or four times a year.	Worth it once the workload needs it.
Amazon ECS on Fargate	A handful of containerized services on AWS. No nodes to patch, no cluster version to upgrade, IAM works the same as the rest of AWS.	No control plane fee. You pay for the task CPU and memory you reserve.	Our default for small AWS teams.
Google Cloud Run	Stateless HTTP services and jobs on GCP that can scale to zero between requests.	With request-based billing you pay for instance time while requests are handled, so quiet services cost little.	Hard to beat for APIs and internal tools.
Azure App Service or Container Apps	Web apps and APIs on Azure, especially teams already on Microsoft 365 and Entra ID.	Plan-based (App Service) or consumption-based (Container Apps) pricing, with no cluster to operate.	The simplest path on Azure.

Kubernetes is worth it when

You run ten or more services, or expect to within a year
Different services need very different scaling, scheduling or GPU nodes
You need the same deployment model across AWS, Azure and GCP, or on-premises
A vendor product you depend on ships only as a Helm chart or operator
You already run Kubernetes and the problem is operating it, not choosing it

A simpler platform is likely better when

Fewer than about five services and one or two developers handling ops
Nobody on the team has upgraded a cluster before
The main goal is "deploy containers without managing servers"
The monthly cloud bill is small enough that a cluster fee and idle nodes would be a visible share of it

Already decided against Kubernetes? We run ECS, Cloud Run and App Service under the same managed DevOps retainer.

The upgrade calendar you sign up for

A managed control plane does not mean managed upgrades. Each provider retires old versions on a fixed schedule, and falling behind costs money or ends in an upgrade you did not choose.

Upstream Kubernetes

A new minor version about every four months

The Kubernetes project maintains release branches for the three most recent minor versions, and each one gets roughly a year of patches. After that, upstream security fixes stop.

kubernetes.io releases

Amazon EKS

14 months standard, then 12 months extended

Extended support is on by default and raises the cluster fee from $0.10 to $0.60 an hour, about $73 to $438 a month per cluster. When extended support ends, EKS upgrades the control plane for you. Managed node groups and self-managed nodes stay on the old version.

EKS version lifecycle

Azure AKS

Three GA minor versions, about 12 months each

AKS supports the latest version and the two before it (N-2). A fourth version gets platform support only, with no Kubernetes security patches. Long-term support adds a second year, and it requires the Premium tier.

AKS supported versions

Google GKE

About 14 months standard, up to 24 with Extended

The Extended release channel adds roughly ten months of security patches for an extra fee per cluster. At the end of support, GKE upgrades clusters to the next minor version, whether or not workloads still use removed APIs.

GKE versioning

The practical result: plan a minor-version upgrade roughly three times a year per cluster, test it in staging first, and upgrade nodes and add-ons with the control plane. That is the first thing we take off your team.

What we run on your clusters

Six areas of ongoing work, done in your cloud accounts and visible in pull requests, your Slack or Teams channel and a monthly report.

Version upgrades

One minor version at a time, before standard support ends, so you never pay extended-support fees by accident or get force-upgraded.

Deprecated and removed API checks before every upgrade
Staging cluster first, then production in an agreed window
Control plane, node pools and add-ons kept in step
Ingress controller, CNI, CSI and cert-manager upgraded alongside

Security baseline

The controls a security questionnaire or SOC 2 auditor asks about, applied by policy rather than by memory.

Pod Security Standards: baseline everywhere, restricted where workloads allow
RBAC mapped to your identity provider, with no shared admin kubeconfigs
Workload identity (EKS Pod Identity or IRSA, AKS and GKE Workload Identity) instead of static cloud keys
Secrets from a cloud secrets manager, network policies and image scanning

Runtime detection and image signing

Cost control

Most Kubernetes waste is requested capacity nobody uses. We size requests to real usage and let the cluster shrink.

Requests and limits set from observed usage, reviewed monthly
Cluster Autoscaler or Karpenter tuned so idle nodes are removed
Spot or preemptible nodes for stateless and batch workloads
Cost per namespace or team, so the bill has owners

Kubernetes cost optimization guide

Deployments

What runs in the cluster is what is in Git. Changes go through pull requests and can be rolled back by reverting one.

Argo CD or Flux syncing from your repository
Helm or Kustomize, whichever you already use
Health checks and readiness probes on every workload
Image tags pinned to a build, never latest

The pipelines that feed the cluster

Monitoring and on-call

Cluster alerts route to our engineers, with response times set by your retainer plan.

Node pressure, crash loops, pending pods and certificate expiry alerts
Prometheus-compatible metrics and centralized logs
Alert noise reviewed so pages mean something
Incident updates in your Slack or Teams channel

Incident response and on-call

Backup and recovery

Cluster state can be rebuilt from Git. Persistent data cannot, so we back it up and prove it restores.

