> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tensor9.com/llms.txt
> Use this file to discover all available pages before exploring further.

# EKS

> EKS APIs with Cloud Adapter.

This page describes how EKS maps to services in the environment where the application runs, including backend choices, supported operations and service-specific behavior.

## Supported environments

* Akamai
* Azure
* DigitalOcean
* Google Cloud
* OCI
* Private Kubernetes
* Scaleway

Check the operation and capability tables for the behavior your application depends on. A supported environment does not imply that every operation of the origin service is available.

## How the backends compare

Each row compares a capability of EKS with its adaptation on each backend.
A dash means this profile does not state the capability for that backend.

### Cloud Adapter

| Capability | EKS | Akamai, DigitalOcean, Private Kubernetes, and Scaleway | Azure | Google Cloud | OCI |
| - | - | - | - | - | - |
| Control plane · who operates it | EKS managed control plane | your existing cluster; you operate the API server, and it is not provisioned | azurerm\_kubernetes\_cluster, Microsoft-operated; SystemAssigned cluster identity | GKE Standard, regional (control plane across multiple zones), Google-operated | oci\_containerengine\_cluster ENHANCED\_CLUSTER, Oracle-operated |
| Node groups · who owns the nodes | aws\_eks\_node\_group | your nodes; node-group provisioning is owned by you | - | - | - |
| Workload identity (IRSA) | Yes - IRSA (cloud-federated) | Partial - Kubernetes RBAC for cluster access; selected STS adapter for AWS role sessions; no native cloud binding provisioned | - | - | - |
| Cluster authentication · how Tensor9 reaches it | data.aws\_eks\_cluster\_auth token | the client cert / token you supply with the existing cluster | - | - | - |
| API coverage | full | high | high | high | high |
| Kubernetes version · version selection | requested minor version | - | AKS recommended default; the build reports the selected minor version, which may differ from the requested version | - | a supported patch of your requested minor version; exact patch chosen at plan time, surfaced |
| Node groups → node pools · machine mapping | aws\_eks\_node\_group | - | default\_node\_pool + one node pool per additional group; VM size in the same hardware class, default Standard\_D2s\_v5 | - | - |
| Workload identity (IRSA → WI) | Yes - IRSA | - | Yes - Azure Workload Identity: OIDC issuer + UAMI + federated identity credential | - | - |
| Private cluster endpoint | Yes | - | Partial - public control-plane endpoint; a private endpoint is not part of this equivalence, surfaced | Partial - public control-plane endpoint; a private endpoint is not part of this equivalence, surfaced | Yes - private in this mapping; a public-access origin gets a network-access warning, not an apply failure |
| Add-ons · core vs custom | EKS add-ons | - | AKS platform components (managed for you); non-core add-on with no analog dropped and surfaced | - | - |
| Kubernetes version · version selection | requested minor version (e.g. 1.29) | - | - | release channel (STABLE); the build reports the selected minor version, which may differ from the requested version | - |
| Node groups → node pools · machine mapping | aws\_eks\_node\_group (instance\_types) | - | - | one node pool per group; same hardware class (m5→n2/e2, c5→c2, arm→t2a, GPU→g2/L4; default e2-medium); region-wide autoscaling | - |
| Workload identity (IRSA → WI) | Yes - IRSA (OIDC + AssumeRoleWithWebIdentity) | - | - | Yes - GKE Workload Identity | Partial - OKE Workload Identity, the OCI-native analog: workload-principal policies scoped to cluster, namespace and service account |
| Add-ons · core vs custom | EKS add-ons (vpc-cni/coredns/kube-proxy/ebs-csi) | - | - | GKE platform components (managed for you); a non-core add-on with no analog is dropped and surfaced | - |
| Node groups → node pools · shapes + autoscaling | aws\_eks\_node\_group (scaling\_config min/max) | - | - | - | one node pool per group; flex shapes specify ocpus + memory; the desired size is applied, min/max bounds are unsupported on the node-pool resource; the build reports their omission |
| Pod networking · CNI | VPC-CNI | - | - | - | VCN-native pod IPs (OCI\_VCN\_IP\_NATIVE) |

## On Akamai, DigitalOcean, Private Kubernetes, and Scaleway

### Kubernetes Cluster

| Operation | Area | Support | Depth | Notes |
| - | - | - | - | - |
| Workload identity (IRSA) | Identity | Partial | Full surface | Kubernetes ServiceAccounts and RBAC govern cluster access. The selected STS service adapter supplies supported AWS role sessions; this mapping does not provision a native cloud identity binding. Real external-cloud access requires separately authorized credentials or federation. |
| Cluster provisioning (control plane / node groups) | Provisioning | Out of scope | Full surface | not provisioned: you bring the API server and the nodes; Tensor9 emits a reference to your existing cluster's endpoint and auth |
| Fargate profile | Serverless nodes | Out of scope | Full surface | no analog; you run the nodes |
| In-cluster Kubernetes API (client-go / in-cluster config) | Workload | Supported | Full surface | your existing cluster's API server: standard workload verbs and objects; cloud-specific integrations need backend configuration |

#### How it works

Your workloads run on a Kubernetes cluster that already exists in the deployment environment, such as one built with kubeadm, k3s or kops. Tensor9 points your EKS cluster at that cluster's endpoint and credentials. It creates no control plane and no node pools.

Whoever operates that cluster runs the API server, keeps the control plane available, upgrades Kubernetes, and adds and replaces nodes. They also install and run the ingress controller, autoscaler, monitoring, secrets driver and backup service. Tensor9 deploys your workloads without adding those. The cluster's existing API server, scheduler, controller manager, networking (CNI), DNS and storage (CSI) stay as they are.

![Nothing is created on this target. At build time your EKS cluster is pointed at a Kubernetes cluster that already exists, such as kubeadm, k3s or kops. Tensor9 uses that cluster's endpoint and credentials.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMTc2IiB2aWV3Qm94PSIwIDAgODM2IDE3NiIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJOb3RoaW5nIGlzIGNyZWF0ZWQgb24gdGhpcyB0YXJnZXQuIEF0IGJ1aWxkIHRpbWUgeW91ciBFS1MgY2x1c3RlciBpcyBwb2ludGVkIGF0IGEgS3ViZXJuZXRlcyBjbHVzdGVyIHRoYXQgYWxyZWFkeSBleGlzdHMsIHN1Y2ggYXMga3ViZWFkbSwgazNzIG9yIGtvcHMuIFRlbnNvcjkgdXNlcyB0aGF0IGNsdXN0ZXIncyBlbmRwb2ludCBhbmQgY3JlZGVudGlhbHMuIj48c3R5bGU+dGV4dHtmb250LWZhbWlseTpJbnRlciwtYXBwbGUtc3lzdGVtLEJsaW5rTWFjU3lzdGVtRm9udCwnU2Vnb2UgVUknLFJvYm90bywnSGVsdmV0aWNhIE5ldWUnLEFyaWFsLHNhbnMtc2VyaWY7ZmlsbDojMzM0MTU1fTwvc3R5bGU+CjxkZWZzPjxtYXJrZXIgaWQ9InJoLWs4cyIgdmlld0JveD0iMCAwIDEwIDEwIiByZWZYPSI4IiByZWZZPSI1IiBtYXJrZXJXaWR0aD0iNyIgbWFya2VySGVpZ2h0PSI3IiBvcmllbnQ9ImF1dG8tc3RhcnQtcmV2ZXJzZSI+PHBhdGggZD0iTTAsMCBMMTAsNSBMMCwxMCB6IiBzdHlsZT0iZmlsbDojOTRhM2I4Ii8+PC9tYXJrZXI+PC9kZWZzPgo8cmVjdCB4PSIyOCIgeT0iNDAiIHdpZHRoPSIzNDAiIGhlaWdodD0iNzIiIHJ4PSIxMiIgc3Ryb2tlLXdpZHRoPSIxLjUiIHN0eWxlPSJmaWxsOiNmZmZmZmY7c3Ryb2tlOiNjYmQ1ZTEiLz4KPHRleHQgeD0iMTk4IiB5PSI3MiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwZjE3MmE7IGZvbnQtc2l6ZToxMS41cHgiPkVLUyBjb250cm9sIHBsYW5lPC90ZXh0Pgo8dGV4dCB4PSIxOTgiIHk9IjkyIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YiI+UnVuIGJ5IEFXUzwvdGV4dD4KPGxpbmUgeDE9IjM3MCIgeTE9Ijc2IiB4Mj0iNDUyIiB5Mj0iNzYiIHN0cm9rZS13aWR0aD0iMiIgbWFya2VyLWVuZD0idXJsKCNyaC1rOHMpIiBzdHlsZT0ic3Ryb2tlOiM5NGEzYjgiLz4KPHRleHQgeD0iNDExIiB5PSI2OCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGI7IGZvbnQtc2l6ZTo5cHgiPmF0IGJ1aWxkIHRpbWU8L3RleHQ+CjxyZWN0IHg9IjQ2NiIgeT0iNDAiIHdpZHRoPSIzNDIiIGhlaWdodD0iNzIiIHJ4PSIxMiIgc3Ryb2tlLXdpZHRoPSIxLjUiIHN0cm9rZS1kYXNoYXJyYXk9IjUgNSIgc3R5bGU9ImZpbGw6I2Y4ZmFmYztzdHJva2U6I2NiZDVlMSIvPgo8dGV4dCB4PSI2MzciIHk9IjcyIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzBmMTcyYTsgZm9udC1zaXplOjExLjVweDtmaWxsOiMzMzQxNTUiPkV4aXN0aW5nIGNsdXN0ZXI8L3RleHQ+Cjx0ZXh0IHg9IjYzNyIgeT0iOTIiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiIj5rdWJlYWRtLCBrM3Mgb3Iga29wczwvdGV4dD4KPHJlY3QgeD0iMjgiIHk9IjEyOCIgd2lkdGg9Ijc4MCIgaGVpZ2h0PSIzNCIgcng9IjEwIiBzdHJva2Utd2lkdGg9IjEuNCIgc3R5bGU9ImZpbGw6I2Y4ZmFmYztzdHJva2U6I2NiZDVlMSIvPgo8dGV4dCB4PSI0MTgiIHk9IjE1MCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGIiPk5vdGhpbmcgaXMgY3JlYXRlZDogVGVuc29yOSB1c2VzIHRoZSBleGlzdGluZyBjbHVzdGVyJ3MgZW5kcG9pbnQgYW5kIGNyZWRlbnRpYWxzLjwvdGV4dD4KPC9zdmc+)

