What network costs does Kubernetes add to a cloud bill?
Kubernetes on a hyperscaler adds four network line items on top of internet egress: traffic between availability zones, NAT gateway processing, one load balancer per LoadBalancer Service, and hourly charges for public IPv4 addresses. On AWS, data crossing zones costs USD 0.01 per GB in each direction and a NAT gateway charges USD 0.045 per GB processed. Same-zone routing, VPC endpoints and a shared ingress point remove most of it.
The four line items
AWS list prices as of November 2026:
| Line item | AWS price | What triggers it in Kubernetes |
|---|---|---|
| Cross-zone traffic | USD 0.01 per GB in each direction, so USD 0.02 per GB crossing a zone | Service traffic, database replication and load balancer hops between Pods in different zones |
| NAT gateway | USD 0.045 per hour and USD 0.045 per GB processed in US East (Ohio) | Pods in private subnets pulling images, calling cloud APIs or reaching the internet |
| Load balancers | Hourly charge plus capacity units per load balancer | Every Service of type LoadBalancer |
| Public IPv4 addresses | USD 0.005 per address per hour since February 1, 2024, about USD 3.65 per month | Nodes with public IPs, load balancers and NAT gateways |
Internet egress is billed on top and varies widely between providers; see what cloud egress fees are.
Cross-zone traffic
A highly available cluster spreads nodes and replicas across zones. By default, kube-proxy distributes Service traffic across all endpoints regardless of zone. With replicas spread evenly over three zones, about two of every three requests leave the caller’s zone, and each crossing is billed on both the sending and the receiving side. Chatty microservices, replicated databases and message brokers multiply this.
Providers price it differently:
| Provider | Traffic between zones in one region |
|---|---|
| AWS | USD 0.01 per GB in each direction |
| Google Cloud | USD 0.01 per GiB between zones of the same region |
| Azure | Not charged since May 2024 |
| Hetzner Cloud | Private network traffic is free |
Routing traffic within a zone
The Service field spec.trafficDistribution tells kube-proxy to prefer nearby endpoints and fall back to the rest when none are available. PreferSameZone keeps traffic in the caller’s zone, and PreferSameNode prefers an endpoint on the same node first. PreferClose is the older, deprecated name for PreferSameZone. Traffic distribution reached general availability in Kubernetes 1.33, according to the Amazon EKS best practices guide.
The trade-off is load balance. If most traffic starts in one zone, the endpoints in that zone take most of the load. Spread replicas evenly with topology spread constraints, or run one Deployment and autoscaler per zone for heavily skewed traffic.
For stateful systems, check whether the database or broker supports zone-aware reads, such as reading from a replica in the same zone, since that traffic bypasses Services.
NAT gateways
Pods in private subnets reach the internet and many cloud APIs through a NAT gateway, which charges per GB on top of any transfer cost. Three changes cut it:
- One NAT gateway per zone. A single shared NAT gateway adds cross-zone charges for traffic from the other zones. AWS recommends one per zone, which costs extra hourly fees but removes the cross-zone hop.
- Gateway endpoints for object storage. AWS gateway VPC endpoints for S3 and DynamoDB carry no hourly or data charge, so that traffic skips the NAT gateway.
- Registries in the same region. Image pulls through a NAT gateway are billed per GB. A registry or mirror in the same region, reached through a private endpoint, avoids it.
Load balancers
On a hyperscaler, each Service of type LoadBalancer provisions its own cloud load balancer with its own hourly fee. Ten public services means ten load balancers. A single Ingress or Gateway API controller behind one load balancer serves all of them by host name or path.
How the load balancer reaches Pods also matters. In instance mode, traffic lands on any node’s NodePort and kube-proxy forwards it, often to a node in another zone. In IP mode, the load balancer sends traffic straight to Pod IPs, which AWS documents as avoiding that cross-zone hop. externalTrafficPolicy: Local has a similar effect for NodePort-based setups.
Public IPv4 addresses
Every public IPv4 address on AWS is billed hourly, whether it is in use or not. Nodes in public subnets, each load balancer and each NAT gateway carry at least one. Put nodes in private subnets, share load balancers, and route outbound traffic through a small number of NAT gateways or an egress gateway when external systems need a fixed source IP.
Measuring it
Cloud bills report data transfer per account or per resource, not per Kubernetes Service. To see which workloads drive it, use flow logs or a CNI with flow visibility to attribute traffic to Pods and zones, then compare before and after each change. How to reduce Kubernetes costs puts network costs in context with compute and storage.
How Cloudfleet handles it
In Cloudfleet Kubernetes Engine (CFKE), Pod-to-Pod traffic uses locality load balancing to reach the nearest target Pod where it can, and node auto-provisioning respects affinity rules that co-locate services which talk to each other. Load balancing explains how external traffic policies affect the number of load balancers.