Before choosing a managed Kubernetes provider, get a written answer to one question: which parts of your production platform will the provider operate, and which remain your responsibility? “Managed Kubernetes” describes a service boundary, not a blanket transfer of operational risk. Compare the boundary, service commitments, lifecycle work, support, network design, security obligations, and recovery capabilities—not just who runs the control plane.
What does “managed Kubernetes” actually cover?
A provider may operate the Kubernetes control plane without operating the rest of the platform your applications depend on. Nodes, operating systems, networking, identities, workloads, logs, persistent data, and recovery can remain partly or substantially customer-owned. The division varies by product, configuration, and contract, so do not infer a responsibility from the word “managed.”
As an Amazon Associate I earn from qualifying purchases.
For example, AWS describes EKS control-plane security as AWS’s responsibility while customers retain important duties involving the data plane, nodes, operating systems, network, identity, and applications. Microsoft puts the boundary plainly in its AKS security guidance: “Microsoft manages the Kubernetes control plane, while you’re responsible for securing the workloads, node configuration, networking, identity, and data in your clusters.” That statement is Microsoft’s guidance for AKS; it should not be treated as a universal description of every provider.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Ask for a responsibility matrix
Request a service-specific RACI or equivalent matrix, with an owner for each component and activity. It should cover at least the control plane and etcd, worker nodes and OS, container runtime, CNI and other networking, identity and secrets, image supply chain, workloads, logs, data, and compliance evidence. Clarify who performs each task, who approves it, and who is accountable when it fails.
#1 Best Overall
For each “provider-managed” item, ask what that means in practice: does the provider monitor it, patch it, make changes automatically, notify you, or only provide tooling? Record customer prerequisites and any configuration that changes the support boundary. The matrix should reflect the architecture you will actually deploy, not merely the service’s default setup.
What does the service commitment guarantee?
An SLA is a defined promise for a specified service component under stated conditions. It is not automatically a guarantee that your application, cluster workloads, dependencies, or complete user journey will be available. Identify the exact measured component and determine whether it matches the failure that matters to your business.
Amazon Web Services’ 2026 EKS SLA illustrates why the details matter. Its published monthly Kubernetes endpoint availability commitments differ by control-plane tier and measurement interval:
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minute| EKS tier | Published monthly endpoint commitment | Measurement interval | Important qualification |
|---|---|---|---|
| Standard Control Plane | 99.95% | Five-minute intervals | Subject to the EKS SLA’s eligibility terms, conditions, and exclusions. |
| Provisioned Control Plane | 99.99% | One-minute intervals | Subject to the EKS SLA’s eligibility terms, conditions, and exclusions. |
These are EKS endpoint commitments, not industry averages or application-availability figures. AWS’s SLA also defines service-credit tiers and excludes certain situations, including some customer actions or configurations and workload or software factors. Before relying on any SLA, read its current terms and establish what remedy is available, how to document an incident, and when a claim must be filed.
Put the SLA questions in the contract review
- Which component is measured: API endpoint, control plane, nodes, or another service element?
- What is the target and measurement interval, and how are outages or degraded periods counted?
- What exclusions apply, including customer configuration, dependencies, maintenance, or workload behavior?
- What remedy is available, what evidence is required, and what is the claim deadline?
- Are response and restoration commitments separate from availability credits?
Who owns upgrades and patching?
Lifecycle work is often shared. A provider may publish supported Kubernetes versions and end-of-support dates, while the customer decides when or how to move clusters and node pools. Treat version policy, control-plane upgrades, node image updates, and operating-system patching as separate activities in the responsibility matrix.
Microsoft’s AKS support policy documents this division: Microsoft provides supported versions and deprecation timelines, while customers choose an auto-upgrade channel or apply changes manually. Node image and OS patching also involve customer decisions. Confirm the current policy for your chosen configuration rather than assuming that selecting managed Kubernetes means every upgrade happens automatically.
Rank #3
Agree the lifecycle operating model
- Supported Kubernetes versions, end-of-support dates, and the time available to upgrade.
- Whether control-plane and node upgrades are automatic, customer-triggered, or separately managed.
- How maintenance windows, notifications, surge capacity, and workload disruption are handled.
- Who updates node images and operating systems, and how exceptions are tracked.
- What rollback options exist if an upgrade causes a problem, and which components those options cover.
Ask for a documented upgrade path and define an owner for scheduling, testing, approval, and post-change validation. A supported-version policy is not itself an upgrade operation performed on your schedule.
What support will you receive when something breaks?
“24/7 support” or a support-plan label is not enough to establish who will diagnose a Kubernetes incident. Determine which components, configurations, and third-party add-ons are in scope; how severity is defined; what response commitments apply in your contract; and how an incident moves from initial support to a specialist escalation.
AKS policy, for example, describes limits on support for some configurations and discusses service identity and consent for Microsoft or AKS actions. This makes permissions and intervention boundaries practical procurement questions: what can the provider inspect or change, under what authorization, and how is that access recorded? Ask the provider to identify unsupported or customer-managed networking configurations, add-ons, and dependencies relevant to your design.
How much networking do you still have to operate?
Kubernetes networking is part of the service architecture, not a detail that disappears when the control plane is managed. AWS documents EKS as using an AWS-managed control-plane VPC and a customer-managed VPC for nodes and related infrastructure. AWS also says operating EKS requires both AWS VPC and Kubernetes networking knowledge. That is an EKS-specific example, not a rule for every managed service.