![Nothing is created on this target. At build time your EKS cluster is pointed at a Kubernetes cluster that already exists, such as kubeadm, k3s or kops. Tensor9 uses that cluster's endpoint and credentials.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMTc2IiB2aWV3Qm94PSIwIDAgODM2IDE3NiIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJOb3RoaW5nIGlzIGNyZWF0ZWQgb24gdGhpcyB0YXJnZXQuIEF0IGJ1aWxkIHRpbWUgeW91ciBFS1MgY2x1c3RlciBpcyBwb2ludGVkIGF0IGEgS3ViZXJuZXRlcyBjbHVzdGVyIHRoYXQgYWxyZWFkeSBleGlzdHMsIHN1Y2ggYXMga3ViZWFkbSwgazNzIG9yIGtvcHMuIFRlbnNvcjkgdXNlcyB0aGF0IGNsdXN0ZXIncyBlbmRwb2ludCBhbmQgY3JlZGVudGlhbHMuIj48c3R5bGU+dGV4dHtmb250LWZhbWlseTpJbnRlciwtYXBwbGUtc3lzdGVtLEJsaW5rTWFjU3lzdGVtRm9udCwnU2Vnb2UgVUknLFJvYm90bywnSGVsdmV0aWNhIE5ldWUnLEFyaWFsLHNhbnMtc2VyaWY7ZmlsbDojY2JkNWUxfTwvc3R5bGU+CjxkZWZzPjxtYXJrZXIgaWQ9InJoLWs4cyIgdmlld0JveD0iMCAwIDEwIDEwIiByZWZYPSI4IiByZWZZPSI1IiBtYXJrZXJXaWR0aD0iNyIgbWFya2VySGVpZ2h0PSI3IiBvcmllbnQ9ImF1dG8tc3RhcnQtcmV2ZXJzZSI+PHBhdGggZD0iTTAsMCBMMTAsNSBMMCwxMCB6IiBzdHlsZT0iZmlsbDojNjQ3NDhiIi8+PC9tYXJrZXI+PC9kZWZzPgo8cmVjdCB4PSIyOCIgeT0iNDAiIHdpZHRoPSIzNDAiIGhlaWdodD0iNzIiIHJ4PSIxMiIgc3Ryb2tlLXdpZHRoPSIxLjUiIHN0eWxlPSJmaWxsOiMxZTI5M2I7c3Ryb2tlOiM0NzU1NjkiLz4KPHRleHQgeD0iMTk4IiB5PSI3MiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICNmMWY1Zjk7IGZvbnQtc2l6ZToxMS41cHgiPkVLUyBjb250cm9sIHBsYW5lPC90ZXh0Pgo8dGV4dCB4PSIxOTgiIHk9IjkyIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiOCI+UnVuIGJ5IEFXUzwvdGV4dD4KPGxpbmUgeDE9IjM3MCIgeTE9Ijc2IiB4Mj0iNDUyIiB5Mj0iNzYiIHN0cm9rZS13aWR0aD0iMiIgbWFya2VyLWVuZD0idXJsKCNyaC1rOHMpIiBzdHlsZT0ic3Ryb2tlOiM2NDc0OGIiLz4KPHRleHQgeD0iNDExIiB5PSI2OCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjg7IGZvbnQtc2l6ZTo5cHgiPmF0IGJ1aWxkIHRpbWU8L3RleHQ+CjxyZWN0IHg9IjQ2NiIgeT0iNDAiIHdpZHRoPSIzNDIiIGhlaWdodD0iNzIiIHJ4PSIxMiIgc3Ryb2tlLXdpZHRoPSIxLjUiIHN0cm9rZS1kYXNoYXJyYXk9IjUgNSIgc3R5bGU9ImZpbGw6IzBmMTcyYTtzdHJva2U6IzQ3NTU2OSIvPgo8dGV4dCB4PSI2MzciIHk9IjcyIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogI2YxZjVmOTsgZm9udC1zaXplOjExLjVweDtmaWxsOiNjYmQ1ZTEiPkV4aXN0aW5nIGNsdXN0ZXI8L3RleHQ+Cjx0ZXh0IHg9IjYzNyIgeT0iOTIiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4Ij5rdWJlYWRtLCBrM3Mgb3Iga29wczwvdGV4dD4KPHJlY3QgeD0iMjgiIHk9IjEyOCIgd2lkdGg9Ijc4MCIgaGVpZ2h0PSIzNCIgcng9IjEwIiBzdHJva2Utd2lkdGg9IjEuNCIgc3R5bGU9ImZpbGw6IzBmMTcyYTtzdHJva2U6IzQ3NTU2OSIvPgo8dGV4dCB4PSI0MTgiIHk9IjE1MCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjgiPk5vdGhpbmcgaXMgY3JlYXRlZDogVGVuc29yOSB1c2VzIHRoZSBleGlzdGluZyBjbHVzdGVyJ3MgZW5kcG9pbnQgYW5kIGNyZWRlbnRpYWxzLjwvdGV4dD4KPC9zdmc+)

Your EKS cluster is pointed at a Kubernetes cluster that already exists; nothing is created.

#### Workloads and nodes

Deploy your workloads through the existing cluster's Kubernetes API. Match API versions, identity annotations, storage classes and installed controllers to that cluster; AWS-specific integrations may need different manifests or Helm values.

There is no mapping from EKS instance types to machine types and no cloud autoscaler set up for you. The cluster's operator decides how nodes are added, sized and retired, and runs an autoscaler (cluster-autoscaler, Karpenter or none) if they want one. Tensor9 schedules your workloads onto the capacity that is already there.

#### Cluster access and AWS credentials

**Kubernetes API access.** Service accounts and RBAC control what workloads may do in the existing cluster's API. They do not supply AWS credentials.

**AWS credentials.** With IRSA (IAM Roles for Service Accounts), the AWS SDK sends the pod's service account token to the selected STS adapter through `AssumeRoleWithWebIdentity`, and gets back an AWS role session for calls that Tensor9 handles. With EKS Pod Identity, the selected EKS Auth adapter's `AssumeRoleForPodIdentity` does the same. You must configure the cluster's token issuer, the service account binding and the IAM role trust for the exchange you use.

**AWS permissions.** The Cloud Adapter deployment checks the role's AWS policies for each API call its service adapters handle. An explicit deny wins over an allow.

**Other clouds.** Calls to real services on another cloud need credentials or federation that cloud authorizes. This mapping does not set up a native cloud identity; configure that access through the cluster's identity integration or mounted credentials.

![On an existing cluster, the STS adapter exchanges the pod's service account token for an AWS role session. The Cloud Adapter deployment checks that role's AWS policy for each AWS request, and a deny overrides an allow. Kubernetes RBAC separately controls access to the cluster API.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjAwIiB2aWV3Qm94PSIwIDAgODM2IDIwMCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJPbiBhbiBleGlzdGluZyBjbHVzdGVyLCB0aGUgU1RTIGFkYXB0ZXIgZXhjaGFuZ2VzIHRoZSBwb2QncyBzZXJ2aWNlIGFjY291bnQgdG9rZW4gZm9yIGFuIEFXUyByb2xlIHNlc3Npb24uIFRoZSBhcHBsaWFuY2UgY2hlY2tzIHRoYXQgcm9sZSdzIEFXUyBwb2xpY3kgZm9yIGVhY2ggQVdTIHJlcXVlc3QsIGFuZCBhIGRlbnkgb3ZlcnJpZGVzIGFuIGFsbG93LiBLdWJlcm5ldGVzIFJCQUMgc2VwYXJhdGVseSBjb250cm9scyBhY2Nlc3MgdG8gdGhlIGNsdXN0ZXIgQVBJLiI+PHN0eWxlPnRleHR7Zm9udC1mYW1pbHk6SW50ZXIsLWFwcGxlLXN5c3RlbSxCbGlua01hY1N5c3RlbUZvbnQsJ1NlZ29lIFVJJyxSb2JvdG8sJ0hlbHZldGljYSBOZXVlJyxBcmlhbCxzYW5zLXNlcmlmO2ZpbGw6IzMzNDE1NX08L3N0eWxlPgo8ZGVmcz48bWFya2VyIGlkPSJpZGF1dGh6LWs4cyIgdmlld0JveD0iMCAwIDEwIDEwIiByZWZYPSI4IiByZWZZPSI1IiBtYXJrZXJXaWR0aD0iNyIgbWFya2VySGVpZ2h0PSI3IiBvcmllbnQ9ImF1dG8tc3RhcnQtcmV2ZXJzZSI+PHBhdGggZD0iTTAsMCBMMTAsNSBMMCwxMCB6IiBzdHlsZT0iZmlsbDojMDQ3ODU3Ii8+PC9tYXJrZXI+PG1hcmtlciBpZD0iaWRhdXRoei1rOHMtbiIgdmlld0JveD0iMCAwIDEwIDEwIiByZWZYPSI4IiByZWZZPSI1IiBtYXJrZXJXaWR0aD0iNyIgbWFya2VySGVpZ2h0PSI3IiBvcmllbnQ9ImF1dG8tc3RhcnQtcmV2ZXJzZSI+PHBhdGggZD0iTTAsMCBMMTAsNSBMMCwxMCB6IiBzdHlsZT0iZmlsbDojOTRhM2I4Ii8+PC9tYXJrZXI+PC9kZWZzPgo8dGV4dCB4PSIyOCIgeT0iMjIiIHN0eWxlPSJmb250OiA3MDAgMTBweCBJbnRlciwgc2Fucy1zZXJpZjsgbGV0dGVyLXNwYWNpbmc6IDEuM3B4OyBmaWxsOiAjOTRhM2I4OyBmaWxsOiM2NDc0OGIiPklERU5USVRZIMK3IFdITyBBTSBJPC90ZXh0Pgo8cmVjdCB4PSIyOCIgeT0iMzAiIHdpZHRoPSIyNTAiIGhlaWdodD0iNjAiIHJ4PSIxMiIgc3Ryb2tlLXdpZHRoPSIxLjUiIHN0eWxlPSJmaWxsOiNmZmZmZmY7c3Ryb2tlOiNjYmQ1ZTEiLz4KPHRleHQgeD0iMTUzIiB5PSI1NiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwZjE3MmE7IGZvbnQtc2l6ZToxMS41cHgiPllvdXIgSVJTQSByb2xlPC90ZXh0Pgo8dGV4dCB4PSIxNTMiIHk9Ijc0IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YiI+VGhlIHJvbGUgYSBwb2QgcnVucyBhczwvdGV4dD4KPGxpbmUgeDE9IjI3OCIgeTE9IjYwIiB4Mj0iMzUyIiB5Mj0iNjAiIHN0cm9rZS13aWR0aD0iMiIgbWFya2VyLWVuZD0idXJsKCNpZGF1dGh6LWs4cy1uKSIgc3R5bGU9InN0cm9rZTojOTRhM2I4Ii8+Cjx0ZXh0IHg9IjMxNSIgeT0iNTIiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiOyBmb250LXNpemU6OC41cHg7ZmlsbDojMzM0MTU1Ij5TVFM8L3RleHQ+CjxyZWN0IHg9IjM1NiIgeT0iMzAiIHdpZHRoPSI0NTIiIGhlaWdodD0iNjAiIHJ4PSIxMiIgc3Ryb2tlLXdpZHRoPSIxLjUiIHN0cm9rZS1kYXNoYXJyYXk9IjUgNSIgc3R5bGU9ImZpbGw6I2Y4ZmFmYztzdHJva2U6I2NiZDVlMSIvPgo8dGV4dCB4PSIzNzQiIHk9IjU0IiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzBmMTcyYTsgZm9udC1zaXplOjExLjVweDtmaWxsOiMzMzQxNTUiPkFXUyByb2xlIHNlc3Npb248L3RleHQ+Cjx0ZXh0IHg9IjM3NCIgeT0iNzQiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiOyBmb250LXNpemU6MTBweCI+SXNzdWVkIGJ5IHRoZSBTVFMgYWRhcHRlcjwvdGV4dD4KPHRleHQgeD0iMjgiIHk9IjExOCIgc3R5bGU9ImZvbnQ6IDcwMCAxMHB4IEludGVyLCBzYW5zLXNlcmlmOyBsZXR0ZXItc3BhY2luZzogMS4zcHg7IGZpbGw6ICM5NGEzYjg7IGZpbGw6IzY0NzQ4YiI+UEVSTUlTU0lPTlMgwrcgTUFZIEk8L3RleHQ+CjxyZWN0IHg9IjI4IiB5PSIxMjYiIHdpZHRoPSIyNTAiIGhlaWdodD0iNjAiIHJ4PSIxMiIgc3Ryb2tlLXdpZHRoPSIxLjUiIHN0eWxlPSJmaWxsOiNmZmZmZmY7c3Ryb2tlOiNjYmQ1ZTEiLz4KPHRleHQgeD0iMTUzIiB5PSIxNTIiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMGYxNzJhOyBmb250LXNpemU6MTEuNXB4Ij5Zb3VyIEFXUyBJQU0gcG9saWN5PC90ZXh0Pgo8dGV4dCB4PSIxNTMiIHk9IjE3MCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGIiPkFsbG93IGFuZCBEZW55IHJ1bGVzPC90ZXh0Pgo8bGluZSB4MT0iMjc4IiB5MT0iMTU2IiB4Mj0iMzUyIiB5Mj0iMTU2IiBzdHJva2Utd2lkdGg9IjIiIG1hcmtlci1lbmQ9InVybCgjaWRhdXRoei1rOHMpIiBzdHlsZT0ic3Ryb2tlOiMwNDc4NTciLz4KPHRleHQgeD0iMzE1IiB5PSIxNDgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMC41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwNDc4NTc7IGZvbnQtc2l6ZTo4LjVweCI+Y2hlY2tlZDwvdGV4dD4KPHJlY3QgeD0iMzU2IiB5PSIxMjYiIHdpZHRoPSI0NTIiIGhlaWdodD0iNjAiIHJ4PSIxMiIgc3Ryb2tlLXdpZHRoPSIxLjciIHN0eWxlPSJmaWxsOiNlY2ZkZjU7c3Ryb2tlOiMwNDc4NTciLz4KPHRleHQgeD0iMzc0IiB5PSIxNTAiIHN0eWxlPSJmb250OiA3MDAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMDQ3ODU3OyBmb250LXNpemU6MTEuNXB4Ij5BV1MgcmVxdWVzdCBjaGVjazwvdGV4dD4KPHRleHQgeD0iMzc0IiB5PSIxNzAiIHN0eWxlPSJmb250OiAxMC41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwNDc4NTc7IGZvbnQtc2l6ZToxMHB4Ij5EZW55IG92ZXJyaWRlcyBhbGxvdzwvdGV4dD4KPC9zdmc+)

