Northflank Has Four Kubernetes Modes. Only One Puts You in the Driver's Seat

"Built on Kubernetes" sounds like one claim. At Northflank it's four, and they don't mean the same thing.

Northflank offers a Managed tier (its own multi-tenant clusters), BYOC (Bring Your Own Cloud — Northflank provisions a cluster inside your AWS/GCP/Azure/bare-metal account), BYOK (Bring Your Own Kubernetes — you import a cluster you already run), and a sales-gated forward-deployed Enterprise tier (Northflank's control plane runs in your VPC or datacenter, air-gapped). Here's the table that actually matters — not where the compute sits, but who's driving:

Three of the four rows have the same answer in the "who operates" column. Moving the compute into your account or your datacenter changes where Northflank's control plane runs — it doesn't change whose control plane it is. Only BYOK moves that line, and it only works because you already crossed it yourself.

Three Tiers, One Operator​

Start with Managed, the default: Northflank's own multi-tenant infrastructure, billed per resource with no ambiguity about who's running it. Compute costs $0.01667 per vCPU-hour and $0.00833 per GB-hour, plus $0.06/GB egress and $0.15/GB/month for disk — Northflank's own published rate card. There's no ownership question here, and Northflank doesn't pretend otherwise.

BYOC is where the marketing starts doing more work. Northflank's own description: "Northflank provisions and manages Kubernetes clusters within your cloud environment, handling upgrades, scaling, and maintenance." A separate Northflank post is more precise about the split: Northflank "manages the control plane: orchestration, scheduling, CI/CD pipelines, secrets management, and the developer-facing UI and API," while the customer "owns the cloud account and data residency." That's a real and useful boundary — your data never leaves your VPC, and BYOC workloads can draw down existing AWS/GCP/Azure committed-spend agreements — but it's a data-residency boundary, not an operational one. You hold the AWS bill. Northflank still runs kubectl against the cluster living inside it.

Forward-deployed Enterprise pushes the compute even further into your control — literally your own datacenter, "zero egress with air-gap support for classified workloads" — without changing the operator. It's still Northflank's control-plane software, just installed somewhere with no outbound network path. That's a meaningful security property for a regulated buyer, and it's genuinely different from BYOC. But it answers a different question than "who operates this," and conflating the two would be the same mistake in reverse: hosting location and operator identity are separate axes, and this tier only moves the first one.

BYOK is the exception, and Northflank's own docs state it plainly: "you manage cluster lifecycle, Northflank handles application deployment and operations." Import a cluster you already run — on CAPH, kOps, EKS, whatever — and Northflank sits on top purely as a deploy layer. This is the one mode where the sentence "I own my Kubernetes cluster" and "I use Northflank" are both true at the same time.

What the Convenience Costs — and What's Missing to Know the Rest​

Take a single node spec — 16 vCPU, 64GB RAM — and price it three ways using each vendor's own published numbers.

That's a real, sourced number — and it's honest to say exactly what it measures: the premium for Northflank's fully-hands-off Managed tier over renting or owning the equivalent hardware yourself. It is not a stand-in for what BYOC or BYOK actually cost. Northflank states BYOC/BYOK bill your cloud infrastructure "at list price with no markup," which is a genuine advantage for a team already sitting on AWS or GCP committed-use spend. But on top of that pass-through cost sits a platform fee that Northflank does not publish — every source on this checks out to "contact sales." That's not a gap I'm filling in with a guess; it's the actual state of Northflank's public pricing today. A team evaluating BYOC or BYOK against a self-hosted Cluster API fleet cannot get an apples-to-apples number without a sales call, and any post that pretends otherwise is making the number up.

Is BYOK a Strawman Nobody Actually Runs?​

Fair question — if almost nobody uses the one mode where you keep the control plane, the four-tier table is academic. Northflank doesn't publish a customer split between Managed, BYOC, and BYOK, and no third-party source has that number either, so there's no percentage to cite here.

