I'm comparing the cost of AWS Application Load Balancers and Network Load Balancers for Kubernetes. They seem expensive, especially when multiple services each end up with their own load balancer. One alternative I'm considering is running a hardened fleet of ingress-only nodes in public subnets, sending all external traffic to them, and relying on the proxy and ingress rules to route requests internally. Has anyone operated this setup in production? I'd especially appreciate advice about hardening, high availability, DDoS protection, patching, and the real cost trade-offs compared with managed AWS load balancers.
5 Answers
Cloudflare Tunnel is another architecture to evaluate. The cluster nodes make outbound connections to Cloudflare, so the application nodes do not need to be directly exposed to the internet. It can provide ingress routing and an additional protection layer, but review the limits, latency, traffic costs, and operational fit before depending on it for production.
Before replacing the managed service, check whether you can share one load balancer across multiple services. A single ALB or NLB can often handle multiple hostnames and routing rules, which avoids paying for a separate load balancer per ingress.
If you do use public ingress-only nodes, treat them as a separate security boundary: keep the node image minimal, expose only the required ports, restrict administrative access, use automated patching and immutable replacement, deploy across multiple availability zones, and put strong rate limits and monitoring in front of the proxies. The design can work, but it is effectively building and operating your own managed load-balancer layer.
The hourly charge usually isn’t the whole story. Look at Cost Explorer to see whether LCUs, processed bytes, or having too many separate ALBs is driving the bill. Public ingress nodes still cost money, but you also take on patching, health checks, multi-AZ failover, capacity planning, and incident response. An NLB in front of an NGINX, HAProxy, or similar fleet can be a reasonable middle ground, but fully rolling your own only tends to win when traffic volume is high enough to dominate the bill.
A basic NLB is often around a few dozen dollars per month before usage-based charges, though high traffic can increase the bill substantially. If the fixed cost is the issue, compare the total cost with an EC2 Auto Scaling Group running your ingress software. Also consider whether EKS itself is still economical for your workload; changing platforms may save more than replacing only the load balancer.
The main advantage of the managed option is that failover and a lot of the internet-facing operational work are handled for you. Make sure those responsibilities are included in the comparison, not just the instance price.