![On an existing cluster, the STS adapter exchanges the pod's service account token for an AWS role session. The Cloud Adapter deployment checks that role's AWS policy for each AWS request, and a deny overrides an allow. Kubernetes RBAC separately controls access to the cluster API.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjAwIiB2aWV3Qm94PSIwIDAgODM2IDIwMCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJPbiBhbiBleGlzdGluZyBjbHVzdGVyLCB0aGUgU1RTIGFkYXB0ZXIgZXhjaGFuZ2VzIHRoZSBwb2QncyBzZXJ2aWNlIGFjY291bnQgdG9rZW4gZm9yIGFuIEFXUyByb2xlIHNlc3Npb24uIFRoZSBhcHBsaWFuY2UgY2hlY2tzIHRoYXQgcm9sZSdzIEFXUyBwb2xpY3kgZm9yIGVhY2ggQVdTIHJlcXVlc3QsIGFuZCBhIGRlbnkgb3ZlcnJpZGVzIGFuIGFsbG93LiBLdWJlcm5ldGVzIFJCQUMgc2VwYXJhdGVseSBjb250cm9scyBhY2Nlc3MgdG8gdGhlIGNsdXN0ZXIgQVBJLiI+PHN0eWxlPnRleHR7Zm9udC1mYW1pbHk6SW50ZXIsLWFwcGxlLXN5c3RlbSxCbGlua01hY1N5c3RlbUZvbnQsJ1NlZ29lIFVJJyxSb2JvdG8sJ0hlbHZldGljYSBOZXVlJyxBcmlhbCxzYW5zLXNlcmlmO2ZpbGw6I2NiZDVlMX08L3N0eWxlPgo8ZGVmcz48bWFya2VyIGlkPSJpZGF1dGh6LWs4cyIgdmlld0JveD0iMCAwIDEwIDEwIiByZWZYPSI4IiByZWZZPSI1IiBtYXJrZXJXaWR0aD0iNyIgbWFya2VySGVpZ2h0PSI3IiBvcmllbnQ9ImF1dG8tc3RhcnQtcmV2ZXJzZSI+PHBhdGggZD0iTTAsMCBMMTAsNSBMMCwxMCB6IiBzdHlsZT0iZmlsbDojNmVlN2I3Ii8+PC9tYXJrZXI+PG1hcmtlciBpZD0iaWRhdXRoei1rOHMtbiIgdmlld0JveD0iMCAwIDEwIDEwIiByZWZYPSI4IiByZWZZPSI1IiBtYXJrZXJXaWR0aD0iNyIgbWFya2VySGVpZ2h0PSI3IiBvcmllbnQ9ImF1dG8tc3RhcnQtcmV2ZXJzZSI+PHBhdGggZD0iTTAsMCBMMTAsNSBMMCwxMCB6IiBzdHlsZT0iZmlsbDojNjQ3NDhiIi8+PC9tYXJrZXI+PC9kZWZzPgo8dGV4dCB4PSIyOCIgeT0iMjIiIHN0eWxlPSJmb250OiA3MDAgMTBweCBJbnRlciwgc2Fucy1zZXJpZjsgbGV0dGVyLXNwYWNpbmc6IDEuM3B4OyBmaWxsOiAjNjQ3NDhiOyBmaWxsOiM5NGEzYjgiPklERU5USVRZIMK3IFdITyBBTSBJPC90ZXh0Pgo8cmVjdCB4PSIyOCIgeT0iMzAiIHdpZHRoPSIyNTAiIGhlaWdodD0iNjAiIHJ4PSIxMiIgc3Ryb2tlLXdpZHRoPSIxLjUiIHN0eWxlPSJmaWxsOiMxZTI5M2I7c3Ryb2tlOiM0NzU1NjkiLz4KPHRleHQgeD0iMTUzIiB5PSI1NiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICNmMWY1Zjk7IGZvbnQtc2l6ZToxMS41cHgiPllvdXIgSVJTQSByb2xlPC90ZXh0Pgo8dGV4dCB4PSIxNTMiIHk9Ijc0IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiOCI+VGhlIHJvbGUgYSBwb2QgcnVucyBhczwvdGV4dD4KPGxpbmUgeDE9IjI3OCIgeTE9IjYwIiB4Mj0iMzUyIiB5Mj0iNjAiIHN0cm9rZS13aWR0aD0iMiIgbWFya2VyLWVuZD0idXJsKCNpZGF1dGh6LWs4cy1uKSIgc3R5bGU9InN0cm9rZTojNjQ3NDhiIi8+Cjx0ZXh0IHg9IjMxNSIgeT0iNTIiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4OyBmb250LXNpemU6OC41cHg7ZmlsbDojY2JkNWUxIj5TVFM8L3RleHQ+CjxyZWN0IHg9IjM1NiIgeT0iMzAiIHdpZHRoPSI0NTIiIGhlaWdodD0iNjAiIHJ4PSIxMiIgc3Ryb2tlLXdpZHRoPSIxLjUiIHN0cm9rZS1kYXNoYXJyYXk9IjUgNSIgc3R5bGU9ImZpbGw6IzBmMTcyYTtzdHJva2U6IzQ3NTU2OSIvPgo8dGV4dCB4PSIzNzQiIHk9IjU0IiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogI2YxZjVmOTsgZm9udC1zaXplOjExLjVweDtmaWxsOiNjYmQ1ZTEiPkFXUyByb2xlIHNlc3Npb248L3RleHQ+Cjx0ZXh0IHg9IjM3NCIgeT0iNzQiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4OyBmb250LXNpemU6MTBweCI+SXNzdWVkIGJ5IHRoZSBTVFMgYWRhcHRlcjwvdGV4dD4KPHRleHQgeD0iMjgiIHk9IjExOCIgc3R5bGU9ImZvbnQ6IDcwMCAxMHB4IEludGVyLCBzYW5zLXNlcmlmOyBsZXR0ZXItc3BhY2luZzogMS4zcHg7IGZpbGw6ICM2NDc0OGI7IGZpbGw6Izk0YTNiOCI+UEVSTUlTU0lPTlMgwrcgTUFZIEk8L3RleHQ+CjxyZWN0IHg9IjI4IiB5PSIxMjYiIHdpZHRoPSIyNTAiIGhlaWdodD0iNjAiIHJ4PSIxMiIgc3Ryb2tlLXdpZHRoPSIxLjUiIHN0eWxlPSJmaWxsOiMxZTI5M2I7c3Ryb2tlOiM0NzU1NjkiLz4KPHRleHQgeD0iMTUzIiB5PSIxNTIiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjZjFmNWY5OyBmb250LXNpemU6MTEuNXB4Ij5Zb3VyIEFXUyBJQU0gcG9saWN5PC90ZXh0Pgo8dGV4dCB4PSIxNTMiIHk9IjE3MCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjgiPkFsbG93IGFuZCBEZW55IHJ1bGVzPC90ZXh0Pgo8bGluZSB4MT0iMjc4IiB5MT0iMTU2IiB4Mj0iMzUyIiB5Mj0iMTU2IiBzdHJva2Utd2lkdGg9IjIiIG1hcmtlci1lbmQ9InVybCgjaWRhdXRoei1rOHMpIiBzdHlsZT0ic3Ryb2tlOiM2ZWU3YjciLz4KPHRleHQgeD0iMzE1IiB5PSIxNDgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMC41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2ZWU3Yjc7IGZvbnQtc2l6ZTo4LjVweCI+Y2hlY2tlZDwvdGV4dD4KPHJlY3QgeD0iMzU2IiB5PSIxMjYiIHdpZHRoPSI0NTIiIGhlaWdodD0iNjAiIHJ4PSIxMiIgc3Ryb2tlLXdpZHRoPSIxLjciIHN0eWxlPSJmaWxsOiMwNjRlM2I7c3Ryb2tlOiM2ZWU3YjciLz4KPHRleHQgeD0iMzc0IiB5PSIxNTAiIHN0eWxlPSJmb250OiA3MDAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNmVlN2I3OyBmb250LXNpemU6MTEuNXB4Ij5BV1MgcmVxdWVzdCBjaGVjazwvdGV4dD4KPHRleHQgeD0iMzc0IiB5PSIxNzAiIHN0eWxlPSJmb250OiAxMC41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2ZWU3Yjc7IGZvbnQtc2l6ZToxMHB4Ij5EZW55IG92ZXJyaWRlcyBhbGxvdzwvdGV4dD4KPC9zdmc+)

AWS calls use the selected credential adapter and your role's policy; Kubernetes RBAC and other clouds authorize their own APIs.

#### Limitations

Workloads use the existing cluster's Kubernetes API. This mapping creates no control plane and no nodes.

Where EKS and an existing cluster differ

* **A managed control plane and node pools are not created.** Tensor9 uses the existing cluster's endpoint and credentials. Whoever operates that cluster runs its control plane and nodes.
* **Native cloud identity bindings are not created.** AWS role sessions come from the selected STS or EKS Auth adapter. You must set up credentials or federation separately for real services on other clouds.
* **Fargate is not supported.** The cluster's own nodes run every pod; there is no serverless node capacity.
* **Machine-type mapping and a cloud autoscaler are not set up.** Node sizing, scaling and replacement belong to the cluster's operator.

#### Other considerations

* **Before going live.** Supply the existing cluster's endpoint, certificate authority, client certificate or token, and namespace. Then re-apply your adapted manifests; the move is placing workloads on existing capacity, not building a cluster.
* **Who runs what.** Control-plane availability, version upgrades, node lifecycle and any platform services (ingress, autoscaler, monitoring, backup) stay with the cluster's operator. A managed target would have run them.
* **Test each credential path.** Check Kubernetes RBAC for cluster access, the STS or EKS Auth exchange for AWS calls, and separately authorized credentials or federation for any other cloud.
* **Cost.** There is no managed control-plane charge, but the cluster's capacity, availability and upkeep run on infrastructure the operator owns and staffs.

#### Management and credentials on an existing cluster

This backend uses your existing cluster; it does not provision a managed Kubernetes service. Cluster RBAC and selected AWS role sessions are separate. External cloud access still requires credentials or federation authorized by that provider. See [cluster management and credential separation](https://docs.tensor9.com/cloud-adapter-early-access/service-catalog/aws/compute-containers/eks-cluster.md#runtime-cluster-management-and-credentials) for the common model and its managed-backend restriction.

#### Example monthly charges

This Tensor9 Cloud Adapter scenario estimates service charges for the named origin and target services. Adapter hosting and commercial Tensor9 fees need separate allocations. [How Tensor9 estimates costs](https://docs.tensor9.com/cloud-adapter-early-access/costs/overview.md) explains the method and what the estimates include.

**Native or deployment mapping.** Applications use the target cluster's Kubernetes API directly. This mapping does not expose an EKS management adapter endpoint. Kubernetes API availability and pod scheduling are not measured as service-adapter request latency. Cost estimates describe the selected service resources; operation coverage remains separate.

##### Managed Kubernetes and discovery (EKS) · Worker CPU-hours per month

Feature: Managed Kubernetes and discovery (EKS).

Estimated monthly service charges by Worker CPU-hours per month. Adapter hosting and Tensor9 fees are excluded. Source: us-east-1; target: us-central1; currency: USD.

![Managed Kubernetes and discovery (EKS) · Worker CPU-hours per month: monthly service charges by Worker CPU-hours per month. Exact values are in the following table.](https://docs.tensor9.com/images/cloud-adapter-early-access/diagrams/service-cost/f9d3c937eb022caa9ef45e88e4b979d18abdeb7a8517e92f1d47dee2421bb796-light.svg)

![Managed Kubernetes and discovery (EKS) · Worker CPU-hours per month: monthly service charges by Worker CPU-hours per month. Exact values are in the following table.](https://docs.tensor9.com/images/cloud-adapter-early-access/diagrams/service-cost/10f1024e431341309cce36cd79900c08747146e1862e9cef28b60c89d66d01ad-dark.svg)

Comparison pills describe all sampled scale points; amounts beside each service are for the named workload. Costs The Same means within 20% at every point. Costs Depend includes mixed results and unpriced samples.

