Sample 02 • Decision Guide • 11 min
Kubernetes vs Managed Container Platforms: When Each Makes Sense
Two great answers to the same question — “where should my containers run?” — with very different bills and failure modes. This guide gives you five constraints that decide it, so you can exit the debate in one meeting.
The wrong starting question
Don’t ask “is Kubernetes better?” Ask: “which set of operational costs and escape hatches do we want to pay for, given our team?” Managed platforms (Cloud Run, ECS/Fargate, Azure Container Apps, Fly.io, Render) buy you time. Kubernetes buys you control. Time is usually the right purchase early.
The five constraints that decide
Score yourself “yes”/“no” — if ≥2 are “yes,” Kubernetes is defensible. Otherwise, stay managed.
| # | Constraint | Favors managed | Favors K8s | Signal example |
|---|---|---|---|---|
| 1 | Platform team | <2 dedicated platform engineers | ≥2 who can own upgrades, CVEs, nodes | You patch nodes “when we have time” → stay managed |
| 2 | Multi-cloud / portability | Single cloud is fine for 18+ mo | Must run same policy across clouds | Legal requires cloud-agnostic infra → lean K8s |
| 3 | Workload diversity | ≤10 services, similar shape | >12–15 services, divergent deploys | Each team wants its own deploy/rollout → K8s helps |
| 4 | Control depth | Needs are L7 + autoscaling + jobs | Need operators, CRDs, extended networking | You plan custom controllers → K8s native |
| 5 | Compliance | Standard SOC 2, single region | FedRAMP, air-gapped, or bespoke policy engine | Policy = code + admission control everywhere → K8s |
Shortcut: If you’re asking “should we adopt K8s?” and you have fewer than 2 platform engineers who love living in YAML — you already have your answer. Stay managed and ship.
Cost / ops math (no hand-waving)
These are order-of-magnitude so you can compare apples to apples for a mid-traffic app (~200 RPS, 6 services).
- Managed (Cloud Run / Fargate class): $400–$1,100/mo compute + egress, plus near-zero control-plane labor. Day-2 is “set min/max, tune concurrency.”
- Managed K8s (GKE Autopilot / EKS Fargate / AKS): $300–$800/mo control plane + nodes + add-ons, plus ~15–30h/mo for upgrades, networking, storage, IAM, and CVE patches — even on “managed.”
- Self-managed K8s on VMs: cheaper sticker, far more pager time. Only wins if you already pay for a platform team or need on-prem.
At a $150k fully loaded engineer, 20h/mo of K8s care = ~$1,800/mo in hidden cost — often more than the PaaS delta.
Migration risk (what no one mentions)
- Managed → K8s later: Moderate risk. Your images and OTel already travel. The work is ingress, IAM, network policy, secrets, storage classes, and re-tuning autoscaling. Budget 3–6 eng-weeks plus a period of dual-run.
- K8s → Managed (unwind): Usually low risk if services are stateless. High risk if you adopted CRDs/operators that don’t map cleanly.
- Biggest regret vector: adopting K8s too early and then staffing around it. You don’t get that headcount back.
When to use what — explicit recommendations
- Use Cloud Run / ECS Fargate / Azure Container Apps when: team ≤8, single cloud, <10 services, and delivery speed > infrastructure novelty.
- Use GKE Autopilot / EKS on Fargate when: you want K8s API benefits (operators, GitOps, policy) but not node management — a pragmatic halfway house.
- Use full K8s (GKE Standard / EKS / AKS) when: ≥2 platform owners, >12 services, or you truly need CRDs / multi-cloud policy portability.
- Use Fly.io / Render when: you value global edge + simplest deploys for small teams — but vet lock-in tolerance for data.
Decision template (copy into your ADR)
Decision: We will run on [Cloud Run / ECS Fargate / GKE Autopilot / EKS] because we have [team size] and [≤10 services, single cloud]. We will revisit when we hit [≥12 services OR ≥2 platform engineers OR portability requirement]. Cost delta accepted: ~$[X]/mo vs ~[Y]h/mo platform labor. Rollback path: images are portable; ingress/IAM is the migration tax.
Bottom line
Default: stay managed. Graduate to Kubernetes when two of the five constraints become true — not because it’s “what serious companies do.” The serious thing is shipping with the smallest production-grade platform that can fail well.