Skip to main content
On this page

​
Coverage by target cloud

​
How the backends compare

Each row compares a capability of ECS with its adaptation on each backend. A dash means this row is not stated for that backend.

​
Max adaptation

​
On Private Kubernetes

​
How it works

Your container image does not change. On AWS, a task definition describes the image and its sizing, and an ECS service keeps a desired number of copies running on Fargate behind a load balancer. When Tensor9 builds your release, it translates the task definition and service into Kubernetes objects on a cluster you already operate: a Deployment (a DaemonSet for the DAEMON strategy) and a Service. After deployment, clients reach your containers through the cluster’s load balancer or cluster DNS. Tensor9 does not proxy application traffic.
On AWS, your container image runs as an ECS service on Fargate behind an Application Load Balancer. After the move, the same image runs on a cluster you already operate as a Kubernetes Deployment or DaemonSet plus a Service, behind the cluster's load balancer. Tensor9 is not in the request path.On AWS, your container image runs as an ECS service on Fargate behind an Application Load Balancer. After the move, the same image runs on a cluster you already operate as a Kubernetes Deployment or DaemonSet plus a Service, behind the cluster's load balancer. Tensor9 is not in the request path.

Tensor9 translates your task definition and service before deployment; afterwards the cluster’s load balancer carries every request.

​
The task definition and service

Every container in the task definition becomes a container in one Kubernetes Pod, so a main container and its helper containers stay together. Tensor9 copies each image to your registry during the build. Fargate sizes a task from fixed CPU and memory combinations (0.25 to 16 vCPU); on the target cluster those values become Pod requests and limits, without the fixed combinations. The requested resources must fit node capacity, scheduling rules and quota. The service’s desired count becomes the Deployment’s replicas: the number of Pods Kubernetes keeps running, not a promise that they are all ready. Scale-to-zero is off unless you add it with KEDA or Knative. Application Auto Scaling becomes a HorizontalPodAutoscaler on CPU, memory or a custom metric. A rolling update uses the Deployment’s RollingUpdate settings, maxSurge and maxUnavailable. The DAEMON strategy becomes a DaemonSet (one Pod per node), and ECS Exec becomes kubectl exec into the Pod.
A task definition's containers, image and CPU and memory sizing become a Kubernetes Pod spec, and an ECS service's desired count becomes a Deployment's replica count. CPU and memory become Pod requests and limits. The DAEMON strategy becomes a DaemonSet, and ECS Exec becomes kubectl exec.A task definition's containers, image and CPU and memory sizing become a Kubernetes Pod spec, and an ECS service's desired count becomes a Deployment's replica count. CPU and memory become Pod requests and limits. The DAEMON strategy becomes a DaemonSet, and ECS Exec becomes kubectl exec.

The task definition becomes a Pod spec and the service becomes a Deployment with the same desired count.

​
Networking, discovery, and load balancing

In ECS awsvpc mode, each task has its own IP address and security group. On the target cluster, your CNI gives each Pod its own IP address, so Pods are individually addressable in the same way. A task’s security group becomes a NetworkPolicy that keeps the same isolation between workloads. Service discovery by name, through Cloud Map or DNS, becomes a Kubernetes Service with cluster DNS, the same name-based model. The service’s loadBalancer block (the ALB or NLB target group its tasks register with) becomes a Kubernetes Service of type LoadBalancer or ClusterIP, plus an Ingress for host and path routing. The target group’s health check becomes the Pod’s readiness probe. For supported routing rules, weights and certificates, see the Application Load Balancer and Network Load Balancer articles.

​
The cluster you operate

The Deployment and Service run on a cluster you already operate: kubeadm, k3s or kops, or a managed cluster you bring. This works on any target the appliance supports, including fully disconnected environments. For a self-operated cluster, you maintain the control plane and nodes, including the API server, etcd, upgrades and availability. For a managed cluster you bring, its provider keeps those responsibilities. An ECS capacity provider maps to your own node pools and cluster autoscaler, and a FARGATE_SPOT preference maps to your Spot node pools. The service needs an ingress controller for the Service and Ingress, a cluster autoscaler, a metrics or Prometheus stack, and the service mesh that replaces Service Connect’s proxy. On a self-operated cluster you install and run these; on a managed cluster, use the provider’s supported services. Confirm which components you operate and which your provider supplies.
The service runs on an existing cluster, self-operated or managed. Confirm who operates its control plane and nodes, and its ingress controller, cluster autoscaler, metrics stack and Gateway API or service mesh. In a disconnected environment, these must be available locally.The service runs on an existing cluster, self-operated or managed. Confirm who operates its control plane and nodes, and its ingress controller, cluster autoscaler, metrics stack and Gateway API or service mesh. In a disconnected environment, these must be available locally.

