Self-hosted Kubernetes platforms
Running your own cluster is usually the wrong answer. It becomes the right one at a fairly specific point: when your managed-Kubernetes bill is dominated by things you are not using, when your workloads are steady rather than spiky, and when someone on the project is willing to own the control plane. This page is about how to tell whether you are at that point.
We have built this and we run one in production today.
Amour runs on a K3s cluster on Hetzner that we provisioned, hardened and are on call for, with deployments managed declaratively through Flux.
See the case study →Every capability page carries one of three badges: Shipped, Adjacent — we have built the components of this — or Can build — we can build it from our expertise. We would rather tell you before the call than during it.
The cluster is the easy part.
K3s installs in a minute. What takes the time is everything that a managed provider was quietly doing for you: certificate rotation, ingress with a real load balancer in front of it, node upgrades that do not drain into an empty pool, backups you have actually restored from, and a monitoring stack that pages the right person.
We keep stateful workloads off the cluster wherever possible. Postgres goes on a managed instance. Object storage is external. What runs in Kubernetes is stateless application code and workers, which means a node can be destroyed and recreated without anybody thinking hard about it.
Asked on nearly every call.
Is this cheaper than managed Kubernetes?+
On the invoice, usually yes, often by a factor of three or four for steady workloads. In total cost, only if someone is willing to own the cluster. If that person does not exist, managed is cheaper.
What if we want to move to EKS later?+
Your manifests move mostly unchanged, which is the point of keeping stateful things off the cluster. The work is in the ingress, secrets and CI, and it is a week rather than a project.
Who is on call?+
Us, while we run it. That is written into the engagement. If you take it in-house we run a handover that includes the on-call rota and the runbook, and we shadow your team for two weeks.
Does this pass a security review?+
It has passed two. Private networking, no public control plane, secrets in a managed store rather than in the cluster, and audit logging shipped off-node. We will send the questionnaire responses we have already written.