AWS offers two ways to run EKS on your own servers, and they are built in opposite ways. With EKS Anywhere, the entire cluster runs in your data center, including the control plane, etcd, and a management cluster, and your team operates all of it. With EKS Hybrid Nodes, the control plane stays in an AWS Region and is managed by AWS, while your servers join it as worker nodes over a private connection. A third option, managed hybrid Kubernetes such as Cloudfleet, keeps the managed control plane of Hybrid Nodes but drops the dependency on one cloud and on a private network link.
This post compares the three on architecture, networking, operations, and price.
At a glance
| EKS Anywhere | EKS Hybrid Nodes | Cloudfleet | |
|---|---|---|---|
| Control plane | On your infrastructure, operated by you | In an AWS Region, managed by AWS | Managed by Cloudfleet |
| Where nodes run | vSphere, bare metal, Nutanix, or AWS Snow, one provider per cluster | Your physical or virtual machines, not cloud instances | Any cloud and any Linux server, in the same cluster |
| Connection to the cloud | Optional, runs air-gapped | Private connectivity required: Site-to-Site VPN, Direct Connect, or your own VPN | Outbound internet access, works behind NAT |
| Disconnected sites | Supported | Not a fit, according to AWS | Pods keep running, changes resume on reconnect |
| Operating system | Ubuntu and RHEL, plus Bottlerocket on vSphere | Bottlerocket (vSphere only), Amazon Linux 2023 (VMs only), Ubuntu, RHEL | Ubuntu, Debian, and the RHEL family |
| Pricing | Free software, $24,000 per cluster a year for support, plus AWS Enterprise Support | $0.10 per cluster hour plus $0.006 to $0.020 per vCPU hour | Flat monthly fee plus €4.95 per vCPU a month above the included vCPUs |
EKS Anywhere: the whole cluster on your hardware
EKS Anywhere is AWS’s open-source tooling for running EKS Distro, AWS’s Kubernetes distribution, on your own infrastructure. It supports VMware vSphere, bare metal, Nutanix, and AWS Snow devices, with Docker for development. Clusters are created and upgraded from a management cluster that runs on the same provider as the workload clusters it manages, and each cluster runs on exactly one provider.
Because nothing depends on AWS at runtime, EKS Anywhere can run without a connection to AWS and in air-gapped environments. That is its main strength. The cost is operational: in AWS’s own words, you are responsible for cluster lifecycle operations and maintenance. That covers the management cluster, every control plane and its etcd, upgrades, certificates, the operating system images, and on bare metal, the provisioning stack and spare servers for rolling upgrades.
The software is free to use. Production support comes from an EKS Anywhere Enterprise Subscription, which also includes curated packages and extended Kubernetes version support. It costs $24,000 per cluster a year on a one-year term, or $18,000 a year on a three-year term, regardless of cluster size. It also requires an AWS Enterprise Support plan, which starts at $5,000 a month. Three clusters on one-year terms therefore cost at least $132,000 a year before any hardware: $72,000 in subscriptions and $60,000 in Enterprise Support.
EKS Hybrid Nodes: your servers, AWS’s control plane
EKS Hybrid Nodes turns on-premises servers into nodes of a regular EKS cluster. AWS runs the control plane in a Region, and most EKS features work with the hybrid nodes, including add-ons, Pod Identity, access entries, and extended version support. A single cluster can mix hybrid nodes with EC2 nodes, so you can burst from your data center to AWS.
The networking is where most of the setup effort goes. The EKS control plane reaches your nodes through the VPC you choose at cluster creation, so you need private connectivity between your data center and that VPC, through Site-to-Site VPN, Direct Connect, or your own VPN. Your node and Pod networks must use RFC 1918 or CGNAT ranges and must not overlap with the VPC or service ranges. The node network must be routable in both directions: the VPC route table points at your transit or virtual private gateway, your on-premises router routes the node CIDRs, and your firewall allows the control plane to reach the kubelet on every node. AWS recommends making the Pod CIDRs routable too. Without it, webhooks have to run on cloud nodes, Pods on cloud nodes and AWS load balancers cannot reach Pods on your servers directly, and the CNI must NAT Pod traffic that leaves your hosts. AWS recommends at least 100 Mbps and at most 200 ms round trip to the Region.