The service runs on your existing cluster; confirm who operates its control plane, nodes and add-ons.

​
Pod identity: the task role

An ECS task role is the identity your application code uses; EKS does the same with IRSA. On managed Kubernetes services it maps to the cloud’s workload identity; an existing cluster uses whatever identity integrations it already has. Inside the cluster, identity is a native Kubernetes ServiceAccount with RBAC, which you own: the ServiceAccount identifies the workload, and RBAC decides what it may do through the Kubernetes API. AWS calls handled by Tensor9 use the configured credential adapter and the task-role policy. The appliance answers as the task role, taken from the Pod’s identity, so aws sts get-caller-identity and iam:GetRole return the task’s own role. Calls to real external cloud services need credentials that cloud authorizes, through the cluster’s federation or secret configuration. The execution role, which ECS used to pull the image, fetch secrets and write logs, is not needed, because the cluster pulls images and delivers logs.
The ECS task role maps to a native Kubernetes ServiceAccount, with RBAC governing access to the cluster. AWS calls use the task role. Access to an external cloud uses credentials or federation you configure separately.The ECS task role maps to a native Kubernetes ServiceAccount, with RBAC governing access to the cluster. AWS calls use the task role. Access to an external cloud uses credentials or federation you configure separately.

Cluster permissions, AWS calls and external-cloud credentials are configured separately.

​
AWS request authorization

For supported AWS API calls, Tensor9 checks the task role’s IAM policy against the verified caller, action and resource; a denial overrides an allowance. Tensor9 prepares the policy rules during the build, including supported action and resource wildcards, and policy updates reach the appliance with an integrity check. See AWS request authorization for details. Native permissions for external cloud services are granted separately, with credentials or federation that provider authorizes. Kubernetes RBAC governs the cluster API on its own, and the AWS policy check runs inside the appliance without a cloud IAM service.

​
Secrets and logging

Container environment variables are set as they are. Container secrets entries are not supported: if a container passes secrets through valueFrom, deployment stops with an error that names the service and each variable, rather than starting the container without them. On this target, Parameter Store values live in Kubernetes Secrets, often managed through the External Secrets Operator. The awslogs log driver becomes the cluster’s own log stack, which collects stdout and stderr automatically. A custom FireLens log router can still run as a helper container; configure its destination and credentials for your environment’s logging service.

​
Limitations

  • Container secrets are not supported. A container secrets entry (valueFrom) stops the deployment with an error naming the service and the variable, rather than starting the container without it.
  • ECS Service Connect is only partly supported. A Kubernetes Service provides name-based discovery, but Service Connect’s injected proxy and its built-in metrics need a service mesh you add, such as Istio or Linkerd. You run that mesh.
  • You must add tooling for weighted blue-green or canary releases. A plain rolling update works natively; a weighted traffic split uses Gateway API, Argo Rollouts or Flagger.
  • Capacity providers and Fargate Spot behave differently: your node pools provide capacity. A capacity-provider strategy maps to your node pools, and a Spot preference maps to your Spot node pools.
  • You must configure each credential path. Kubernetes RBAC governs cluster access. AWS adapters use the task role; real external services need credentials or federation their provider authorizes.
  • The task metadata endpoint is read-only. Your code reaches the ECS task metadata API through ECS_CONTAINER_METADATA_URI_V4, as on ECS. Other AWS calls go to the matching Tensor9 adapters.

​
Other considerations

  • Moving from AWS. A task definition and service hold no data, and each image is copied to your registry during the build, so moving is a redeploy. Volumes a task mounts (EFS, EBS) move under their own service mappings.
  • Confirm who operates what. On a self-operated cluster you maintain the control plane, nodes and add-ons. A managed cluster you bring keeps its provider’s control-plane and add-on services.
  • Cost. desiredCount becomes always-on replicas on nodes you provision, sized by your node pools rather than billed per Fargate task.
  • What to monitor. Logs flow through the node’s log stack and Parameter Store values live in Kubernetes Secrets, so there is no CloudWatch or Secrets Manager in the path; observability is whatever the cluster runs.

