One version pinned in Terraform meant our brand-new cluster paid AWS a 6x surcharge from day one
We're building Hinode (cloud GPU workstations) on EKS. Pre-launch, almost no traffic, so I expected our AWS cost audit to be boring. It wasn't.
The EKS line was ~$520/month for a cluster doing nothing. Five sixths of it came from a single meter: "extendedSupport".
If you run EKS: AWS charges $0.10/hr per cluster for the control plane. Once your Kubernetes version ages out of standard support, that jumps to $0.60/hr. Per cluster, regardless of size. An idle cluster pays the same surcharge as a 500-node one.
The part that made me feel dumb: our cluster was a month old. Terraform had cluster_version = "1.30" hardcoded, and 1.30 had aged out before we even provisioned. The cluster was born taxed. We paid 6x the base rate from the first hour, with zero customers on it.
A version pinned in IaC ages. Standard support lasts about 14 months per minor version. Pin it and forget it, and the calendar walks your cluster into the paid window while you're busy shipping. The only signal is a line item you have to go looking for.
Getting out meant upgrading a live control plane five hops, because EKS only allows one minor version at a time: 1.30 → 1.31 → 1.32 → 1.33 → 1.34 → 1.35. About 10 minutes per hop, plus rolling node groups and addons after each one.
Bonus gotcha from the same upgrade: updating the EBS CSI addon with the safe-sounding PRESERVE flag dropped the IAM role annotation off the driver's ServiceAccount. The old pod kept running, because credentials are injected at pod creation. So the cluster looked healthy right up until new pods came up with no way to authenticate and started crashlooping. The fix: pass --service-account-role-arn explicitly on every addon update, so the role binding gets re-asserted instead of quietly dropped.
Two things worth checking today:
Open Cost Explorer, group by usage type, search for "extendedSupport". If it's there, a forgotten pin is costing you $0.50/hr per cluster.
If any addon relies on IRSA, don't trust PRESERVE to keep your role annotation.
We run real GPUs so you don't babysit a control plane — spin one up → hinode.run
Replies