Dora NodaThe proposal email was three lines long: four dedicated servers, €179 a month each, and a single box that out-specced the team's entire Kubernetes cluster. The CTO approved it in two hours. Migration started Monday.
That is the opening of an April 2026 migration writeup that has been passed around platform-engineering circles ever since: a team replaced its whole AWS Kubernetes setup with four Hetzner dedicated servers, watched the monthly bill fall from over $7,000 to about $780 — then catalogued everything the cheaper bill gave up. The cost-cut half of the story gets quoted everywhere. This post is about the second half: a line-by-line audit of what the $780 doesn't cover, what a self-hosted platform rebuilds declaratively, and the decision rule that falls out of it.
The numbers first: an 89% drop
Before any narrative, here is the whole before/after in one table:
| AWS (before) | Hetzner (after) | |
|---|---|---|
| Monthly infra bill | $7,000+ | ~$780 (4 × €179 ≈ €716) |
| Compute | EKS cluster, smaller in aggregate than one Hetzner box | 4 × Ryzen 9-class dedicated servers |
| Billing model | Metered: compute, transfer, requests, IOPS | Fixed per-server pricing, generous traffic included |
| Delta | — | −89% |
The arithmetic checks out: ($7,000 − $780) / $7,000 ≈ 89%. Four servers at €179 is €716 a month, roughly $780 at typical exchange rates. And the vivid detail — one €179 box carrying better specs than the entire cluster it replaced — is the kind of sentence that makes a CTO approve in two hours.
But a bill is not a total cost of ownership. To judge whether the 89% is real, you need two more things: where the $7,000 actually went, and what each disappearing line item bought besides raw compute. Take them in order.
Where the money actually went
The writeup's full bill breakdown sits behind a paywall, so let's decompose a typical managed-Kubernetes AWS bill of that size instead — the anatomy is remarkably consistent across teams:
- Managed control plane (~$73/month). EKS charges $0.10 an hour per cluster. Everyone quotes this number, and it is barely 1% of a $7,000 bill. The control plane was never the problem.
- Worker-node compute (the largest line). On-demand EC2 pricing for the node pool, usually over-provisioned for headroom and multi-AZ spreading. This is raw CPU/RAM marked up to cloud-retail rates.
- NAT gateways (~$33/month each, plus $0.045/GB processed). One per availability zone for high availability means roughly $100 a month before a single gigabyte flows — and the per-gigabyte processing fee is routinely the biggest hidden cost in an EKS bill. Private-subnet Kubernetes cannot reach the internet without them.
- Data transfer and egress. Metered per gigabyte, in every direction that matters, on top of the NAT processing fee already paid on the same bytes.
- EBS volumes, IOPS, and snapshots. Persistent volumes billed per GB-month, provisioned IOPS billed separately, snapshots billed again.
- Load balancers (ALB/NLB hours plus capacity units). Metered on uptime and throughput — a standing charge for every exposed service.
The pattern: maybe half the bill is compute, and the rest is networking and storage taxes that exist only because the infrastructure is rented by the meter rather than owned by the box. Hetzner's side of the ledger has no per-gigabyte NAT processing, no per-request load-balancer metering, no per-IOPS storage billing. That absence — not cheaper silicon alone — is where most of the 89% comes from.
A caveat worth stating plainly: Hetzner adjusted dedicated-server pricing on June 15, 2026, and providers reprice in both directions over time. Re-run the numbers at purchase time; the shape of the argument survives even if the exact percentages drift.
What €179 a month buys in 2026
The writeup's price tier puts each box in Ryzen 9 territory: 16 cores and 32 threads, 128 GB of DDR5, and terabytes of NVMe flash. Multiply by four and the $780 fleet is roughly 64 cores, half a terabyte of RAM, and on the order of 15 TB of NVMe — fixed, predictable, and paid whether the CPUs idle or burn.
That last clause cuts both ways, and honest accounting says so up front. Fixed pricing is a discount on steady load and a penalty on idle capacity: a box that sits at 5% utilization still costs €179. The writeup's team had steady-state Kubernetes workloads, which is exactly the shape dedicated hardware rewards. A workload that spikes 100× for an hour a day and idles otherwise would look very different on this math — more on that in the decision rule below.
Against that, the old cluster's aggregate capacity fit inside a single new box. When one side of a migration is cloud-retail VMs and the other is bare metal at Hetzner prices, the per-core gap is so wide that consolidation alone — fewer, denser nodes — pays for the move before any operational change does.