​
Runtime task execution

The runtime ECS API is not available today. Calls your application makes through the AWS SDK, such as RegisterTaskDefinition, RunTask, DescribeTasks, ListTasks and StopTask, are not answered: the appliance does not start the ECS adapter until task-role delivery and placement are qualified. The ECS services you declare in Terraform are compiled to Kubernetes workloads at deployment, as described above, and their containers run on the target cluster. Check readiness and container exit information through Kubernetes, not through the ECS API. Service deployment, scaling and workload credentials are separate concerns. The target cluster schedules and runs the containers. A Kubernetes ServiceAccount does not by itself supply AWS credentials, so containers that call AWS need a separate identity setup. Check task and service features against their own rows, including network policy, Service Connect, storage and execution settings.

​
Example monthly charges

This Tensor9 BYOC scenario estimates service charges for the named origin and target services. Adapter hosting and commercial Tensor9 fees need separate allocations. How Tensor9 estimates costs explains the method and what the estimates include.
ECS task execution on Kubernetes · Allocated task CPU-seconds per month
Feature: ECS task execution on Kubernetes. Estimated monthly service charges by Allocated task CPU-seconds per month. Adapter hosting and Tensor9 fees are excluded. Source: us-east-1; target: us-central1; currency: USD.
ECS task execution on Kubernetes · Allocated task CPU-seconds per month: monthly service charges by Allocated task CPU-seconds per month. Exact values are in the following table.ECS task execution on Kubernetes · Allocated task CPU-seconds per month: monthly service charges by Allocated task CPU-seconds per month. Exact values are in the following table.
Comparison pills describe all sampled scale points; amounts beside each service are for the named workload. Costs The Same means within 20% at every point. Costs Depend includes mixed results and unpriced samples. Sampled monthly charges in USD, rounded to cents. Difference means target minus origin; a positive difference means the target costs more. Estimated allocation, not benchmark calibrated: sized from 2 vCPU, 8 GiB memory and 100 GiB SSD at 0 vCPU-second/month to 9 nodes of 32 vCPU, 128 GiB memory and 100 GiB SSD each at 262,800,000 vCPU-second/month. Curve assumptions
  • Only this native meter varies; all other source usage and translation assumptions retain the displayed defaults. Other native meters and workload assumptions retain their explicitly displayed default quantities. Workload translation and capacity assumptions are not benchmark measurements.
  • Native monthly usage priced at the cited provider list prices; listed target allowances apply where present, excluding invoice credits, taxes and negotiated discounts. Rates as of 2026-10-22: us-east-1 → us-central1, USD/month.
  • Source prices are reference charges, not an invoice. Target lines cover selected service usage/configuration only; adapter hosting and Tensor9 fees are excluded.
  • Samples of explicit prices are not performance measurements or capacity qualification. No interpolation or break-even guarantee is implied.
  • Variant assumptions show the first axis sample; any axis-dependent configuration is described by this curve’s workload note.
  • Rates are cited provider list prices, editable for discounts, commitments or another region. Workload translation and capacity coefficients remain editable planning assumptions, not benchmark measurements or a commercial quote.
  • Default-zero rates are explicit assumptions, not evidence that the deployed service or resource is free.
  • Provisioned-unit minimums use an editable approximate allocation floor. Modeled target service cost is max(usage/allocation, minimum), with billable network, durable staging and dependent sinks added separately; actual RU/TU sizing, scaling increments and throughput remain unqualified.
  • Durable staging is priced once: provisioned targets include adapter state in their selected allocation; native targets add a separate staging allocation when required. Adapter hosting is a separate allocation and must exclude resources already priced as staging, workers or target capacity.
