For SMB teams, the Kubernetes decision is less about ideology and more about operational fit. Both managed and self-hosted Kubernetes run the same workloads. The difference is who manages the control plane, who handles upgrades, and who responds when etcd runs out of disk space at 2 AM. According to the CNCF 2025 survey, 73% of organizations using Kubernetes in production use a managed service, and the percentage is even higher for companies with fewer than 500 employees.
---
Understanding the Core Tradeoff
| Aspect | Managed Kubernetes | Self-Hosted Kubernetes |
| Control plane management | Provider handles | Your team handles |
| Kubernetes upgrades | Provider-managed, scheduled | Your team plans and executes |
| etcd operations | Fully abstracted | Your team backs up and monitors |
| Node management | Auto-scaling, auto-repair | Manual or custom automation |
| Networking | CNI pre-configured | CNI selection and configuration |
| Cost | Per-cluster fee + node costs | Node costs + engineering time |
| Customization | Limited to provider options | Full control |
| Multi-tenancy | Provider isolation model | Your isolation design |
Team-Size Guidance
2-5 Engineers, No Platform Team
Managed is almost always the right choice. At this team size, every hour spent on Kubernetes operations is an hour not spent on product development. A 4-person team spending 20 hours/month on cluster operations loses 25% of one engineer's capacity.
6-12 Engineers, Partial Platform Ownership
Managed still often wins unless the team has someone with genuine Kubernetes operational experience. At this size, you might assign 25-50% of one engineer's time to platform work, which is enough for managed Kubernetes operations but insufficient for self-hosted.
12+ with Dedicated Platform Depth
Self-hosted becomes viable when you have at least one full-time platform engineer with Kubernetes experience. Even at this size, managed is still the default recommendation unless you have specific requirements that the managed provider cannot satisfy.
Decision Rubric
Score each factor 1 (managed wins clearly) to 5 (self-hosted is viable):
Reliability
| Factor | Score 1 | Score 5 |
| Upgrade confidence | No K8s upgrade experience | Automated upgrade pipeline tested |
| DR readiness | No disaster recovery plan | DR tested quarterly with documented RTO |
| On-call sustainability | No on-call rotation | 24/7 rotation with K8s-trained engineers |
| Incident history | First K8s deployment | Years of K8s production experience |
Security
| Factor | Score 1 | Score 5 |
| Patch cadence | Cannot patch within 72 hours of CVE | Automated CVE scanning + patching |
| RBAC maturity | Basic cluster-admin for everyone | Fine-grained RBAC with audit logging |
| Network policy | No network segmentation | Zero-trust network with policy enforcement |
| Compliance needs | SOC 2 / HIPAA required | Internal-only, minimal compliance |
Cost
Managed Kubernetes TCO (typical SMB):
Cluster management fee: $70-200/month
Node costs (3x 4vCPU/16GB): $200-400/month
Load balancer: $20-50/month
Storage (100GB): $10-30/month
Engineering time (K8s ops): ~5 hours/month
Total: $300-680 + 5 eng hours
Self-Hosted Kubernetes TCO (typical SMB):
Node costs (3x 4vCPU/16GB): $150-350/month
Control plane nodes (3x): $100-200/month
Load balancer: $20-50/month
Storage (100GB): $10-30/month
Monitoring/tooling: $50-100/month
Engineering time (K8s ops): ~30-50 hours/month
Total: $330-730 + 30-50 eng hours
At $100/hour engineering cost, self-hosted adds $3,000-5,000/month in labor costs that managed eliminates.