Sampled monthly charges in USD, rounded to cents. Difference means target minus origin; a positive difference means the target costs more.

| Worker CPU-hours per month (vCPU-hour/month) | EKS Cluster | Target scenario | Kubernetes Cluster | Difference |
| -: | -: | - | -: | -: |
| 0 | 156.80 | Kubernetes Cluster (one copy) | 577.17 | 420.37 |
| 0 | 156.80 | Kubernetes Cluster (two copies) | 1,154.34 | 997.53 |
| 1,460 | 211.48 | Kubernetes Cluster (one copy) | 577.17 | 365.69 |
| 1,460 | 211.48 | Kubernetes Cluster (two copies) | 1,154.34 | 942.86 |
| 5,840 | 375.51 | Kubernetes Cluster (one copy) | 577.17 | 201.66 |
| 5,840 | 375.51 | Kubernetes Cluster (two copies) | 1,154.34 | 778.83 |
| 23,360 | 1,031.64 | Kubernetes Cluster (one copy) | 2,288.68 | 1,257.04 |
| 23,360 | 1,031.64 | Kubernetes Cluster (two copies) | 4,577.35 | 3,545.72 |
| 93,440 | 3,656.13 | Kubernetes Cluster (one copy) | 5,721.69 | 2,065.56 |
| 93,440 | 3,656.13 | Kubernetes Cluster (two copies) | 11,443.38 | 7,787.25 |
| 373,760 | 14,154.12 | Kubernetes Cluster (one copy) | 21,742.43 | 7,588.31 |
| 373,760 | 14,154.12 | Kubernetes Cluster (two copies) | 43,484.85 | 29,330.74 |

Estimated allocation, not benchmark calibrated: sized from 16 vCPU, 64 GiB memory and 100 GiB SSD at 0 vCPU-hour/month to 19 nodes of 32 vCPU, 128 GiB memory and 100 GiB SSD each at 373,760 vCPU-hour/month.

**Curve assumptions**

| Target scenario | Assumption | Value | Unit |
| - | - | -: | - |
| Kubernetes Cluster (one copy) | Origin list price · Allocated cluster control plane | 0.1 | USD/cluster-hour |
| Kubernetes Cluster (one copy) | Origin list price · Allocated worker CPU | 0.03745 | USD/vCPU-hour |
| Kubernetes Cluster (one copy) | Origin list price · Allocated worker memory | 0.0035875 | USD/GiB-hour |
| Kubernetes Cluster (one copy) | Origin list price · Cluster management requests | 0 | USD/Requests |
| Kubernetes Cluster (one copy) | Target / origin worker allocation | 1.15 | multiplier |
| Kubernetes Cluster (one copy) | Target price guess · read | 0 | USD/read |
| Kubernetes Cluster (one copy) | Target price guess · write | 0 | USD/write |
| Kubernetes Cluster (one copy) | Target price guess · provider operation | 0 | USD/provider operation |
| Kubernetes Cluster (one copy) | Target list price · GiB-month | 0.1 | USD/GiB-month |
| Kubernetes Cluster (one copy) | Target price guess · published GiB | 0 | USD/published GiB |
| Kubernetes Cluster (one copy) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| Kubernetes Cluster (one copy) | Target list price · network GiB | 0.12 | USD/network GiB |
| Kubernetes Cluster (one copy) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| Kubernetes Cluster (one copy) | Target list price · vCPU-hour | 0.031611 | USD/vCPU-hour |
| Kubernetes Cluster (one copy) | Target list price · GiB-hour | 0.004237 | USD/GiB-hour |
| Kubernetes Cluster (one copy) | Target price guess · resource-hour | 0 | USD/resource-hour |
| Kubernetes Cluster (one copy) | Target price guess · resource-month | 0 | USD/resource-month |
| Kubernetes Cluster (one copy) | Target price guess · input token | 0 | USD/input token |
| Kubernetes Cluster (one copy) | Target price guess · output token | 0 | USD/output token |
| Kubernetes Cluster (one copy) | Target monthly base charge | 0 | USD/month |
| Kubernetes Cluster (one copy) | Approximate target service minimum | 0 | USD/month |
| Kubernetes Cluster (one copy) | Minimum primary CPU | 2 | vCPU |
| Kubernetes Cluster (one copy) | Minimum primary RAM | 8 | GiB |
| Kubernetes Cluster (one copy) | Minimum primary disk | 100 | GiB |
| Kubernetes Cluster (one copy) | Additional full-price standby copy | 0 | 0 or 1 |
| Kubernetes Cluster (one copy) | Allocated share of provisioned cost | 1 | fraction |
| Kubernetes Cluster (one copy) | Read/write work per vCPU-second | 1,500 | operations/vCPU-second |
| Kubernetes Cluster (one copy) | Planning peak / mean work | 2 | multiplier |
| Kubernetes Cluster (one copy) | Planning primary CPU utilization | 0.7 | fraction |
| Kubernetes Cluster (one copy) | Resident state reserved in RAM | 0.1 | fraction |
| Kubernetes Cluster (one copy) | Planning disk utilization | 0.8 | fraction |
| Kubernetes Cluster (one copy) | Maintenance and log disk reserve | 20 | GiB |
| Kubernetes Cluster (one copy) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| Kubernetes Cluster (one copy) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| Kubernetes Cluster (one copy) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| Kubernetes Cluster (one copy) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| Kubernetes Cluster (one copy) | Dependent object sink write price guess | 0.000005 | USD/write |
| Kubernetes Cluster (two copies) | Origin list price · Allocated cluster control plane | 0.1 | USD/cluster-hour |
| Kubernetes Cluster (two copies) | Origin list price · Allocated worker CPU | 0.03745 | USD/vCPU-hour |
| Kubernetes Cluster (two copies) | Origin list price · Allocated worker memory | 0.0035875 | USD/GiB-hour |
| Kubernetes Cluster (two copies) | Origin list price · Cluster management requests | 0 | USD/Requests |
| Kubernetes Cluster (two copies) | Target / origin worker allocation | 1.15 | multiplier |
| Kubernetes Cluster (two copies) | Target price guess · read | 0 | USD/read |
| Kubernetes Cluster (two copies) | Target price guess · write | 0 | USD/write |
| Kubernetes Cluster (two copies) | Target price guess · provider operation | 0 | USD/provider operation |
| Kubernetes Cluster (two copies) | Target list price · GiB-month | 0.1 | USD/GiB-month |
| Kubernetes Cluster (two copies) | Target price guess · published GiB | 0 | USD/published GiB |
| Kubernetes Cluster (two copies) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| Kubernetes Cluster (two copies) | Target list price · network GiB | 0.12 | USD/network GiB |
| Kubernetes Cluster (two copies) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| Kubernetes Cluster (two copies) | Target list price · vCPU-hour | 0.031611 | USD/vCPU-hour |
| Kubernetes Cluster (two copies) | Target list price · GiB-hour | 0.004237 | USD/GiB-hour |
| Kubernetes Cluster (two copies) | Target price guess · resource-hour | 0 | USD/resource-hour |
| Kubernetes Cluster (two copies) | Target price guess · resource-month | 0 | USD/resource-month |
| Kubernetes Cluster (two copies) | Target price guess · input token | 0 | USD/input token |
| Kubernetes Cluster (two copies) | Target price guess · output token | 0 | USD/output token |
| Kubernetes Cluster (two copies) | Target monthly base charge | 0 | USD/month |
| Kubernetes Cluster (two copies) | Approximate target service minimum | 0 | USD/month |
| Kubernetes Cluster (two copies) | Minimum primary CPU | 2 | vCPU |
| Kubernetes Cluster (two copies) | Minimum primary RAM | 8 | GiB |
| Kubernetes Cluster (two copies) | Minimum primary disk | 100 | GiB |
| Kubernetes Cluster (two copies) | Additional full-price standby copy | 1 | 0 or 1 |
| Kubernetes Cluster (two copies) | Allocated share of provisioned cost | 1 | fraction |
| Kubernetes Cluster (two copies) | Read/write work per vCPU-second | 1,500 | operations/vCPU-second |
| Kubernetes Cluster (two copies) | Planning peak / mean work | 2 | multiplier |
| Kubernetes Cluster (two copies) | Planning primary CPU utilization | 0.7 | fraction |
| Kubernetes Cluster (two copies) | Resident state reserved in RAM | 0.1 | fraction |
| Kubernetes Cluster (two copies) | Planning disk utilization | 0.8 | fraction |
| Kubernetes Cluster (two copies) | Maintenance and log disk reserve | 20 | GiB |
| Kubernetes Cluster (two copies) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| Kubernetes Cluster (two copies) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| Kubernetes Cluster (two copies) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| Kubernetes Cluster (two copies) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| Kubernetes Cluster (two copies) | Dependent object sink write price guess | 0.000005 | USD/write |

* Only this native meter varies; all other source usage and translation assumptions retain the displayed defaults. Other native meters and workload assumptions retain their explicitly displayed default quantities. Workload translation and capacity assumptions are not benchmark measurements.
* Native monthly usage priced at the cited provider list prices; listed target allowances apply where present, excluding invoice credits, taxes and negotiated discounts. Rates as of 2026-10-22: us-east-1 → us-central1, USD/month.
* Source prices are reference charges, not an invoice. Target lines cover selected service usage/configuration only; adapter hosting and Tensor9 fees are excluded.
* Samples of explicit prices are not performance measurements or capacity qualification. No interpolation or break-even guarantee is implied.
* Variant assumptions show the first axis sample; any axis-dependent configuration is described by this curve's workload note.
* Rates are cited provider list prices, editable for discounts, commitments or another region. Workload translation and capacity coefficients remain editable planning assumptions, not benchmark measurements or a commercial quote.
* Default-zero rates are explicit assumptions, not evidence that the deployed service or resource is free.
* Provisioned-unit minimums use an editable approximate allocation floor. Modeled target service cost is max(usage/allocation, minimum), with billable network, durable staging and dependent sinks added separately; actual RU/TU sizing, scaling increments and throughput remain unqualified.
* Durable staging is priced once: provisioned targets include adapter state in their selected allocation; native targets add a separate staging allocation when required. Adapter hosting is a separate allocation and must exclude resources already priced as staging, workers or target capacity.
* A declared adapter mapping and cost model do not establish implementation availability or service equivalence.
* This is a declared directed mapping; a planning estimate does not establish deployment or request-serving support.
* Native/deployment comparison scope: Applications use the target cluster's Kubernetes API directly. This mapping does not expose an EKS management adapter endpoint. Kubernetes API availability and pod scheduling are not measured as service-adapter request latency.
* Origin unit prices are cited provider list prices; capacity coefficients and translation assumptions are editable authored planning guesses, not measured capacity or a provider quote.
* Management requests do not reveal resource allocation or workload traffic. Provisioned resources and traffic are independent inputs.
* The discovery adapter does not itself own or provision the cluster. Allocate existing cluster capacity once across adapters.
* Self-hosted target: Kubernetes (Apache-2.0, [https://github.com/kubernetes/kubernetes/blob/master/LICENSE](https://github.com/kubernetes/kubernetes/blob/master/LICENSE)); the host cloud's managed control plane is a separate per-cluster-hour allocation. Selected CPU, RAM and physical disk allocation grow with workload; no per-operation price is assumed. No vendor charge: the target runs on the customer's Kubernetes nodes, so CPU, RAM and disk bill at the Kubernetes node reference rates, Compute Engine N2 in us-central1 (USD 0.031611/vCPU-hour, 0.004237/GiB-hour) with pd-balanced disk (0.10/GiB-month) and Premium Tier egress. The cost-optimized E2 series lists 0.02181159/vCPU-hour and 0.00292353/GiB-hour; AWS m6i/r6i and Azure D2s v5/E2s v5 both decompose to 0.033/vCPU-hour and 0.00375/GiB-hour. Requested CPU and RAM are billed; node bin-packing waste, system reservations and the cluster control-plane fee are not.
* Row-store throughput (capacityOpsPerVcpuSecond, default 1500) is measured-by-tensor9 as a lower bound: the DynamoDB adapter on Cloud SQL db-custom-2-7680 (2 vCPU, PostgreSQL 16, us-west1) served 2,974 ops/s of YCSB-A at 16 threads without recorded saturation (src/main/kotlin/t9/prime/equiv/generated/eval/CloudsqlPostgresqlYcsbAT16GoYcsbV1\_0\_0.kt). Published CPU-bound pgbench reaches 3,101 read-write transactions and 20,289 point reads per vCPU-second (AWS z1d.2xlarge, PostgreSQL 14.5), so actual capacity is likely higher. Reads and writes share one coefficient: at the same adapter version, read-only YCSB-C was not faster than 50%-update YCSB-A.
* Log-broker throughput (capacityStreamMiBPerVcpuSecond 20 at 0.5 utilization, 4 GiB RAM per vCPU) is provider-documented by Google Managed Service for Apache Kafka sizing ([https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size](https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size)): write-equivalent bytes are replicated writes plus a quarter of reads. Producer batches below 10 KB lower per-CPU throughput; that penalty is not modeled.
* Disk utilization 0.8 is provider-documented headroom below Cloud SQL automatic storage increase, which triggers near 91-95% full ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)). The 20 GiB reserve exceeds PostgreSQL's 1 GB default max\_wal\_size; the remainder of that reserve is unmeasured.
* CPU tiers double from 2 vCPUs to the target's largest node at 4 GiB per vCPU; each target's documented largest node bounds CPU, RAM, RAM per vCPU and disk, and the durable staging database uses Cloud SQL Enterprise (96 vCPU, 6.5 GiB per vCPU, 624 GiB, 64 TiB). Targets billed per capacity unit or throughput unit are sized by their backend instead.
* No public evidence: peak/mean work (2) and the RAM working-set fraction (0.1). Proposed measurements: the p99 one-minute rate over the monthly mean from customer CloudWatch metrics; the buffer hit ratio while stepping RAM under a fixed YCSB-B load.
* Node bounds: Planning worker node of 32 vCPUs and 128 GiB, not a provider maximum; the cluster adds nodes up to a 1,000-node planning bound. Requested CPU and RAM bill linearly, so the node size changes only rounding.
* Stored GiB already includes the origin family's physical footprint assumptions; no second storage amplification is applied.
* The workload family already selected resource-hours; the throughput coefficient is not applied again.
* Copies and allocation fractions change cost only; they do not increase modeled primary capacity.
* AWS Price List API, AmazonEKS offer: [https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AmazonEKS/current/us-east-1/index.json](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AmazonEKS/current/us-east-1/index.json)
* AWS Price List API, AmazonEC2 offer (CSV): [https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AmazonEC2/current/us-east-1/index.csv](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AmazonEC2/current/us-east-1/index.csv)
* Amazon EKS pricing: [https://aws.amazon.com/eks/pricing/](https://aws.amazon.com/eks/pricing/)
* Compute Engine general-purpose machine pricing: [https://cloud.google.com/products/compute/pricing/general-purpose](https://cloud.google.com/products/compute/pricing/general-purpose)
* Disk and image pricing: [https://cloud.google.com/compute/disks-image-pricing](https://cloud.google.com/compute/disks-image-pricing)
* Network pricing: [https://cloud.google.com/vpc/network-pricing](https://cloud.google.com/vpc/network-pricing)