  • A declared adapter mapping and cost model do not establish implementation availability or service equivalence.
  • This is a declared directed mapping; a planning estimate does not establish deployment or request-serving support.
  • Origin unit prices are cited provider list prices; capacity coefficients and translation assumptions are editable authored planning guesses, not measured capacity or a provider quote.
  • Management requests do not reveal resource allocation or workload traffic. Provisioned resources and traffic are independent inputs.
  • Task CPU and memory independently grow worker resource-hours; task-start counts are not a capacity estimate.
  • The runtime ECS management endpoint and catalog compile-time container targets have different serving availability.
  • Self-hosted target: Kubernetes (Apache-2.0, https://github.com/kubernetes/kubernetes/blob/master/LICENSE); the host cloud’s managed control plane is a separate per-cluster-hour allocation. Selected CPU, RAM and physical disk allocation grow with workload; no per-operation price is assumed. No vendor charge: the target runs on the customer’s Kubernetes nodes, so CPU, RAM and disk bill at the Kubernetes node reference rates, Compute Engine N2 in us-central1 (USD 0.031611/vCPU-hour, 0.004237/GiB-hour) with pd-balanced disk (0.10/GiB-month) and Premium Tier egress. The cost-optimized E2 series lists 0.02181159/vCPU-hour and 0.00292353/GiB-hour; AWS m6i/r6i and Azure D2s v5/E2s v5 both decompose to 0.033/vCPU-hour and 0.00375/GiB-hour. Requested CPU and RAM are billed; node bin-packing waste, system reservations and the cluster control-plane fee are not.
  • Row-store throughput (capacityOpsPerVcpuSecond, default 1500) is measured-by-tensor9 as a lower bound: the DynamoDB adapter on Cloud SQL db-custom-2-7680 (2 vCPU, PostgreSQL 16, us-west1) served 2,974 ops/s of YCSB-A at 16 threads without recorded saturation (src/main/kotlin/t9/prime/equiv/generated/eval/CloudsqlPostgresqlYcsbAT16GoYcsbV1_0_0.kt). Published CPU-bound pgbench reaches 3,101 read-write transactions and 20,289 point reads per vCPU-second (AWS z1d.2xlarge, PostgreSQL 14.5), so actual capacity is likely higher. Reads and writes share one coefficient: at the same adapter version, read-only YCSB-C was not faster than 50%-update YCSB-A.
  • Log-broker throughput (capacityStreamMiBPerVcpuSecond 20 at 0.5 utilization, 4 GiB RAM per vCPU) is provider-documented by Google Managed Service for Apache Kafka sizing (https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size): write-equivalent bytes are replicated writes plus a quarter of reads. Producer batches below 10 KB lower per-CPU throughput; that penalty is not modeled.
  • Disk utilization 0.8 is provider-documented headroom below Cloud SQL automatic storage increase, which triggers near 91-95% full (https://docs.cloud.google.com/sql/docs/postgres/instance-settings). The 20 GiB reserve exceeds PostgreSQL’s 1 GB default max_wal_size; the remainder of that reserve is unmeasured.
  • CPU tiers double from 2 vCPUs to the target’s largest node at 4 GiB per vCPU; each target’s documented largest node bounds CPU, RAM, RAM per vCPU and disk, and the durable staging database uses Cloud SQL Enterprise (96 vCPU, 6.5 GiB per vCPU, 624 GiB, 64 TiB). Targets billed per capacity unit or throughput unit are sized by their backend instead.
  • No public evidence: peak/mean work (2) and the RAM working-set fraction (0.1). Proposed measurements: the p99 one-minute rate over the monthly mean from customer CloudWatch metrics; the buffer hit ratio while stepping RAM under a fixed YCSB-B load.
  • Node bounds: Planning worker node of 32 vCPUs and 128 GiB, not a provider maximum; the cluster adds nodes up to a 1,000-node planning bound. Requested CPU and RAM bill linearly, so the node size changes only rounding.
  • Stored GiB already includes the origin family’s physical footprint assumptions; no second storage amplification is applied.
  • The workload family already selected resource-hours; the throughput coefficient is not applied again.