What the documentation does show is which path is the default. Managed and BYOC are self-serve, on every plan including free, with a published rate card — zero prerequisites beyond a credit card or a cloud account. BYOK's own requirements page recommends bringing "a new, dedicated cluster" rather than reusing a shared one, and lists specific pre-installed components a cluster has to already have before Northflank will import it. That's not nothing — BYOK demands you've already stood up and operated a working cluster before Northflank becomes relevant to it at all. It's a real mode, used by teams that already run Kubernetes elsewhere and want an app layer on top of it. It's just not the path Northflank is optimized to sell you into, and the prerequisite gap between it and the two self-serve tiers is itself part of the point.

What Owning the Control Plane Actually Buys You​

Here's the catch BYOK doesn't remove: it doesn't lower the bar to owning a cluster, it charges a fee for what comes after you've already cleared it. Someone still has to stand up that Kubernetes cluster — decide on a provider, wire up node provisioning, handle upgrades — before Northflank's BYOK path even applies. Northflank's app-platform layer attaches after that work is done; it doesn't do it for you.

Cluster API Provider Hetzner (CAPH) takes the opposite default. A Cluster and MachineDeployment custom resource, reconciled by controllers that "react to every change in your infrastructure, identifying and resolving issues without human intervention," is the ownership story from day one — not a fourth tier reached by first building a cluster the hard way and then paying to attach a UI to it. A CAPH-based git-push PaaS like bex runs on exactly this pattern: the control plane is the same open-source Cluster API tooling operating the fleet, on machines the team's own account pays for directly, with no separate per-vCPU platform fee layered on top of the hardware bill. There's no "graduate to BYOK" moment, because there's no earlier tier to graduate from.

The Walk-Away Test​

The TODO brief for this post asked what happens when a team wants to walk away — a fair test to actually run, tier by tier:

• Managed: total loss. Nothing running was ever yours to keep.
• BYOC: you keep the cloud account and the VMs, but Northflank provisioned and configured the cluster running on them. Reconstructing that configuration well enough to keep operating it solo isn't something any public Northflank documentation walks through — that's an absence of published guidance, not proof no handoff path exists, but it's not a one-click export either.
• Forward-deployed Enterprise: the same operator problem as BYOC, just running on hardware you already physically control.
• BYOK: the cleanest exit of the four, because you were always the operator — removing Northflank's agents leaves you exactly where you started, running the cluster you already knew how to run.
• CAPH/Cluster API: the question doesn't apply. Operatorship was never handed to anyone else. The Cluster and MachineDeployment resources keep reconciling against Hetzner's API whether or not any vendor's dashboard is open that day.

The Honest Bottom Line​

None of this makes Northflank's BYOC and forward-deployed tiers a bad product — for a team that doesn't want to hire or build a platform practice, "Northflank operates the control plane, wherever it physically runs" is a legitimate trade, and "no markup on cloud spend" is a real advantage a single-cloud-hardware fleet doesn't try to match. Bex isn't a multi-cloud abstraction layer and doesn't pretend to be one.

But the title's claim holds, with more precision than a blanket "Northflank's clusters aren't yours" would give it: hosting location and operator identity are different axes, and three of Northflank's four modes only move the first one. The fourth, BYOK, requires you to have already built what a CAPH-based fleet gives you by default — then charges an unpublished fee to layer a deploy UI on top of it.

Bex.co is the open-source, AI-native Render alternative — push a git repo, get a running HTTPS service on machines you own, operated by the same Cluster API primitives from day one, no fourth tier required. Star the repo on GitHub or deploy your first app today.

Sources​

• Bring Your Own Cloud — Features — Northflank
• What is BYOC (Bring Your Own Cloud) in cloud computing? — Northflank
• Best options for BYOC in cloud computing in 2026 — Northflank
• BYOC and BYOK requirements — Northflank docs
• Manage your cluster — Bring Your Own Cloud — Northflank docs
• Northflank Enterprise — deploy in your own VPC
• Pricing on Northflank — Billing docs
• Northflank Pricing
• AI Sandbox pricing comparison (2026) — Northflank
• Cluster API Provider Hetzner — GitHub (syself)
• What is the Cluster API Provider Hetzner — CAPH docs
• Euro US Dollar Exchange Rate — Trading Economics