Cost scope: Modeled target native service and explicitly modeled state allocation; hosting and Tensor9 fees only when supplied.

Excluded costs and workload features:

* Worker disks, GPUs, ingress, network traffic, extended support and observability.
* Taxes, discounts, credits and free-tier allowances not explicitly listed by this model.
* Unmodeled dependent services, task execution and operations outside the selected workload family.

List prices read: 2026-10-22. Model: `plan-ce2b3cb77636f0d9f4da7786e5bf9ce9779b8216` / `2026-10-22.planning.2`. Curve: `workload-1`.

Sources: [AWS Price List API, AmazonEKS offer](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AmazonEKS/current/us-east-1/index.json), [AWS Price List API, AmazonEC2 offer (CSV)](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AmazonEC2/current/us-east-1/index.csv), [Amazon EKS pricing](https://aws.amazon.com/eks/pricing/), [Compute Engine general-purpose machine pricing](https://cloud.google.com/products/compute/pricing/general-purpose), [Disk and image pricing](https://cloud.google.com/compute/disks-image-pricing), [Network pricing](https://cloud.google.com/vpc/network-pricing).

##### Managed Kubernetes and discovery (EKS) · Cluster-hours per month

Feature: Managed Kubernetes and discovery (EKS).

Estimated monthly service charges by Cluster-hours per month. Adapter hosting and Tensor9 fees are excluded. Source: us-east-1; target: us-central1; currency: USD.

![Managed Kubernetes and discovery (EKS) · Cluster-hours per month: monthly service charges by Cluster-hours per month. Exact values are in the following table.](https://docs.tensor9.com/images/cloud-adapter-early-access/diagrams/service-cost/e8aaebccadc3c518e63ba1b1fd54191c689e894d1b828054e7b836e18294d834-light.svg)

![Managed Kubernetes and discovery (EKS) · Cluster-hours per month: monthly service charges by Cluster-hours per month. Exact values are in the following table.](https://docs.tensor9.com/images/cloud-adapter-early-access/diagrams/service-cost/68cdda91bffb523bd6c4c894fcbeebba00987adceea6ec821f1b598dcc1ddceb-dark.svg)

Comparison pills describe all sampled scale points; amounts beside each service are for the named workload. Costs The Same means within 20% at every point. Costs Depend includes mixed results and unpriced samples.

Sampled monthly charges in USD, rounded to cents. Difference means target minus origin; a positive difference means the target costs more.

| Cluster-hours per month (cluster-hour/month) | EKS Cluster | Target scenario | Kubernetes Cluster | Difference |
| -: | -: | - | -: | -: |
| 0 | 302.51 | Kubernetes Cluster (one copy) | 577.17 | 274.66 |
| 0 | 302.51 | Kubernetes Cluster (two copies) | 1,154.34 | 851.83 |
| 730 | 375.51 | Kubernetes Cluster (one copy) | 577.17 | 201.66 |
| 730 | 375.51 | Kubernetes Cluster (two copies) | 1,154.34 | 778.83 |
| 3,650 | 667.51 | Kubernetes Cluster (one copy) | 577.17 | -90.34 |
| 3,650 | 667.51 | Kubernetes Cluster (two copies) | 1,154.34 | 486.83 |
| 7,300 | 1,032.51 | Kubernetes Cluster (one copy) | 577.17 | -455.34 |
| 7,300 | 1,032.51 | Kubernetes Cluster (two copies) | 1,154.34 | 121.83 |
| 36,500 | 3,952.51 | Kubernetes Cluster (one copy) | 577.17 | -3,375.34 |
| 36,500 | 3,952.51 | Kubernetes Cluster (two copies) | 1,154.34 | -2,798.17 |

Estimated allocation, not benchmark calibrated: sized at 16 vCPU, 64 GiB memory and 100 GiB SSD at every sample.

**Curve assumptions**

| Target scenario | Assumption | Value | Unit |
| - | - | -: | - |
| Kubernetes Cluster (one copy) | Origin list price · Allocated cluster control plane | 0.1 | USD/cluster-hour |
| Kubernetes Cluster (one copy) | Origin list price · Allocated worker CPU | 0.03745 | USD/vCPU-hour |
| Kubernetes Cluster (one copy) | Origin list price · Allocated worker memory | 0.0035875 | USD/GiB-hour |
| Kubernetes Cluster (one copy) | Origin list price · Cluster management requests | 0 | USD/Requests |
| Kubernetes Cluster (one copy) | Target / origin worker allocation | 1.15 | multiplier |
| Kubernetes Cluster (one copy) | Target price guess · read | 0 | USD/read |
| Kubernetes Cluster (one copy) | Target price guess · write | 0 | USD/write |
| Kubernetes Cluster (one copy) | Target price guess · provider operation | 0 | USD/provider operation |
| Kubernetes Cluster (one copy) | Target list price · GiB-month | 0.1 | USD/GiB-month |
| Kubernetes Cluster (one copy) | Target price guess · published GiB | 0 | USD/published GiB |
| Kubernetes Cluster (one copy) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| Kubernetes Cluster (one copy) | Target list price · network GiB | 0.12 | USD/network GiB |
| Kubernetes Cluster (one copy) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| Kubernetes Cluster (one copy) | Target list price · vCPU-hour | 0.031611 | USD/vCPU-hour |
| Kubernetes Cluster (one copy) | Target list price · GiB-hour | 0.004237 | USD/GiB-hour |
| Kubernetes Cluster (one copy) | Target price guess · resource-hour | 0 | USD/resource-hour |
| Kubernetes Cluster (one copy) | Target price guess · resource-month | 0 | USD/resource-month |
| Kubernetes Cluster (one copy) | Target price guess · input token | 0 | USD/input token |
| Kubernetes Cluster (one copy) | Target price guess · output token | 0 | USD/output token |
| Kubernetes Cluster (one copy) | Target monthly base charge | 0 | USD/month |
| Kubernetes Cluster (one copy) | Approximate target service minimum | 0 | USD/month |
| Kubernetes Cluster (one copy) | Minimum primary CPU | 2 | vCPU |
| Kubernetes Cluster (one copy) | Minimum primary RAM | 8 | GiB |
| Kubernetes Cluster (one copy) | Minimum primary disk | 100 | GiB |
| Kubernetes Cluster (one copy) | Additional full-price standby copy | 0 | 0 or 1 |
| Kubernetes Cluster (one copy) | Allocated share of provisioned cost | 1 | fraction |
| Kubernetes Cluster (one copy) | Read/write work per vCPU-second | 1,500 | operations/vCPU-second |
| Kubernetes Cluster (one copy) | Planning peak / mean work | 2 | multiplier |
| Kubernetes Cluster (one copy) | Planning primary CPU utilization | 0.7 | fraction |
| Kubernetes Cluster (one copy) | Resident state reserved in RAM | 0.1 | fraction |
| Kubernetes Cluster (one copy) | Planning disk utilization | 0.8 | fraction |
| Kubernetes Cluster (one copy) | Maintenance and log disk reserve | 20 | GiB |
| Kubernetes Cluster (one copy) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| Kubernetes Cluster (one copy) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| Kubernetes Cluster (one copy) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| Kubernetes Cluster (one copy) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| Kubernetes Cluster (one copy) | Dependent object sink write price guess | 0.000005 | USD/write |
| Kubernetes Cluster (two copies) | Origin list price · Allocated cluster control plane | 0.1 | USD/cluster-hour |
| Kubernetes Cluster (two copies) | Origin list price · Allocated worker CPU | 0.03745 | USD/vCPU-hour |
| Kubernetes Cluster (two copies) | Origin list price · Allocated worker memory | 0.0035875 | USD/GiB-hour |
| Kubernetes Cluster (two copies) | Origin list price · Cluster management requests | 0 | USD/Requests |
| Kubernetes Cluster (two copies) | Target / origin worker allocation | 1.15 | multiplier |
| Kubernetes Cluster (two copies) | Target price guess · read | 0 | USD/read |
| Kubernetes Cluster (two copies) | Target price guess · write | 0 | USD/write |
| Kubernetes Cluster (two copies) | Target price guess · provider operation | 0 | USD/provider operation |
| Kubernetes Cluster (two copies) | Target list price · GiB-month | 0.1 | USD/GiB-month |
| Kubernetes Cluster (two copies) | Target price guess · published GiB | 0 | USD/published GiB |
| Kubernetes Cluster (two copies) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| Kubernetes Cluster (two copies) | Target list price · network GiB | 0.12 | USD/network GiB |
| Kubernetes Cluster (two copies) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| Kubernetes Cluster (two copies) | Target list price · vCPU-hour | 0.031611 | USD/vCPU-hour |
| Kubernetes Cluster (two copies) | Target list price · GiB-hour | 0.004237 | USD/GiB-hour |
| Kubernetes Cluster (two copies) | Target price guess · resource-hour | 0 | USD/resource-hour |
| Kubernetes Cluster (two copies) | Target price guess · resource-month | 0 | USD/resource-month |
| Kubernetes Cluster (two copies) | Target price guess · input token | 0 | USD/input token |
| Kubernetes Cluster (two copies) | Target price guess · output token | 0 | USD/output token |
| Kubernetes Cluster (two copies) | Target monthly base charge | 0 | USD/month |
| Kubernetes Cluster (two copies) | Approximate target service minimum | 0 | USD/month |
| Kubernetes Cluster (two copies) | Minimum primary CPU | 2 | vCPU |
| Kubernetes Cluster (two copies) | Minimum primary RAM | 8 | GiB |
| Kubernetes Cluster (two copies) | Minimum primary disk | 100 | GiB |
| Kubernetes Cluster (two copies) | Additional full-price standby copy | 1 | 0 or 1 |
| Kubernetes Cluster (two copies) | Allocated share of provisioned cost | 1 | fraction |
| Kubernetes Cluster (two copies) | Read/write work per vCPU-second | 1,500 | operations/vCPU-second |
| Kubernetes Cluster (two copies) | Planning peak / mean work | 2 | multiplier |
| Kubernetes Cluster (two copies) | Planning primary CPU utilization | 0.7 | fraction |
| Kubernetes Cluster (two copies) | Resident state reserved in RAM | 0.1 | fraction |
| Kubernetes Cluster (two copies) | Planning disk utilization | 0.8 | fraction |
| Kubernetes Cluster (two copies) | Maintenance and log disk reserve | 20 | GiB |
| Kubernetes Cluster (two copies) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| Kubernetes Cluster (two copies) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| Kubernetes Cluster (two copies) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| Kubernetes Cluster (two copies) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| Kubernetes Cluster (two copies) | Dependent object sink write price guess | 0.000005 | USD/write |