  • Copies and allocation fractions change cost only; they do not increase modeled primary capacity.
  • AWS Price List API, AmazonECS offer: https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AmazonECS/current/us-east-1/index.json
  • Amazon ECS pricing: https://aws.amazon.com/ecs/pricing/
  • Compute Engine general-purpose machine pricing: https://cloud.google.com/products/compute/pricing/general-purpose
  • Disk and image pricing: https://cloud.google.com/compute/disks-image-pricing
  • Network pricing: https://cloud.google.com/vpc/network-pricing
Cost scope: Modeled target native service and explicitly modeled state allocation; hosting and Tensor9 fees only when supplied. Excluded costs and workload features:
  • Cluster control plane, worker idle floor, image pulls, persistent storage, GPU tasks, networking and ECS service lifecycle.
  • Taxes, discounts, credits and free-tier allowances not explicitly listed by this model.
  • Unmodeled dependent services, task execution and operations outside the selected workload family.
List prices read: 2026-10-22. Model: plan-351fa675b0206b0661fb0e787b5c1d6d303c1fd4 / 2026-10-22.planning.2. Curve: workload-1. Sources: AWS Price List API, AmazonECS offer, Amazon ECS pricing, Compute Engine general-purpose machine pricing, Disk and image pricing, Network pricing. ECS task execution on Kubernetes → Kubernetes Cluster: Authored native-usage planning example. Native monthly usage priced at the cited provider list prices; listed target allowances apply where present, excluding invoice credits, taxes and negotiated discounts. Scenario source region: us-east-1. Scenario target region: us-central1. Currency: USD. Estimated allocation, not benchmark calibrated: sized at 4 vCPU, 16 GiB memory and 100 GiB SSD for this scenario. Unestimated components: Adapter hosting, Tensor9 fees. A modeled adapted total and savings require these costs. Cost scope: Modeled target native service and explicitly modeled state allocation; hosting and Tensor9 fees only when supplied. Excluded costs and workload features:
  • Cluster control plane, worker idle floor, image pulls, persistent storage, GPU tasks, networking and ECS service lifecycle.
  • Taxes, discounts, credits and free-tier allowances not explicitly listed by this model.
  • Unmodeled dependent services, task execution and operations outside the selected workload family.
Scenario assumptions
  • Translated reads: 0 operations.
  • Translated writes: 0 operations.
  • Translated resident physical data: 0 GiB-month.
  • Native provider operations: 43,800 operations.
  • Published payload: 0 GiB.
  • Delivered payload: 0 GiB.
  • Allocated execution CPU: 2,086 vCPU-hour.
  • Allocated execution RAM: 4,171 GiB-hour.
  • Independent resource allocation: 0 resource-hour.
  • Independent inventory: 0 resource-month.
  • Input tokens: 0 tokens.
  • Output tokens: 0 tokens.
  • Billable network: 0 GiB.
  • Dependent object sink retained data: 0 GiB-month.
  • Dependent object sink writes: 0 writes.
  • Rates are cited provider list prices, editable for discounts, commitments or another region. Workload translation and capacity coefficients remain editable planning assumptions, not benchmark measurements or a commercial quote.
  • Default-zero rates are explicit assumptions, not evidence that the deployed service or resource is free.
  • Provisioned-unit minimums use an editable approximate allocation floor. Modeled target service cost is max(usage/allocation, minimum), with billable network, durable staging and dependent sinks added separately; actual RU/TU sizing, scaling increments and throughput remain unqualified.
  • Durable staging is priced once: provisioned targets include adapter state in their selected allocation; native targets add a separate staging allocation when required. Adapter hosting is a separate allocation and must exclude resources already priced as staging, workers or target capacity.
  • A declared adapter mapping and cost model do not establish implementation availability or service equivalence.
  • This is a declared directed mapping; a planning estimate does not establish deployment or request-serving support.
