Luca BertonKubernetes Costs Are Out of Control — And Compliance Makes It Harder
The average enterprise wastes 30-40% of its Kubernetes spend on over-provisioned resources. But in regulated environments, the obvious fix — "just right-size everything" — collides with compliance requirements: high availability mandates, burst capacity for audits, dedicated node pools for data classification, and the overhead of security tooling that runs on every node.
FinOps for regulated Kubernetes isn't just about cutting costs. It's about spending deliberately — knowing exactly where every euro goes, why it's there, and what compliance requirement justifies it.
The Regulated Kubernetes Cost Problem
Why Regulated Environments Overspend
- HA requirements: DORA and NIS2 mandate high availability. This means multi-AZ deployments, minimum replica counts, and anti-affinity rules — all increasing base cost.
- Dedicated node pools: Data classification requirements often mandate separate node pools for PII workloads, preventing efficient bin-packing across the cluster.
- Security overhead: Service mesh (Istio/Cilium), runtime security (Falco), log collection, and policy agents consume 15-25% of cluster capacity just for compliance tooling.
- Audit burst capacity: Regulated enterprises maintain excess capacity for audit periods when reporting jobs, evidence generation, and additional monitoring spike resource usage.
- Fear of under-provisioning: In regulated environments, an outage isn't just a business problem — it's a compliance finding. Teams over-provision as insurance.
Right-Sizing Without Compliance Risk
Safe Right-Sizing Approach
- Observe before acting: Run Vertical Pod Autoscaler (VPA) in recommendation mode for 2 weeks minimum. Collect P95 and P99 usage data — not averages.
- Set requests to P95, limits to P99+20%: For regulated workloads, use P95 (not P50) as your baseline. The 20% headroom on limits covers the "audit burst" without wasting resources.
- Separate critical from best-effort: Not all workloads in a regulated cluster are equally critical. Batch jobs, dev environments, and internal tools can use lower QoS classes.
- Implement Guaranteed QoS for compliance workloads: Set requests=limits for anything that must never be evicted (payment processing, audit logging, security monitoring).
- Use LimitRanges and ResourceQuotas: Prevent teams from requesting 64GB RAM for a service that uses 2GB. Enforce sensible defaults at the namespace level.
Kubernetes Recipes
A practical guide for container orchestration and deployment by Grzegorz Stencel & Luca Berton (Apress).
Watch on Skillshare →Cluster Autoscaling Strategy
Multi-Tier Node Strategy
- Tier 1 — Reserved/committed (60-70% of base): On-demand instances covered by savings plans or reserved instances. These run your always-on regulated workloads. 1 or 3-year commits for maximum discount (40-60% off).
- Tier 2 — On-demand burst (20-30%): Standard on-demand instances for predictable scaling (business hours, batch processing windows). No commitment, but full price.
- Tier 3 — Spot/preemptible (10-20% for non-critical): Development environments, CI/CD runners, non-customer-facing batch jobs. 60-90% discount but can be interrupted. NEVER for compliance-critical workloads.
Key rule: Anything in your DORA scope runs on Tier 1 or Tier 2 only. Spot instances for critical financial services workloads is a compliance finding waiting to happen.
Cost Allocation & Chargeback
Showback Before Chargeback
- Phase 1 — Visibility (Month 1-3): Deploy Kubecost, OpenCost, or cloud-native cost tools. Tag every namespace with team, project, environment, and cost center. Generate weekly cost reports per team.
- Phase 2 — Showback (Month 3-6): Share costs with team leads. "Your team's Kubernetes spend was €12,400 this month, up 15% from last month." No charge, just awareness. This alone typically reduces waste by 15-20%.
- Phase 3 — Chargeback (Month 6+): Actual cost allocation to business unit budgets. Teams now have financial incentive to optimise. Include shared infrastructure costs (security tooling, ingress, monitoring) as a platform tax.
Compliance cost attribution: Tag compliance-specific resources (audit logging, security agents, HA overhead) separately. This makes it visible that 20-30% of Kubernetes spend is compliance cost — useful context for CFOs questioning cloud bills.
Operationalizing ML Models: MLOps for Scalable AI
Turn ML prototypes into robust, scalable systems using real-world tools. In collaboration with Starweaver.
Start on Coursera →Quick Wins (Immediate 20-30% Savings)
- Delete idle resources: Dev/staging environments running 24/7 when only needed during business hours. Scale to zero nights and weekends (saves 65% on non-prod).
- Right-size development clusters: Dev doesn't need HA. Single-AZ, smaller nodes, aggressive autoscaling down to 1 node.
- Storage cleanup: Persistent volumes from deleted pods, old snapshots, unused ConfigMaps. Storage costs are small per-unit but accumulate.
- Container image optimisation: Smaller images = faster pulls = less network cost = faster autoscaling. Use distroless or Alpine bases.
- Implement pod disruption budgets correctly: Allows the autoscaler to consolidate pods onto fewer nodes during low-traffic periods without violating HA requirements.