* Only this native meter varies; all other source usage and translation assumptions retain the displayed defaults. Other native meters and workload assumptions retain their explicitly displayed default quantities. Workload translation and capacity assumptions are not benchmark measurements.
* Native monthly usage priced at the cited provider list prices; listed target allowances apply where present, excluding invoice credits, taxes and negotiated discounts. Rates as of 2026-10-22: us-east-1 → us-central1, USD/month.
* Source prices are reference charges, not an invoice. Target lines cover selected service usage/configuration only; adapter hosting and Tensor9 fees are excluded.
* Samples of explicit prices are not performance measurements or capacity qualification. No interpolation or break-even guarantee is implied.
* Variant assumptions show the first axis sample; any axis-dependent configuration is described by this curve's workload note.
* Rates are cited provider list prices, editable for discounts, commitments or another region. Workload translation and capacity coefficients remain editable planning assumptions, not benchmark measurements or a commercial quote.
* Default-zero rates are explicit assumptions, not evidence that the deployed service or resource is free.
* Provisioned-unit minimums use an editable approximate allocation floor. Modeled target service cost is max(usage/allocation, minimum), with billable network, durable staging and dependent sinks added separately; actual RU/TU sizing, scaling increments and throughput remain unqualified.
* Durable staging is priced once: provisioned targets include adapter state in their selected allocation; native targets add a separate staging allocation when required. Adapter hosting is a separate allocation and must exclude resources already priced as staging, workers or target capacity.
* A declared adapter mapping and cost model do not establish implementation availability or service equivalence.
* This is a declared directed mapping; a planning estimate does not establish deployment or request-serving support.
* Native/deployment comparison scope: Applications use the target cluster's Kubernetes API directly. This mapping does not expose an EKS management adapter endpoint. Kubernetes API availability and pod scheduling are not measured as service-adapter request latency.
* Origin unit prices are cited provider list prices; capacity coefficients and translation assumptions are editable authored planning guesses, not measured capacity or a provider quote.
* Management requests do not reveal resource allocation or workload traffic. Provisioned resources and traffic are independent inputs.
* The discovery adapter does not itself own or provision the cluster. Allocate existing cluster capacity once across adapters.
* Self-hosted target: Kubernetes (Apache-2.0, [https://github.com/kubernetes/kubernetes/blob/master/LICENSE](https://github.com/kubernetes/kubernetes/blob/master/LICENSE)); the host cloud's managed control plane is a separate per-cluster-hour allocation. Selected CPU, RAM and physical disk allocation grow with workload; no per-operation price is assumed. No vendor charge: the target runs on the customer's Kubernetes nodes, so CPU, RAM and disk bill at the Kubernetes node reference rates, Compute Engine N2 in us-central1 (USD 0.031611/vCPU-hour, 0.004237/GiB-hour) with pd-balanced disk (0.10/GiB-month) and Premium Tier egress. The cost-optimized E2 series lists 0.02181159/vCPU-hour and 0.00292353/GiB-hour; AWS m6i/r6i and Azure D2s v5/E2s v5 both decompose to 0.033/vCPU-hour and 0.00375/GiB-hour. Requested CPU and RAM are billed; node bin-packing waste, system reservations and the cluster control-plane fee are not.
* Row-store throughput (capacityOpsPerVcpuSecond, default 1500) is measured-by-tensor9 as a lower bound: the DynamoDB adapter on Cloud SQL db-custom-2-7680 (2 vCPU, PostgreSQL 16, us-west1) served 2,974 ops/s of YCSB-A at 16 threads without recorded saturation (src/main/kotlin/t9/prime/equiv/generated/eval/CloudsqlPostgresqlYcsbAT16GoYcsbV1\_0\_0.kt). Published CPU-bound pgbench reaches 3,101 read-write transactions and 20,289 point reads per vCPU-second (AWS z1d.2xlarge, PostgreSQL 14.5), so actual capacity is likely higher. Reads and writes share one coefficient: at the same adapter version, read-only YCSB-C was not faster than 50%-update YCSB-A.
* Log-broker throughput (capacityStreamMiBPerVcpuSecond 20 at 0.5 utilization, 4 GiB RAM per vCPU) is provider-documented by Google Managed Service for Apache Kafka sizing ([https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size](https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size)): write-equivalent bytes are replicated writes plus a quarter of reads. Producer batches below 10 KB lower per-CPU throughput; that penalty is not modeled.
* Disk utilization 0.8 is provider-documented headroom below Cloud SQL automatic storage increase, which triggers near 91-95% full ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)). The 20 GiB reserve exceeds PostgreSQL's 1 GB default max\_wal\_size; the remainder of that reserve is unmeasured.
* CPU tiers double from 2 vCPUs to the target's largest node at 4 GiB per vCPU; each target's documented largest node bounds CPU, RAM, RAM per vCPU and disk, and the durable staging database uses Cloud SQL Enterprise (96 vCPU, 6.5 GiB per vCPU, 624 GiB, 64 TiB). Targets billed per capacity unit or throughput unit are sized by their backend instead.
* No public evidence: peak/mean work (2) and the RAM working-set fraction (0.1). Proposed measurements: the p99 one-minute rate over the monthly mean from customer CloudWatch metrics; the buffer hit ratio while stepping RAM under a fixed YCSB-B load.
* Node bounds: Planning worker node of 32 vCPUs and 128 GiB, not a provider maximum; the cluster adds nodes up to a 1,000-node planning bound. Requested CPU and RAM bill linearly, so the node size changes only rounding.
* Stored GiB already includes the origin family's physical footprint assumptions; no second storage amplification is applied.
* The workload family already selected resource-hours; the throughput coefficient is not applied again.
* Copies and allocation fractions change cost only; they do not increase modeled primary capacity.
* AWS Price List API, AmazonEKS offer: [https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AmazonEKS/current/us-east-1/index.json](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AmazonEKS/current/us-east-1/index.json)
* AWS Price List API, AmazonEC2 offer (CSV): [https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AmazonEC2/current/us-east-1/index.csv](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AmazonEC2/current/us-east-1/index.csv)
* Amazon EKS pricing: [https://aws.amazon.com/eks/pricing/](https://aws.amazon.com/eks/pricing/)
* Compute Engine general-purpose machine pricing: [https://cloud.google.com/products/compute/pricing/general-purpose](https://cloud.google.com/products/compute/pricing/general-purpose)
* Disk and image pricing: [https://cloud.google.com/compute/disks-image-pricing](https://cloud.google.com/compute/disks-image-pricing)
* Network pricing: [https://cloud.google.com/vpc/network-pricing](https://cloud.google.com/vpc/network-pricing)

Cost scope: Modeled target native service and explicitly modeled state allocation; hosting and Tensor9 fees only when supplied.

Excluded costs and workload features:

* Worker disks, GPUs, ingress, network traffic, extended support and observability.
* Taxes, discounts, credits and free-tier allowances not explicitly listed by this model.
* Unmodeled dependent services, task execution and operations outside the selected workload family.

List prices read: 2026-10-22. Model: `plan-ce2b3cb77636f0d9f4da7786e5bf9ce9779b8216` / `2026-10-22.planning.2`. Curve: `workload-2`.

Sources: [AWS Price List API, AmazonEKS offer](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AmazonEKS/current/us-east-1/index.json), [AWS Price List API, AmazonEC2 offer (CSV)](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AmazonEC2/current/us-east-1/index.csv), [Amazon EKS pricing](https://aws.amazon.com/eks/pricing/), [Compute Engine general-purpose machine pricing](https://cloud.google.com/products/compute/pricing/general-purpose), [Disk and image pricing](https://cloud.google.com/compute/disks-image-pricing), [Network pricing](https://cloud.google.com/vpc/network-pricing).

**Managed Kubernetes and discovery (EKS) → Kubernetes Cluster: Authored native-usage planning example.** Native monthly usage priced at the cited provider list prices; listed target allowances apply where present, excluding invoice credits, taxes and negotiated discounts.

Scenario source region: us-east-1. Scenario target region: us-central1. Currency: USD.

| Monthly component | USD |
| - | -: |
| Origin: Allocated cluster control plane | 73.00 |
| Origin: Allocated worker CPU | 218.71 |
| Origin: Allocated worker memory | 83.80 |
| Origin: Cluster management requests | 0.00 |
| Target: Provisioned primary CPU | 369.22 |
| Target: Provisioned primary RAM | 197.95 |
| Target: Provisioned primary disk | 10.00 |
| Target: Selected billable network | 0.00 |
| Target: Independent provisioned resources | 0.00 |
| Target: Independent managed resources | 0.00 |
| **Origin service subtotal** | **375.51** |
| **Target service subtotal** | **577.17** |

Estimated allocation, not benchmark calibrated: sized at 16 vCPU, 64 GiB memory and 100 GiB SSD for this scenario.

Unestimated components: Adapter hosting, Tensor9 fees. A modeled adapted total and savings require these costs.

Cost scope: Modeled target native service and explicitly modeled state allocation; hosting and Tensor9 fees only when supplied.

Excluded costs and workload features:

* Worker disks, GPUs, ingress, network traffic, extended support and observability.
* Taxes, discounts, credits and free-tier allowances not explicitly listed by this model.
* Unmodeled dependent services, task execution and operations outside the selected workload family.

**Scenario assumptions**

| Input | Value | Unit |
| - | -: | - |
| Origin list price · Allocated cluster control plane | 0.1 | USD/cluster-hour |
| Origin list price · Allocated worker CPU | 0.03745 | USD/vCPU-hour |
| Origin list price · Allocated worker memory | 0.0035875 | USD/GiB-hour |
| Origin list price · Cluster management requests | 0 | USD/Requests |
| Target / origin worker allocation | 1.15 | multiplier |
| Target price guess · read | 0 | USD/read |
| Target price guess · write | 0 | USD/write |
| Target price guess · provider operation | 0 | USD/provider operation |
| Target list price · GiB-month | 0.1 | USD/GiB-month |
| Target price guess · published GiB | 0 | USD/published GiB |
| Target price guess · delivered GiB | 0 | USD/delivered GiB |
| Target list price · network GiB | 0.12 | USD/network GiB |
| Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| Target list price · vCPU-hour | 0.031611 | USD/vCPU-hour |
| Target list price · GiB-hour | 0.004237 | USD/GiB-hour |
| Target price guess · resource-hour | 0 | USD/resource-hour |
| Target price guess · resource-month | 0 | USD/resource-month |
| Target price guess · input token | 0 | USD/input token |
| Target price guess · output token | 0 | USD/output token |
| Target monthly base charge | 0 | USD/month |
| Approximate target service minimum | 0 | USD/month |
| Minimum primary CPU | 2 | vCPU |
| Minimum primary RAM | 8 | GiB |
| Minimum primary disk | 100 | GiB |
| Additional full-price standby copy | 0 | 0 or 1 |
| Allocated share of provisioned cost | 1 | fraction |
| Read/write work per vCPU-second | 1,500 | operations/vCPU-second |
| Planning peak / mean work | 2 | multiplier |
| Planning primary CPU utilization | 0.7 | fraction |
| Resident state reserved in RAM | 0.1 | fraction |
| Planning disk utilization | 0.8 | fraction |
| Maintenance and log disk reserve | 20 | GiB |
| Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| Dependent object sink write price guess | 0.000005 | USD/write |
| Allocated cluster control plane | 730 | cluster-hour |
| Allocated worker CPU | 5,840 | vCPU-hour |
| Allocated worker memory | 23,360 | GiB-hour |
| Cluster management requests | 1,000,000 | Requests |

* Translated reads: 0 operations.