  • Origin unit prices are cited provider list prices; capacity coefficients and translation assumptions are editable authored planning guesses, not measured capacity or a provider quote.
  • Management requests do not reveal resource allocation or workload traffic. Provisioned resources and traffic are independent inputs.
  • Task CPU and memory independently grow worker resource-hours; task-start counts are not a capacity estimate.
  • The runtime ECS management endpoint and catalog compile-time container targets have different serving availability.
  • Self-hosted target: Kubernetes (Apache-2.0, https://github.com/kubernetes/kubernetes/blob/master/LICENSE); the host cloud’s managed control plane is a separate per-cluster-hour allocation. Selected CPU, RAM and physical disk allocation grow with workload; no per-operation price is assumed. No vendor charge: the target runs on the customer’s Kubernetes nodes, so CPU, RAM and disk bill at the Kubernetes node reference rates, Compute Engine N2 in us-central1 (USD 0.031611/vCPU-hour, 0.004237/GiB-hour) with pd-balanced disk (0.10/GiB-month) and Premium Tier egress. The cost-optimized E2 series lists 0.02181159/vCPU-hour and 0.00292353/GiB-hour; AWS m6i/r6i and Azure D2s v5/E2s v5 both decompose to 0.033/vCPU-hour and 0.00375/GiB-hour. Requested CPU and RAM are billed; node bin-packing waste, system reservations and the cluster control-plane fee are not.
  • Row-store throughput (capacityOpsPerVcpuSecond, default 1500) is measured-by-tensor9 as a lower bound: the DynamoDB adapter on Cloud SQL db-custom-2-7680 (2 vCPU, PostgreSQL 16, us-west1) served 2,974 ops/s of YCSB-A at 16 threads without recorded saturation (src/main/kotlin/t9/prime/equiv/generated/eval/CloudsqlPostgresqlYcsbAT16GoYcsbV1_0_0.kt). Published CPU-bound pgbench reaches 3,101 read-write transactions and 20,289 point reads per vCPU-second (AWS z1d.2xlarge, PostgreSQL 14.5), so actual capacity is likely higher. Reads and writes share one coefficient: at the same adapter version, read-only YCSB-C was not faster than 50%-update YCSB-A.
  • Log-broker throughput (capacityStreamMiBPerVcpuSecond 20 at 0.5 utilization, 4 GiB RAM per vCPU) is provider-documented by Google Managed Service for Apache Kafka sizing (https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size): write-equivalent bytes are replicated writes plus a quarter of reads. Producer batches below 10 KB lower per-CPU throughput; that penalty is not modeled.
  • Disk utilization 0.8 is provider-documented headroom below Cloud SQL automatic storage increase, which triggers near 91-95% full (https://docs.cloud.google.com/sql/docs/postgres/instance-settings). The 20 GiB reserve exceeds PostgreSQL’s 1 GB default max_wal_size; the remainder of that reserve is unmeasured.
  • CPU tiers double from 2 vCPUs to the target’s largest node at 4 GiB per vCPU; each target’s documented largest node bounds CPU, RAM, RAM per vCPU and disk, and the durable staging database uses Cloud SQL Enterprise (96 vCPU, 6.5 GiB per vCPU, 624 GiB, 64 TiB). Targets billed per capacity unit or throughput unit are sized by their backend instead.
  • No public evidence: peak/mean work (2) and the RAM working-set fraction (0.1). Proposed measurements: the p99 one-minute rate over the monthly mean from customer CloudWatch metrics; the buffer hit ratio while stepping RAM under a fixed YCSB-B load.
  • Node bounds: Planning worker node of 32 vCPUs and 128 GiB, not a provider maximum; the cluster adds nodes up to a 1,000-node planning bound. Requested CPU and RAM bill linearly, so the node size changes only rounding.
  • Stored GiB already includes the origin family’s physical footprint assumptions; no second storage amplification is applied.
  • The workload family already selected resource-hours; the throughput coefficient is not applied again.
  • Copies and allocation fractions change cost only; they do not increase modeled primary capacity.
List prices read: 2026-10-22. Model: plan-351fa675b0206b0661fb0e787b5c1d6d303c1fd4 / 2026-10-22.planning.2. Scenario: planning-example. Sources: AWS Price List API, AmazonECS offer, Amazon ECS pricing, Compute Engine general-purpose machine pricing, Disk and image pricing, Network pricing.