Each node runs nodeadm, the Hybrid Nodes CLI, and authenticates with temporary IAM credentials from AWS Systems Manager hybrid activations or IAM Roles Anywhere. You provision the machines and manage their operating system. AWS also states two limits worth knowing early. Hybrid Nodes is not a fit for disconnected, intermittent, or limited networks, and AWS recommends EKS Anywhere there instead. And hybrid nodes are not supported on cloud infrastructure, neither in AWS nor in other clouds.
Disconnections also have a credential side. Systems Manager credentials are valid for one hour and cannot be extended, and after a long outage their refresh can take up to 30 minutes, so nodes rejoin the cluster at different times. IAM Roles Anywhere credentials last up to 12 hours and refresh within seconds of reconnecting. For the Kubernetes side of a disconnect, see what happens when the control plane connection drops.
Hybrid Nodes pricing is usage-based. On top of the EKS cluster fee of $0.10 per hour, hybrid nodes cost $0.020 per vCPU hour for the first 576,000 vCPU hours a month, falling in tiers to $0.006 at very large scale. Kubernetes-reported vCPUs count, so a bare-metal core with hyperthreading counts as two. A 160 vCPU on-premises cluster running all month comes to about 116,800 vCPU hours, or roughly $2,400 a month including the cluster fee, before the VPN or Direct Connect bill.
Managed hybrid Kubernetes without a private link
Cloudfleet takes the same basic idea as Hybrid Nodes, a managed control plane with your servers as nodes, and removes the constraints around it. Servers join as self-managed nodes with one command and only outbound connections. They work behind NAT, need no public IP address, no inbound firewall rules, and no VPN or Direct Connect. Node-to-node and control plane traffic runs over an encrypted WireGuard® overlay that Cloudfleet sets up.
The same cluster can also include nodes on AWS, Google Cloud, Azure, Hetzner, and other providers, which node auto-provisioning adds and removes as workloads need them. Your on-premises servers can be bare metal, VMware vSphere, or Proxmox VE virtual machines, which EKS Anywhere does not support as a provider. If a site loses its uplink, its Pods keep running, and the cluster resumes changes when the link returns.
Pricing is a flat monthly fee with included vCPUs, plus a per-vCPU rate above that. On the Pro plan, the 160 vCPU cluster above costs about €742 a month: €69 with 24 vCPUs included, plus €4.95 for each additional vCPU, with the control plane SLA and support included and no separate support plan to buy.
Which one fits
Choose EKS Anywhere when clusters must run fully disconnected or air-gapped, your organization standardizes on AWS, and you have a platform team to operate control planes and a management cluster at every location.
Choose EKS Hybrid Nodes when your on-premises servers sit next to an AWS Region with a reliable private link, you already run EKS, and you want on-premises nodes to use the same EKS add-ons and IAM integration.
Choose managed hybrid Kubernetes with Cloudfleet when you want a managed control plane without building a private network to one cloud, when your sites have ordinary internet connections, or when the same cluster should also span other clouds. The EKS Anywhere alternative page describes the migration support, and the Cloudfleet vs EKS Anywhere comparison goes feature by feature.
Frequently asked questions
How much does EKS Anywhere cost?
The software is free and open source. Production support needs an EKS Anywhere Enterprise Subscription at $24,000 per cluster a year on a one-year term, or $18,000 a year on a three-year term. The subscription requires an AWS Enterprise Support plan, which starts at $5,000 a month.
How much do EKS Hybrid Nodes cost?
$0.020 per vCPU hour for the first 576,000 vCPU hours a month in a Region, with lower tiers above that, plus the EKS cluster fee of $0.10 per hour. Billing starts when a node joins the cluster and stops when it is removed.
What is the difference between EKS Anywhere and EKS Hybrid Nodes?
EKS Anywhere runs the entire cluster, including the control plane, on your infrastructure, and your team operates it. EKS Hybrid Nodes keeps the control plane in an AWS Region and attaches your servers as worker nodes over a private connection.
Can EKS Hybrid Nodes run without a connection to AWS?
Not for long. Hybrid nodes need a reliable connection to the AWS Region, and AWS recommends EKS Anywhere for disconnected environments. Running Pods continue during short disconnections, but node credentials from Systems Manager expire after one hour without a refresh.
Does EKS Anywhere support Proxmox?
No. EKS Anywhere supports VMware vSphere, bare metal, Nutanix, and AWS Snow, plus Docker for development. Proxmox VE virtual machines can join a Cloudfleet cluster as self-managed nodes.