* Translated writes: 0 operations.

* Translated resident physical data: 0 GiB-month.

* Native provider operations: 1,000,000 operations.

* Published payload: 0 GiB.

* Delivered payload: 0 GiB.

* Allocated execution CPU: 6,716 vCPU-hour.

* Allocated execution RAM: 26,864 GiB-hour.

* Independent resource allocation: 730 resource-hour.

* Independent inventory: 0 resource-month.

* Input tokens: 0 tokens.

* Output tokens: 0 tokens.

* Billable network: 0 GiB.

* Dependent object sink retained data: 0 GiB-month.

* Dependent object sink writes: 0 writes.

* Rates are cited provider list prices, editable for discounts, commitments or another region. Workload translation and capacity coefficients remain editable planning assumptions, not benchmark measurements or a commercial quote.

* Default-zero rates are explicit assumptions, not evidence that the deployed service or resource is free.

* Provisioned-unit minimums use an editable approximate allocation floor. Modeled target service cost is max(usage/allocation, minimum), with billable network, durable staging and dependent sinks added separately; actual RU/TU sizing, scaling increments and throughput remain unqualified.

* Durable staging is priced once: provisioned targets include adapter state in their selected allocation; native targets add a separate staging allocation when required. Adapter hosting is a separate allocation and must exclude resources already priced as staging, workers or target capacity.

* A declared adapter mapping and cost model do not establish implementation availability or service equivalence.

* This is a declared directed mapping; a planning estimate does not establish deployment or request-serving support.

* Native/deployment comparison scope: Applications use the target cluster's Kubernetes API directly. This mapping does not expose an EKS management adapter endpoint. Kubernetes API availability and pod scheduling are not measured as service-adapter request latency.

* Origin unit prices are cited provider list prices; capacity coefficients and translation assumptions are editable authored planning guesses, not measured capacity or a provider quote.

* Management requests do not reveal resource allocation or workload traffic. Provisioned resources and traffic are independent inputs.

* The discovery adapter does not itself own or provision the cluster. Allocate existing cluster capacity once across adapters.

* Self-hosted target: Kubernetes (Apache-2.0, [https://github.com/kubernetes/kubernetes/blob/master/LICENSE](https://github.com/kubernetes/kubernetes/blob/master/LICENSE)); the host cloud's managed control plane is a separate per-cluster-hour allocation. Selected CPU, RAM and physical disk allocation grow with workload; no per-operation price is assumed. No vendor charge: the target runs on the customer's Kubernetes nodes, so CPU, RAM and disk bill at the Kubernetes node reference rates, Compute Engine N2 in us-central1 (USD 0.031611/vCPU-hour, 0.004237/GiB-hour) with pd-balanced disk (0.10/GiB-month) and Premium Tier egress. The cost-optimized E2 series lists 0.02181159/vCPU-hour and 0.00292353/GiB-hour; AWS m6i/r6i and Azure D2s v5/E2s v5 both decompose to 0.033/vCPU-hour and 0.00375/GiB-hour. Requested CPU and RAM are billed; node bin-packing waste, system reservations and the cluster control-plane fee are not.

* Row-store throughput (capacityOpsPerVcpuSecond, default 1500) is measured-by-tensor9 as a lower bound: the DynamoDB adapter on Cloud SQL db-custom-2-7680 (2 vCPU, PostgreSQL 16, us-west1) served 2,974 ops/s of YCSB-A at 16 threads without recorded saturation (src/main/kotlin/t9/prime/equiv/generated/eval/CloudsqlPostgresqlYcsbAT16GoYcsbV1\_0\_0.kt). Published CPU-bound pgbench reaches 3,101 read-write transactions and 20,289 point reads per vCPU-second (AWS z1d.2xlarge, PostgreSQL 14.5), so actual capacity is likely higher. Reads and writes share one coefficient: at the same adapter version, read-only YCSB-C was not faster than 50%-update YCSB-A.

* Log-broker throughput (capacityStreamMiBPerVcpuSecond 20 at 0.5 utilization, 4 GiB RAM per vCPU) is provider-documented by Google Managed Service for Apache Kafka sizing ([https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size](https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size)): write-equivalent bytes are replicated writes plus a quarter of reads. Producer batches below 10 KB lower per-CPU throughput; that penalty is not modeled.

* Disk utilization 0.8 is provider-documented headroom below Cloud SQL automatic storage increase, which triggers near 91-95% full ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)). The 20 GiB reserve exceeds PostgreSQL's 1 GB default max\_wal\_size; the remainder of that reserve is unmeasured.

* CPU tiers double from 2 vCPUs to the target's largest node at 4 GiB per vCPU; each target's documented largest node bounds CPU, RAM, RAM per vCPU and disk, and the durable staging database uses Cloud SQL Enterprise (96 vCPU, 6.5 GiB per vCPU, 624 GiB, 64 TiB). Targets billed per capacity unit or throughput unit are sized by their backend instead.

* No public evidence: peak/mean work (2) and the RAM working-set fraction (0.1). Proposed measurements: the p99 one-minute rate over the monthly mean from customer CloudWatch metrics; the buffer hit ratio while stepping RAM under a fixed YCSB-B load.

* Node bounds: Planning worker node of 32 vCPUs and 128 GiB, not a provider maximum; the cluster adds nodes up to a 1,000-node planning bound. Requested CPU and RAM bill linearly, so the node size changes only rounding.

* Stored GiB already includes the origin family's physical footprint assumptions; no second storage amplification is applied.

* The workload family already selected resource-hours; the throughput coefficient is not applied again.

* Copies and allocation fractions change cost only; they do not increase modeled primary capacity.

List prices read: 2026-10-22. Model: `plan-ce2b3cb77636f0d9f4da7786e5bf9ce9779b8216` / `2026-10-22.planning.2`. Scenario: `planning-example`.

Sources: [AWS Price List API, AmazonEKS offer](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AmazonEKS/current/us-east-1/index.json), [AWS Price List API, AmazonEC2 offer (CSV)](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AmazonEC2/current/us-east-1/index.csv), [Amazon EKS pricing](https://aws.amazon.com/eks/pricing/), [Compute Engine general-purpose machine pricing](https://cloud.google.com/products/compute/pricing/general-purpose), [Disk and image pricing](https://cloud.google.com/compute/disks-image-pricing), [Network pricing](https://cloud.google.com/vpc/network-pricing).

## On Azure

### AKS Cluster

| Operation | Area | Support | Depth | Notes |
| - | - | - | - | - |
| DescribeCluster / ListClusters | EKS management API | Supported | Common | if a workload calls the EKS management API at runtime, it is translated to the backend's managed-Kubernetes API |
| CreateCluster / DeleteCluster / node pools | Provisioning | Supported | Most usage | Max lifecycle requests reconcile an AKS cluster and node pools; readiness is asynchronous and backend settings apply |
| Fargate profile | Serverless nodes | Out of scope | Full surface | no AKS analog; pods reschedule onto node pools; Fargate-only cluster stops the build |
| In-cluster Kubernetes API (client-go / in-cluster config) | Workload | Supported | Full surface | native AKS API server: standard workload verbs and objects; cloud-specific integrations need backend configuration |

#### How it works

Your Deployments, Services and other Kubernetes objects keep working, because AKS serves the same Kubernetes API as EKS. At build time, Tensor9 turns your EKS cluster definition into an **AKS** cluster. Microsoft operates the control plane, including upgrades, availability and API server scaling. The cluster uses a system-assigned **managed identity** in Microsoft Entra ID to reach Azure resources.

AKS manages upgrades and keeps the cluster on a supported version. Instead of the exact minor version EKS lets you choose, the cluster uses AKS's **recommended default** near the version you asked for, and the build reports which version was chosen. AKS also requires a **system node pool**, which runs the cluster's own pods; the next sections explain how your node groups fill it.

![Your EKS cluster becomes an AKS cluster that Microsoft runs, with a managed identity in Microsoft Entra ID. Both serve the same Kubernetes API. AKS uses its recommended default version, and the build reports it.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMTc2IiB2aWV3Qm94PSIwIDAgODM2IDE3NiIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJZb3VyIEVLUyBjbHVzdGVyIGJlY29tZXMgYW4gQUtTIGNsdXN0ZXIgdGhhdCBNaWNyb3NvZnQgcnVucywgd2l0aCBhIG1hbmFnZWQgaWRlbnRpdHkgaW4gTWljcm9zb2Z0IEVudHJhIElELiBCb3RoIHNlcnZlIHRoZSBzYW1lIEt1YmVybmV0ZXMgQVBJLiBBS1MgdXNlcyBpdHMgcmVjb21tZW5kZWQgZGVmYXVsdCB2ZXJzaW9uLCBhbmQgdGhlIGJ1aWxkIHJlcG9ydHMgaXQuIj48c3R5bGU+dGV4dHtmb250LWZhbWlseTpJbnRlciwtYXBwbGUtc3lzdGVtLEJsaW5rTWFjU3lzdGVtRm9udCwnU2Vnb2UgVUknLFJvYm90bywnSGVsdmV0aWNhIE5ldWUnLEFyaWFsLHNhbnMtc2VyaWY7ZmlsbDojMzM0MTU1fTwvc3R5bGU+CjxkZWZzPjxtYXJrZXIgaWQ9ImNwLWFrcyIgdmlld0JveD0iMCAwIDEwIDEwIiByZWZYPSI4IiByZWZZPSI1IiBtYXJrZXJXaWR0aD0iNyIgbWFya2VySGVpZ2h0PSI3IiBvcmllbnQ9ImF1dG8tc3RhcnQtcmV2ZXJzZSI+PHBhdGggZD0iTTAsMCBMMTAsNSBMMCwxMCB6IiBzdHlsZT0iZmlsbDojMDQ3ODU3Ii8+PC9tYXJrZXI+PC9kZWZzPgo8cmVjdCB4PSIyOCIgeT0iNDAiIHdpZHRoPSIzNDAiIGhlaWdodD0iNzIiIHJ4PSIxMiIgc3Ryb2tlLXdpZHRoPSIxLjUiIHN0eWxlPSJmaWxsOiNmZmZmZmY7c3Ryb2tlOiNjYmQ1ZTEiLz4KPHRleHQgeD0iMTk4IiB5PSI3MiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwZjE3MmE7IGZvbnQtc2l6ZToxMS41cHgiPkVLUyBjb250cm9sIHBsYW5lPC90ZXh0Pgo8dGV4dCB4PSIxOTgiIHk9IjkyIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YiI+UnVuIGJ5IEFXUzwvdGV4dD4KPGxpbmUgeDE9IjM3MCIgeTE9Ijc2IiB4Mj0iNDUyIiB5Mj0iNzYiIHN0cm9rZS13aWR0aD0iMiIgbWFya2VyLWVuZD0idXJsKCNjcC1ha3MpIiBzdHlsZT0ic3Ryb2tlOiMwNDc4NTciLz4KPHRleHQgeD0iNDExIiB5PSI2OCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzA0Nzg1NzsgZm9udC1zaXplOjlweCI+c2FtZSBBUEk8L3RleHQ+CjxyZWN0IHg9IjQ2NiIgeT0iNDAiIHdpZHRoPSIzNDIiIGhlaWdodD0iNzIiIHJ4PSIxMiIgc3Ryb2tlLXdpZHRoPSIxLjciIHN0eWxlPSJmaWxsOiNlY2ZkZjU7c3Ryb2tlOiMwNDc4NTciLz4KPHRleHQgeD0iNjM3IiB5PSI3MiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDcwMCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwNDc4NTc7IGZvbnQtc2l6ZToxMS41cHgiPkFLUyBjb250cm9sIHBsYW5lPC90ZXh0Pgo8dGV4dCB4PSI2MzciIHk9IjkyIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTAuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMDQ3ODU3Ij5SdW4gYnkgTWljcm9zb2Z0PC90ZXh0Pgo8cmVjdCB4PSIyOCIgeT0iMTI4IiB3aWR0aD0iNzgwIiBoZWlnaHQ9IjM0IiByeD0iMTAiIHN0cm9rZS13aWR0aD0iMS40IiBzdHlsZT0iZmlsbDojZjhmYWZjO3N0cm9rZTojY2JkNWUxIi8+Cjx0ZXh0IHg9IjQxOCIgeT0iMTUwIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YiI+VmVyc2lvbjogQUtTJ3MgcmVjb21tZW5kZWQgZGVmYXVsdDsgdGhlIGJ1aWxkIHJlcG9ydHMgd2hpY2ggb25lLjwvdGV4dD4KPC9zdmc+)

