Kubernetes consulting that starts with whether you need it

Kubernetes in 2026: a practical guide for buyers

This guide is for CTOs and operations leads weighing up Kubernetes, inheriting clusters, or wondering why the bill keeps rising. Versions, dates and prices are as of October 2026.

Do you even need Kubernetes?

Our rule of thumb: under about ten services, one team and one cloud, start with a managed container service and revisit when the pain is real. Moving containers from Fargate or Cloud Run to Kubernetes later is far easier than running a cluster you did not need.

Cluster design decisions that are hard to undo

• How many clusters. One per environment is the usual answer; one per team multiplies upgrade work.
• IP address planning. On EKS, pods take addresses from your VPC, and running out of them is a painful mid-life surprise.
• Ingress. The community Ingress NGINX controller has been retired: best-effort maintenance ended in March 2026, with no further releases or security fixes. New clusters should use Gateway API.
• Workload identity. Pods should get cloud permissions through EKS Pod Identity, AKS Workload Identity or GKE Workload Identity, never through node roles or static keys.
• State. Keep databases on managed services unless you have a strong reason and the people to run them.

The upgrade calendar, and what extended support costs

Kubernetes ships a new minor version roughly every four months, and the project maintains the latest three for about a year each (kubernetes.io/releases). Managed services add their own windows on top.

On EKS, standard support lasts 14 months and costs 0.10 US dollars per cluster per hour; the following 12 months of extended support cost 0.60 dollars per cluster per hour (AWS pricing). That is roughly 73 versus 438 dollars a month per cluster before a single node, and extended support is switched on by default, so clusters that fall behind start costing six times as much without anyone deciding it. When extended support ends, AWS upgrades the control plane automatically, but not your node groups or add-ons. Clusters still on 1.31 reach that point on 26 November 2026.

On AKS, a version gets about a year of community support, and a second year of long-term support if the cluster moves to the Premium tier. From 1 June 2027 AKS will automatically upgrade clusters left on unsupported versions, and those upgrades do not follow your maintenance window. GKE’s Extended channel allows up to 24 months on a minor version, with pay-per-use fees during the extended period. Whichever cloud you use, one planned upgrade every four to six months is cheaper than any of these safety nets.

Autoscaling: Karpenter, HPA and KEDA

Three layers work together. The Horizontal Pod Autoscaler adds pods when CPU, memory or a custom metric rises. KEDA scales on events such as queue depth, including down to zero. Karpenter, or the cloud’s node auto-provisioning, adds and removes nodes to fit the pods, choosing instance types and spot capacity as it goes. The common failures: pods without resource requests, which make every autoscaler guess; HPA and the Vertical Pod Autoscaler acting on the same metric; spot capacity without Pod Disruption Budgets; and aggressive node consolidation that restarts workloads all day.

Cost work

Most Kubernetes waste comes from a short list: requests set far above real usage, idle or oversized nodes, system node pools sized for peak, high log and metrics volume, cross-zone traffic, a load balancer per service, and extended-support fees. Our Kubernetes cost control guide goes through each. The order matters: make cost visible per namespace and team first, then rightsize, then autoscale, and only then buy commitments.

Security baseline

• Pod Security Admission, built into Kubernetes, enforcing the baseline profile everywhere and restricted wherever workloads allow.
• Network policies with a default deny, enforced by a CNI that supports them, such as Cilium.
• Image signing with Sigstore cosign in CI, verified at admission by Kyverno or a similar policy engine, so only images your pipeline built can run.
• Least-privilege RBAC, no shared cluster-admin accounts, and audit logs shipped somewhere attackers cannot delete them.
• A patch rhythm for nodes, add-ons and base images, not just the control plane.

For the wider programme of policies and evidence, see security and compliance.

GitOps: Argo CD or Flux?

Both are mature CNCF projects that keep a cluster in line with what is in Git. Argo CD 3 has a strong web interface and suits organisations where many teams want to see and sync their own applications. Flux 2 is lighter, driven by Kubernetes resources and the command line, and suits platform teams who prefer composable controllers. Either is better than kubectl from laptops; pick one and use it everywhere.

Terraform or OpenTofu?

In August 2023 HashiCorp moved Terraform from the open-source MPL 2.0 licence to the Business Source License 1.1 for future releases. OpenTofu forked from the last open-source version, is developed under the Linux Foundation with an MPL 2.0 licence, and became a CNCF sandbox project in April 2025. For most companies using Terraform internally, the change has little day-to-day effect; it matters more if you build products on top of the tool or care about vendor independence. As Terraform consulting work, we write modules that run on both where practical, keep state remote and locked, and review every plan before it is applied.

Observability

A cluster without good metrics, logs and traces is guesswork during an incident. We wire in Prometheus-compatible metrics, structured logs and OpenTelemetry traces, then set alerts on symptoms users feel rather than every CPU spike. Watch the bill here too: telemetry volume is one of the fastest-growing costs on a busy cluster. Dashboards, SLOs and on-call design sit with our SRE and observability service.

What drives the cost of Kubernetes consulting

• The number of clusters, environments and clouds.
• Whether infrastructure is already in code, or has to be reverse-engineered from the console.
• How far behind the versions are, and how many removed APIs are still in use.
• Stateful workloads, which need more careful migration and backup testing.
• Compliance scope: ISO 27001, SOC 2, HIPAA or DPDP evidence requirements.
• Ongoing operations. Round-the-clock support is available only to managed-service clients, under an agreed SLA.

We do not publish prices. Scope, milestones and price arrive together in a written proposal after a short discovery.

Common mistakes

• Adopting Kubernetes for three services because it looks like the grown-up choice.
• Letting clusters slide into paid extended support for want of an upgrade calendar.
• No resource requests, then wondering why autoscaling misbehaves.
• One giant cluster shared by production and testing.
• Secrets stored in plain ConfigMaps or committed to Git.
• Treating the control-plane upgrade as the whole job and forgetting nodes and add-ons.

How to choose a Kubernetes consulting company

• Ask whether they have ever advised a client not to use Kubernetes, and why.
• Ask for their upgrade process and how they find removed APIs before an upgrade.
• Check that everything they build will be code in your repositories and resources in your cloud accounts.
• Ask how they measure and allocate cost per team before cutting it.
• Confirm who answers at 3 a.m., under what SLA, and what it costs, before you need it.
• Be wary of anyone who promises a savings percentage before seeing your data.