Velero or the provider's backup service for volumes and resources
Managed databases kept outside the cluster where possible
Scheduled restore tests into a scratch namespace
A written rebuild runbook for the whole cluster

Running AI agents or model servers on Kubernetes? Cluster defaults are not enough to contain them; our guide to securing AI agents on Kubernetes covers what to add.

How an engagement works

Projects and operations are priced separately, so you know what the build costs and what keeping it healthy costs.

Assess

We look at your workloads, cluster versions, node usage, access model and bill. If a simpler platform would serve you better, this is where we say so, before anything is built.

Build or stabilize

A new cluster, a migration from VMs or Docker Compose, or catching up an existing cluster that has fallen behind on versions. Scoped and quoted as a fixed project.

Operate

Upgrades, patching, cost reviews and on-call continue under a Managed DevOps retainer. All cluster code lives in your repositories and cloud accounts.

Ongoing operation sits inside a retainer plan: Essential at $3,500–$7,500 a month, Professional at $8,000–$15,000 and Enterprise priced to scope. Builds and migrations are quoted after the assessment. If you want a fixed starting point, the Cloud & DevOps Audit Sprint is $5,000 over 30 days: it finds cost, security and reliability risk in your infrastructure and ships three quick wins.

Probably not a fit if

You want Kubernetes because it is popular, not because a workload needs it. We will usually recommend ECS, Cloud Run or App Service instead
Your platform team of five or more already runs clusters and needs extra hands inside its sprints, not an outside operator
Clusters on custom hardware with bespoke networking that an outside team cannot reach or reproduce

Related services

Kubernetes is one part of how software reaches production. These cover the rest.

Managed DevOps

The monthly service that keeps your clusters, pipelines and infrastructure code running.

Learn more

CI/CD Pipelines

Build, scan and deploy pipelines with OIDC cloud access and tested rollbacks.

Learn more

Platform Engineering

Internal developer platforms for organizations with several product teams.

Learn more

Incident Management

Someone answers, and fixes it, when something breaks

Learn more

Cloud-Native Security

Image signing, admission control and runtime detection for container workloads.

Learn more

DevOps Compliance

SOC 2, HIPAA and PCI DSS controls in your pipelines and clusters, with an 11-control checklist.

Learn more

Managed Kubernetes FAQ

What are managed Kubernetes services?

An outside team operates your Kubernetes clusters for a monthly fee: version upgrades, node patching, security policy, cost tuning, deployments, monitoring and on-call. With PlatOps the clusters stay in your own AWS, Azure or GCP account and all configuration lives in your repositories.

Isn't EKS, AKS or GKE already managed Kubernetes?

Only the control plane. The cloud provider runs the API server and etcd. You still choose when to upgrade, upgrade the nodes and add-ons, write RBAC and network policy, size workloads and answer alerts. EKS, for example, does not upgrade managed node groups when the control plane is upgraded. That remaining work is what we take on.

Does a small team need Kubernetes?

Often not. With a handful of services and no one experienced in cluster operations, Amazon ECS on Fargate, Google Cloud Run or Azure App Service give you containers without nodes or version upgrades. We recommend Kubernetes when the workload needs it, or when you already run it.

How often do Kubernetes clusters need upgrading?

Kubernetes ships a new minor version about every four months, and EKS, AKS and GKE each retire old versions on a published schedule. In practice that means planning a minor upgrade roughly three times a year, plus patch updates in between, to stay inside standard support.

What happens if we fall behind on EKS versions?

After 14 months a version moves to extended support, which is on by default and raises the cluster fee from $0.10 to $0.60 an hour. After another 12 months AWS upgrades the control plane automatically, without notice of the exact time, and your nodes and add-ons are left on the old version until someone updates them.

Which clouds and tools do you support?

Amazon EKS, Azure AKS and Google GKE, with Argo CD or Flux for GitOps, Helm or Kustomize for packaging, Cluster Autoscaler or Karpenter for scaling and Prometheus-compatible monitoring. We work with what you have rather than replacing tools that already work.

How much do managed Kubernetes services cost?

Ongoing operation is part of a Managed DevOps retainer: Essential is $3,500–$7,500 a month, Professional $8,000–$15,000 and Enterprise is custom. Cluster builds and migrations are quoted as separate fixed projects after an assessment. Your cloud bill, including cluster fees, is paid directly to the provider.

Can you take over a cluster someone else built?

Yes, and it is the most common starting point. We inventory what is running, bring hand-applied resources into Git, catch the cluster up to a supported version one minor release at a time and document how to rebuild it.

Can you help us move off Kubernetes?

Yes. If a cluster costs more in time and money than it returns, moving a small number of services to ECS, Cloud Run or App Service is a normal project for us, and the assessment will tell you whether it is worth doing.

Kubernetes, or something simpler

Find out what your clusters need

Tell us what you run today. We will check your versions against each provider's support calendar, look at node usage and access, and tell you whether to keep, fix or replace the cluster.

Book a free 1-hour call Prefer a written review?