Kubernetes That Your Team Can Actually Operate, Not Just Deploy To

ECS is simpler to operate if you are all-in on AWS and your team does not have Kubernetes experience. Kubernetes makes sense when: you need multi-cloud portability, you want GitOps tooling (ArgoCD, Flux), your team already knows K8s, or you have complex networking and scheduling requirements. We will recommend ECS over K8s if K8s is overkill for your use case — the operational overhead of K8s is real and not worth it for a 3-service application.

Managed K8s means the cloud provider runs the control plane (API server, etcd, scheduler) and you manage the worker nodes. Self-managed means you run everything. Unless you have a specific reason (cost at very large scale, hardware requirements, air-gapped environment), use managed. The control plane is not where problems happen — it is expensive to run well and not where you want to spend engineering time.

K8s is worth the operational overhead when: you have 5+ services that need to scale independently, you need sophisticated deployment strategies (canary, blue-green), you want GitOps-style deployment auditability, or you have teams that need namespace isolation. A 2-service app with predictable traffic can run on ECS, App Service, or even a few EC2 instances managed by Terraform. We will tell you when K8s is not the right answer.

A production EKS cluster setup with GitOps, monitoring, and team onboarding typically runs ₹1,50,000–3,00,000 depending on the number of services and existing infrastructure state. Ongoing managed support (upgrades, scaling events, incident response) is ₹30,000–80,000/month. The cluster infrastructure itself (EC2 nodes) is your cloud bill, which varies with workload.

A greenfield cluster with 3–5 services: 3–4 weeks. Migrating an existing 10-service application from VMs or ECS: 6–10 weeks, depending on how stateful the workloads are. Migrating a monolith that was not designed for containers requires application changes first, which we scope separately.

Our standard hardening includes: RBAC with least-privilege (no cluster-admin for application service accounts), Pod Security Standards enforced (no privileged pods in production), NetworkPolicies to restrict east-west traffic, Secrets management via External Secrets Operator with Vault or AWS Secrets Manager, OPA/Kyverno policies for admission control, and regular CIS Kubernetes Benchmark scanning. We also disable unused API server flags and rotate certificate authorities annually.