Have the provider and your platform team walk through the intended traffic paths and operational owners. Cover private or public API access, ingress and egress, IP capacity, DNS, load balancing, firewall rules, CNI choice, and the location of network troubleshooting responsibility. Establish whether the provider supports the networking configuration you plan to run; on AKS, support scope can depend on choices such as customer-managed networking alternatives including BYOCNI.
Which security and compliance duties remain yours?
A provider’s protection of its infrastructure does not settle the security of your cluster or workloads. AWS and Microsoft both document customer responsibilities alongside provider-managed control-plane responsibilities. For procurement, translate those boundaries into controls and evidence your organization can verify.
Best Value
- Identity and access: establish who configures identity integration, least privilege, and access reviews.
- Secrets and data: confirm who configures encryption, access controls, retention, and protection for application and persistent data.
- Workloads and images: assign responsibility for workload isolation, image provenance, vulnerability handling, and deployment policy.
- Auditability: identify which control-plane and workload events are logged, who retains them, and how your teams can export and review them.
- Compliance evidence: validate that the exact service, region, and controls in scope meet your needs, and determine which evidence the provider supplies.
AWS cautions that compliance status can change and frames compliance as a shared responsibility. Check the current status and scope for the specific service and region, then map the provider’s evidence to your workload and contractual requirements. A general claim that a cloud provider is compliant does not by itself establish that your deployment satisfies a particular obligation.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Can you restore the service and its data when needed?
Distinguish provider-side backups from a customer-usable recovery process. A backup may exist for a provider’s disaster planning without being exposed as a restore feature you can invoke. Recovery also involves more than cluster metadata: determine how persistent application data, configuration, secrets, and dependencies are protected and reconstituted.
Microsoft’s current AKS support-policy page says etcd backups occur automatically every 30 minutes for disaster planning, but says those backups are not directly available and on-demand rollback or restore is not supported as a feature. The same policy’s responsibility matrix leaves cluster backup and disaster recovery with the customer. The 30-minute interval describes that AKS policy; it is not a customer recovery-point guarantee.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Require a recovery design you can exercise
- List the data and configuration in scope, and identify the backup owner and access method for each.
- Get explicit recovery-point and recovery-time objectives for your own service; do not infer them from a provider’s internal backup cadence.
- Define the restore or rebuild procedure, including dependencies outside Kubernetes and regional failover if required.
- Run a recovery exercise and retain evidence of what was restored, how long it took, and what failed.
How should you compare providers during procurement?
Use the same evidence request for each candidate, then compare what its current service policy, architecture documentation, and contract actually commit to. The questions below keep a provider comparison focused on operational ownership rather than marketing terminology.
| Evaluation area | Evidence to request | Why it matters |
|---|---|---|
| Service commitment | Measured component, target, interval, exclusions, remedy, evidence requirements, and claim deadline. | A control-plane endpoint commitment does not establish whole-workload availability. |
| Responsibility boundary | A component-by-component RACI covering control plane, etcd, nodes, OS, runtime, network, identity, secrets, images, workloads, logs, data, and compliance. | The word “managed” does not establish who operates or secures each component. |
| Lifecycle operations | Supported versions, end-of-support dates, upgrade controls, maintenance process, node-image updates, patching, and rollback behavior. | Version support and execution of changes may belong to different parties. |
| Support model | Supported configurations, component and add-on scope, severity definitions, contractual response commitments, escalation route, and intervention permissions. | Support can depend on the configuration and on whether the provider is authorized to act. |
| Network design | API access model, VPC or VNet layout, egress and ingress, IP capacity, load balancing, DNS, CNI options, firewall ownership, and incident support. | Network architecture and troubleshooting remain material operating concerns. |
| Security and compliance | Identity, secrets, logging, workload isolation, image controls, audit evidence, covered services and regions, and shared-control assignments. | Provider infrastructure controls do not discharge customer obligations, and scope must match the workload. |
| Resilience and recovery | Backup scope and access, restore method, persistent-data protection, recovery objectives, failover design, and exercise evidence. | A provider-side backup may not provide a customer-operated restore path. |
| Operability and exit | API and extension compatibility, infrastructure-as-code support, observability export, data migration, exit terms, and a tested rebuild procedure. | Kubernetes API compatibility alone does not prove that an estate can be moved or rebuilt without friction. |
What should your team have in hand before signing?
- A service-specific responsibility matrix with named owners for the control plane, nodes, network, identity, workloads, data, and recovery.
- The applicable service terms for availability, support, exclusions, remedies, claim process, supported versions, and deprecation timelines.
- An approved architecture that records network configuration, access boundaries, required integrations, and any configuration that affects support.
- A lifecycle runbook assigning upgrade, patch, test, approval, and validation tasks.
- A security and evidence map connecting customer controls and provider evidence to your organization’s compliance needs.
- A recovery runbook tested in an exercise with clear owners, recovery objectives, and evidence that the documented process works.
If a responsibility, service commitment, or recovery capability matters to your production risk, get it confirmed in the relevant policy, architecture documentation, support agreement, or contract. Evaluate competing providers on those written boundaries and on whether your team can operate what remains—not on the label alone.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