The honest audit: rebuilt declaratively vs genuinely lost
Now the part the title promised. Each managed service the AWS bill covered is a row below, graded on the axis that actually matters to a team running its own platform: what a Cluster-API-based self-hosted PaaS rebuilds declaratively, what it costs to own that rebuild, and what stays genuinely lost.
| What AWS provided | Rebuilt declaratively as | Cost of owning it | Genuinely lost |
|---|---|---|---|
| Managed control plane (EKS) | Self-managed control plane via Cluster API: declarative upgrades, machine rollouts, health-checked reconciliation | You run etcd quorum, API-server HA, and the upgrade runbook. Solved patterns, but real operational surface with monitoring and version-skew discipline | AWS's SLA on the API endpoint and zero-effort patching; compliance paperwork that reads "managed by AWS" |
| Managed load balancing (ALB/NLB) | Hetzner load balancers or in-cluster Gateway API / ingress, declared in Git; TLS via cert-manager | You own capacity planning and certificate rotation (both automated, neither zero) | Elastic scale past your own NICs; per-request billing granularity — you buy capacity, not requests |
| Managed backups and snapshots | Velero plus S3-compatible object storage (Backblaze B2 at ~$0.007/GB-month, Cloudflare R2, Hetzner Object Storage) | You own schedules, retention, encryption keys — and, critically, restore drills nobody runs for you | One-click point-in-time restore of managed datastores. If RDS was in the old bill, self-hosting Postgres means you now own failover, and that is the sharpest edge in this whole table |
| DDoS protection, WAF, edge caching | Cloudflare (or equivalent) in front of the fleet — the standard Hetzner-plus-Cloudflare-plus-object-storage stack | DNS and edge rules become your config to manage; the free tier covers a surprising amount | Nothing much — this layer was usually a third party on AWS too |
| Support and someone else's pager | Your own observability stack: metrics, logs, alerts, runbooks | Headcount and on-call rotation. This is the one line item no tooling zeroes out — price it explicitly | A vendor SLA with credits, and a support engineer to blame at 3am. The pager moves to your team |
Two rows deserve emphasis because they are where migrations actually fail.
Stateful data is the sharpest edge. Stateless services repatriate almost mechanically: same containers, cheaper floor. Databases do not. If the old $7,000 included RDS, ElastiCache, or any managed store with point-in-time recovery, the honest options are to operate the datastore yourself with a mature operator (and tested failover), or keep exactly that workload on a managed store and repatriate the rest. There is no shame in the second option — as the industry data below shows, it is what most teams do.
The pager is the real price. A January 2026 companion piece to the same story — "Here's the Catch", running the same Hetzner-plus-Cloudflare-plus-Backblaze stack — framed it the right way: the savings paid for the migration, the learning curve, and still left enough to hire a part-time DevOps person. That is the correct mental model. The 89% is gross margin; on-call is cost of goods sold.
The decision rule: the 89% is real if and only if you own the surface
Everything above compresses into one rule: the saving is real if and only if your platform already owns — or is willing to build and staff — the operational surface the managed bill was covering. Sensitivity-check it against your own shape:
- You already run Kubernetes well. The savings are mostly real. Migration cost is bounded, the audit table above is a checklist not a research project, and the payback period is measured in weeks.
- You have never operated Kubernetes. Year-one savings fund the learning curve and the first on-call rotation. Still often net positive, but do not promise anyone 89% on day one.
- Steady-state workloads. Dedicated boxes win by the widest margin. Predictable load is what fixed pricing rewards.
- Spiky or idle-to-zero workloads. Cloud elasticity still wins; do not repatriate the spiky part. Scale-to-zero and hundred-fold bursts are the workloads the meter was invented for.
- Egress-heavy workloads. Leaving AWS saves the most here, because transfer taxes were the largest hidden line. Price your current per-gigabyte egress before anything else.
- Deep managed-service entanglement. If the old bill is RDS plus queues plus functions plus a Step Functions mesh, the rewrite cost can exceed years of savings. Migrate the stateless edge first and measure.
The industry agrees with the "partial, not total" framing. Barclays and IDC survey data put 86% of CIOs repatriating at least some workloads in 2025, the highest rate yet — but only about 8% planning a full cloud exit (summary). Selective repatriation is the norm; total exits are the press release. The famous total exits are real — 37signals completed its AWS exit in May 2025 and projects over $10 million in savings across five years, and Dropbox's earlier move saved a reported $75 million over two years — but both had dedicated infrastructure teams absorbing the pager as a deliberate strategy, not as a surprise.
And say plainly when to stay: a tiny team with no appetite for platform work, a workload that truly needs minute-level elasticity, or a compliance regime where "managed by AWS" is load-bearing paperwork. The 89% is not a universal discount. It is the market price of operational surface, and you only collect it if you operate.
Conclusion: the bill drops 89%, the pager moves
A decade into the cloud, repatriation stories like this one read less like rebellion and more like maturation: teams learned which workloads genuinely need the meter and which were just paying it out of habit. The April writeup endures because it told both halves — the three-line proposal and the inventory of what the $780 doesn't include.
If there is a single artifact to take from this post, it is the audit table: run your own bill through it, price the "cost of owning it" column in engineer-hours and on-call rotations, and only then compare totals. Do that honestly and whatever number comes out — 89%, 40%, or "stay" — will be a number you can defend.
The deeper point is that owning the surface is exactly what a self-hosted platform is for: declarative machine lifecycle, Git-declared networking and TLS, scheduled and drilled backups — the whole audit table as code rather than as tickets. That is the bet: not that bare metal is cheap, but that the operational surface is ownable.
Bex.co is the open-source, AI-native Render alternative — push a git repo, get a running HTTPS service on machines you own. Star the repo on GitHub or deploy your first app today.