​
Costs

Estimated monthly service charges for each backend with a published cost model, at one sampled workload from that model’s cost curve. Adapter hosting and Tensor9 fees are excluded. How Tensor9 estimates costs explains the method, what the estimates include and how to read their qualifications. Difference means backend minus origin; a positive difference means the backend costs more. Workloads and target configurations differ by model, so compare each row’s difference at its stated workload rather than charges across rows. Cost curves across workload sizes, with every assumption and exclusion: ECS Cluster costs.

​
Service level agreements

These tables show Tensor9’s standard service levels and adapters whose standard terms are still being defined. Your signed agreement determines the SLAs, covered adapters and operations, limits, remedies and support terms that apply to your deployment.
Listed terms cover requests sent through this service adapter. They do not cover direct connections to the target service or replace the cloud provider’s own SLA. Each origin-to-target pair has its own terms or an explicit pending status. See the SLA tables, measurement rules, and scaling conditions.

​
ECS Cluster to Kubernetes Cluster

Adapter-added latency. A + prefix marks time added by the adapter, not the total time your application waits. Total request time includes adapter processing, backend service time and network time. The backend provider’s SLA applies independently. Only separately measured target-service wait may be subtracted, and only when your agreement permits it; internal metadata, coordination and retry processing still count. For one request, 12 ms of adapter processing plus 90 ms waiting for the backend means at least 102 ms total. This example does not add monthly p99 values. What Tensor9 covers. These service levels cover the adapter between the origin API and target API. They do not replace the target provider’s SLA. How latency is counted. Adapter work, including metadata and coordination, counts. Only separately measured permitted target waits are excluded. Which terms apply. Your signed agreement names the covered operations, workload limits, remedies, and final service levels for your deployment.

​
What this adapter does

Cluster, workload and identity calls validate AWS-shaped intent, record the desired resource and reconcile native objects on kubernetes::1.0.0::cluster. In-cluster Kubernetes traffic and application packet flow are not proxied by this control-plane estimate. Provider provisioning and image pull time are readiness phases; adapter validation, durable admission and status conversion remain covered.

​
How the latency targets were chosen

Cluster and workload desired-state admission: +20 ms monthly p99 (adapter-added). CreateService, RegisterTaskDefinition, UpdateService. Validation, durable generation commit and reconciliation scheduling. Your signed agreement sets the terms for your deployment. A target does not add an operation or option that the compatibility tables mark unavailable.

​
What counts toward latency

For a request-response row, measure from the agreed ingress boundary to dispatch of the complete response. A row that explicitly names a first response chunk ends at that chunk; its number does not cover the rest of the stream. A long-poll row names the intentional wait and when adapter delay starts. Include parsing, authorization, admission, translation, serialization, adapter-owned storage and coordination, retries and response handling. Subtract only separately measured target-workload waits and external network segments allowed by the measurement rules. The adapter’s own response handling and dispatch remain covered. A database used for adapter metadata is still adapter work, even if a cloud provider hosts it. For concurrent calls, exclude the union of permitted wait intervals, not the sum of overlapping spans. Calculate each request’s adapter duration first, then the monthly p99. Do not subtract one service’s p99 from another’s. Known adapter timeouts are over-budget samples; failed or incomplete requests cannot disappear to improve the percentile. Missing measurements do not become zero latency. An SDK call span alone does not prove how much of its duration can be excluded.

​
Endpoint reachability and request failures

The endpoint-reachability target measures adapter health checks. Correctly forwarding a target quota or permission error is different from producing that error because the adapter sent the wrong request. Adapter-caused failures remain Tensor9’s responsibility even when the target is healthy. Correctness and data-integrity requirements apply to every supported request. Endpoint reachability does not measure request correctness or grant an allowance for incorrect results.

​
Scaling and target-service capacity

Independent clusters, services, tasks and identity associations reconcile concurrently. Mutations for one object serialize by generation, list calls are bounded pages, and status polling must not starve writes. Qualification fixes object count, manifest size, container count, tag count and concurrent reconcilers. Tell Tensor9 the expected steady rate, bursts, concurrency, payload sizes and operation mix. Tensor9 sizes and scales the adapter for the agreed load; you choose and monitor the target service’s capacity with Tensor9’s help. A latency budget is not a requests-per-second rating. Larger requests and higher rates need explicit terms, not silent inheritance of a small-request SLA.

​
Data and behavior guarantees

Accepted desired state is durable and generation ordered. Workload identity binds only the intended service account/role, secrets are not emitted into public fields, and observed status never claims readiness before the target reports it. Unsupported scheduling or networking modes fail before partial creation.

​
Example and diagnosis

CreateCluster records a bounded cluster specification and returns its stable identity. Native provisioning may continue after the adapter response. DescribeCluster is a bounded read of desired plus observed state and must not report ACTIVE until the target control plane is actually ready. Use tensor9 explain and the documented explain headers to understand the selected adapter and its behavior. Correlate available request diagnostics with the target provider’s latency, throttling and capacity metrics. An explain report helps diagnose a request; it is not by itself a qualified SLA timing measurement. Share the operation, request shape, timestamps and request identifiers with support, with credentials and customer payloads removed.

​
Debug this service

For requests through a service adapter, use Explain and request diagnostics to investigate the selected mapping. Follow the BYOC service-adapter debugging runbook to capture and interpret the diagnostic evidence. Service Catalog.