Managed Kubernetes: What You Get
<h1>Example: Creating a managed K8s cluster</h1>
<h1>Provider handles control plane, etcd, API server, scheduler</h1>
<h1>You manage: node pools, workloads, networking config, RBAC</h1>
apiVersion: v1
kind: ConfigMap
metadata:
name: cluster-config
namespace: kube-system
data:
# Typical managed K8s responsibilities
provider_handles: |
- Control plane HA (3+ API servers)
- etcd backup and recovery
- Kubernetes version upgrades
- Control plane security patches
- API server certificate rotation
- Cloud controller manager
you_handle: |
- Node pool sizing and scaling
- Application deployments
- Ingress controller and configuration
- NetworkPolicies
- RBAC policies
- Monitoring and alerting
- CI/CD pipeline
- Disaster recovery for workloads
Self-Hosted: What You Take On
<h1>Self-hosted operational checklist (monthly)</h1>
<h1>1. etcd health and backup verification</h1>
etcdctl endpoint health --cluster
etcdctl snapshot save /backups/etcd/snapshot-$(date +%Y%m%d).db
<h1>2. Certificate expiration check</h1>
kubeadm certs check-expiration
<h1>3. Node OS patching</h1>
for node in $(kubectl get nodes -o jsonpath='{.items[*].metadata.name}'); do
echo "Patching $node..."
kubectl drain $node --ignore-daemonsets --delete-emptydir-data
ssh $node "sudo apt update && sudo apt upgrade -y && sudo reboot"
# Wait for node to rejoin
kubectl uncordon $node
done
<h1>4. Kubernetes version upgrade planning</h1>
kubectl version --short
kubeadm upgrade plan
<h1>5. Storage health check</h1>
kubectl get pv --sort-by=.status.phase
kubectl get pvc -A | grep -v Bound
<h1>6. Monitoring review</h1>
<h1>API server latency, etcd latency, scheduler queue depth</h1>
<h1>Node resource utilization, pod eviction rate</h1>
Migration Path: Self-Hosted to Managed
If you are running self-hosted and want to migrate to managed:
| Step | Action | Risk | Duration |
| 1 | Export all manifests | None | 1 day |
| 2 | Create managed cluster | None | 1 hour |
| 3 | Deploy workloads to managed | Low | 1-2 days |
| 4 | Migrate persistent data | Medium | 1-2 days |
| 5 | Switch DNS/traffic | Low (reversible) | Minutes |
| 6 | Monitor and validate | Low | 1 week |
| 7 | Decommission old cluster | None | 1 day |
Review deployment tooling on the DevOps Tools page. Compare options on the Services Overview page. Discuss your team profile via Contact.
Frequently Asked Questions
Is managed Kubernetes more expensive than self-hosted?
In infrastructure cost alone, managed is slightly more expensive ($70-200/month for the control plane fee). In total cost of ownership including engineering time, managed is almost always cheaper for SMB teams. The 30-50 hours/month of engineering time saved on cluster operations typically costs $3,000-5,000/month at market rates.
Can I customize the control plane with managed Kubernetes?
Limited. Most managed providers let you configure API server flags, admission controllers, and OIDC integration. You cannot modify etcd configuration, scheduler policies, or run custom control plane components. If you need deep control plane customization, self-hosted is required.
How do I handle Kubernetes upgrades with a managed provider?
Managed providers release new Kubernetes versions 2-4 weeks after the upstream release. You schedule the upgrade during a maintenance window. The provider upgrades the control plane first (usually zero-downtime), then you upgrade node pools. Most providers support automatic node pool upgrades with configurable surge/drain settings.
What if my managed Kubernetes provider has an outage?
Managed Kubernetes outages affecting the control plane are rare but do occur. During a control plane outage, running workloads continue to operate (pods keep running), but you cannot deploy changes, scale, or modify configurations. For critical applications, maintain the ability to apply kubectl commands from a backup kubeconfig or have a secondary cluster in a different region.
When should I migrate from managed to self-hosted?
Almost never for SMBs. The cases where self-hosted makes sense are: bare-metal requirements for performance or compliance, edge deployments where managed providers do not operate, or extreme scale where managed pricing becomes disproportionate. If your managed Kubernetes bill exceeds $50,000/month and you have a 3+ person platform team, self-hosted may reduce costs.
Final Takeaway
For SMB teams, managed Kubernetes is the default recommendation. It trades a small monthly fee for dramatically reduced operational complexity, faster recovery from failures, and more engineering time for product development. Evaluate self-hosted only when you have dedicated platform engineers and specific requirements that managed providers cannot meet.