![Your EKS cluster becomes an AKS cluster that Microsoft runs, with a managed identity in Microsoft Entra ID. Both serve the same Kubernetes API. AKS uses its recommended default version, and the build reports it.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMTc2IiB2aWV3Qm94PSIwIDAgODM2IDE3NiIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJZb3VyIEVLUyBjbHVzdGVyIGJlY29tZXMgYW4gQUtTIGNsdXN0ZXIgdGhhdCBNaWNyb3NvZnQgcnVucywgd2l0aCBhIG1hbmFnZWQgaWRlbnRpdHkgaW4gTWljcm9zb2Z0IEVudHJhIElELiBCb3RoIHNlcnZlIHRoZSBzYW1lIEt1YmVybmV0ZXMgQVBJLiBBS1MgdXNlcyBpdHMgcmVjb21tZW5kZWQgZGVmYXVsdCB2ZXJzaW9uLCBhbmQgdGhlIGJ1aWxkIHJlcG9ydHMgaXQuIj48c3R5bGU+dGV4dHtmb250LWZhbWlseTpJbnRlciwtYXBwbGUtc3lzdGVtLEJsaW5rTWFjU3lzdGVtRm9udCwnU2Vnb2UgVUknLFJvYm90bywnSGVsdmV0aWNhIE5ldWUnLEFyaWFsLHNhbnMtc2VyaWY7ZmlsbDojY2JkNWUxfTwvc3R5bGU+CjxkZWZzPjxtYXJrZXIgaWQ9ImNwLWFrcyIgdmlld0JveD0iMCAwIDEwIDEwIiByZWZYPSI4IiByZWZZPSI1IiBtYXJrZXJXaWR0aD0iNyIgbWFya2VySGVpZ2h0PSI3IiBvcmllbnQ9ImF1dG8tc3RhcnQtcmV2ZXJzZSI+PHBhdGggZD0iTTAsMCBMMTAsNSBMMCwxMCB6IiBzdHlsZT0iZmlsbDojNmVlN2I3Ii8+PC9tYXJrZXI+PC9kZWZzPgo8cmVjdCB4PSIyOCIgeT0iNDAiIHdpZHRoPSIzNDAiIGhlaWdodD0iNzIiIHJ4PSIxMiIgc3Ryb2tlLXdpZHRoPSIxLjUiIHN0eWxlPSJmaWxsOiMxZTI5M2I7c3Ryb2tlOiM0NzU1NjkiLz4KPHRleHQgeD0iMTk4IiB5PSI3MiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICNmMWY1Zjk7IGZvbnQtc2l6ZToxMS41cHgiPkVLUyBjb250cm9sIHBsYW5lPC90ZXh0Pgo8dGV4dCB4PSIxOTgiIHk9IjkyIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiOCI+UnVuIGJ5IEFXUzwvdGV4dD4KPGxpbmUgeDE9IjM3MCIgeTE9Ijc2IiB4Mj0iNDUyIiB5Mj0iNzYiIHN0cm9rZS13aWR0aD0iMiIgbWFya2VyLWVuZD0idXJsKCNjcC1ha3MpIiBzdHlsZT0ic3Ryb2tlOiM2ZWU3YjciLz4KPHRleHQgeD0iNDExIiB5PSI2OCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzZlZTdiNzsgZm9udC1zaXplOjlweCI+c2FtZSBBUEk8L3RleHQ+CjxyZWN0IHg9IjQ2NiIgeT0iNDAiIHdpZHRoPSIzNDIiIGhlaWdodD0iNzIiIHJ4PSIxMiIgc3Ryb2tlLXdpZHRoPSIxLjciIHN0eWxlPSJmaWxsOiMwNjRlM2I7c3Ryb2tlOiM2ZWU3YjciLz4KPHRleHQgeD0iNjM3IiB5PSI3MiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDcwMCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2ZWU3Yjc7IGZvbnQtc2l6ZToxMS41cHgiPkFLUyBjb250cm9sIHBsYW5lPC90ZXh0Pgo8dGV4dCB4PSI2MzciIHk9IjkyIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTAuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNmVlN2I3Ij5SdW4gYnkgTWljcm9zb2Z0PC90ZXh0Pgo8cmVjdCB4PSIyOCIgeT0iMTI4IiB3aWR0aD0iNzgwIiBoZWlnaHQ9IjM0IiByeD0iMTAiIHN0cm9rZS13aWR0aD0iMS40IiBzdHlsZT0iZmlsbDojMGYxNzJhO3N0cm9rZTojNDc1NTY5Ii8+Cjx0ZXh0IHg9IjQxOCIgeT0iMTUwIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiOCI+VmVyc2lvbjogQUtTJ3MgcmVjb21tZW5kZWQgZGVmYXVsdDsgdGhlIGJ1aWxkIHJlcG9ydHMgd2hpY2ggb25lLjwvdGV4dD4KPC9zdmc+)

Tensor9 creates an AKS cluster that Microsoft operates, with a managed identity in Microsoft Entra ID.

#### Add-ons and your manifests

Tensor9 creates the cluster, its node pools, Azure Workload Identity and pod networking. The core EKS add-ons (the VPC CNI, CoreDNS, kube-proxy and the EBS CSI driver) are replaced by AKS's own built-in components. A non-core EKS add-on with no AKS equivalent is dropped, and the build reports it.

AKS also offers optional add-ons and extensions, such as KEDA, Dapr, GitOps with Flux, Azure Policy, Container Insights, the Key Vault Secrets Store CSI driver, application routing (managed NGINX ingress) and virtual nodes on Azure Container Instances. Tensor9 does not turn these on.

Standard Kubernetes objects need no change. Review the AWS-specific parts of your manifests and Helm values (identity annotations, storage classes, ingress controllers and add-ons) and adapt them to AKS.

#### Nodes and scaling

Your first EKS node group becomes the AKS **system node pool**, and each further group becomes its own node pool. If you declare no node groups, or every group uses `count` or `for_each`, Tensor9 adds a small system pool of one `Standard_D2s_v5` node, and the build warns you. Each instance type maps to an Azure VM size of the same hardware class, with `Standard_D2s_v5` as the default when nothing more specific fits.

Your node-group scaling settings become the AKS **cluster autoscaler**. AKS virtual nodes are a different model and do not replace EKS Fargate; see Limitations.

#### Identity and permissions (IRSA → Microsoft Entra Workload ID)

On EKS, **IRSA** (IAM Roles for Service Accounts) gives a pod an IAM role to run as, and the role's policies decide what it may do. Both are kept, as two separate parts.

**Who the pod is.** Identity calls such as `aws sts get-caller-identity` and `iam:GetRole` are answered inside the Cloud Adapter deployment, from the identity given to the pod. They return your own role and account (the same account the instance metadata returns) without contacting AWS. On AKS, the pod is also linked to Azure through **Microsoft Entra Workload ID**. The cluster's OIDC issuer is turned on, and each workload's Kubernetes service account is federated to a **user-assigned managed identity** by a federated identity credential. The `azure.workload.identity` annotations mark the pod. The pod exchanges its service account token for Entra tokens, with no long-lived secret.

**What the pod may do.** Tensor9 converts the supported rules of your AWS IAM policies at build time. The Cloud Adapter deployment checks each AWS request from the pod (role, action and resource) against them, and an explicit deny wins over an allow. Policy updates are verified before the Cloud Adapter deployment uses them. Native Azure permissions are granted separately to the managed identity; they do not replace the AWS policy or supply its AWS role session. The STS or EKS Auth adapter you select supplies AWS credentials for supported AWS API calls.

![Identity: your IRSA role is linked to Microsoft Entra Workload ID, and get-caller-identity returns your own role. Permissions: the Cloud Adapter deployment checks each AWS request against your AWS IAM policy, and a deny overrides an allow. Azure permissions are granted separately.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjAwIiB2aWV3Qm94PSIwIDAgODM2IDIwMCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJJZGVudGl0eTogeW91ciBJUlNBIHJvbGUgaXMgbGlua2VkIHRvIE1pY3Jvc29mdCBFbnRyYSBXb3JrbG9hZCBJRCwgYW5kIGdldC1jYWxsZXItaWRlbnRpdHkgcmV0dXJucyB5b3VyIG93biByb2xlLiBQZXJtaXNzaW9uczogdGhlIGFwcGxpYW5jZSBjaGVja3MgZWFjaCBBV1MgcmVxdWVzdCBhZ2FpbnN0IHlvdXIgQVdTIElBTSBwb2xpY3ksIGFuZCBhIGRlbnkgb3ZlcnJpZGVzIGFuIGFsbG93LiBBenVyZSBwZXJtaXNzaW9ucyBhcmUgZ3JhbnRlZCBzZXBhcmF0ZWx5LiI+PHN0eWxlPnRleHR7Zm9udC1mYW1pbHk6SW50ZXIsLWFwcGxlLXN5c3RlbSxCbGlua01hY1N5c3RlbUZvbnQsJ1NlZ29lIFVJJyxSb2JvdG8sJ0hlbHZldGljYSBOZXVlJyxBcmlhbCxzYW5zLXNlcmlmO2ZpbGw6IzMzNDE1NX08L3N0eWxlPgo8ZGVmcz48bWFya2VyIGlkPSJpZGF1dGh6LWFrcyIgdmlld0JveD0iMCAwIDEwIDEwIiByZWZYPSI4IiByZWZZPSI1IiBtYXJrZXJXaWR0aD0iNyIgbWFya2VySGVpZ2h0PSI3IiBvcmllbnQ9ImF1dG8tc3RhcnQtcmV2ZXJzZSI+PHBhdGggZD0iTTAsMCBMMTAsNSBMMCwxMCB6IiBzdHlsZT0iZmlsbDojMDQ3ODU3Ii8+PC9tYXJrZXI+PC9kZWZzPgo8dGV4dCB4PSIyOCIgeT0iMjIiIHN0eWxlPSJmb250OiA3MDAgMTBweCBJbnRlciwgc2Fucy1zZXJpZjsgbGV0dGVyLXNwYWNpbmc6IDEuM3B4OyBmaWxsOiAjOTRhM2I4OyBmaWxsOiM2NDc0OGIiPklERU5USVRZIMK3IFdITyBBTSBJPC90ZXh0Pgo8cmVjdCB4PSIyOCIgeT0iMzAiIHdpZHRoPSIyNTAiIGhlaWdodD0iNjAiIHJ4PSIxMiIgc3Ryb2tlLXdpZHRoPSIxLjUiIHN0eWxlPSJmaWxsOiNmZmZmZmY7c3Ryb2tlOiNjYmQ1ZTEiLz4KPHRleHQgeD0iMTUzIiB5PSI1NiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwZjE3MmE7IGZvbnQtc2l6ZToxMS41cHgiPllvdXIgSVJTQSByb2xlPC90ZXh0Pgo8dGV4dCB4PSIxNTMiIHk9Ijc0IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YiI+VGhlIHJvbGUgYSBwb2QgcnVucyBhczwvdGV4dD4KPGxpbmUgeDE9IjI3OCIgeTE9IjYwIiB4Mj0iMzUyIiB5Mj0iNjAiIHN0cm9rZS13aWR0aD0iMiIgbWFya2VyLWVuZD0idXJsKCNpZGF1dGh6LWFrcykiIHN0eWxlPSJzdHJva2U6IzA0Nzg1NyIvPgo8dGV4dCB4PSIzMTUiIHk9IjUyIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTAuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMDQ3ODU3OyBmb250LXNpemU6OC41cHgiPmxpbmtlZDwvdGV4dD4KPHJlY3QgeD0iMzU2IiB5PSIzMCIgd2lkdGg9IjQ1MiIgaGVpZ2h0PSI2MCIgcng9IjEyIiBzdHJva2Utd2lkdGg9IjEuNyIgc3R5bGU9ImZpbGw6I2VjZmRmNTtzdHJva2U6IzA0Nzg1NyIvPgo8dGV4dCB4PSIzNzQiIHk9IjU0IiBzdHlsZT0iZm9udDogNzAwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzA0Nzg1NzsgZm9udC1zaXplOjExLjVweCI+TWljcm9zb2Z0IEVudHJhIFdvcmtsb2FkIElEPC90ZXh0Pgo8dGV4dCB4PSIzNzQiIHk9Ijc0IiBzdHlsZT0iZm9udDogMTAuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMDQ3ODU3OyBmb250LXNpemU6MTBweCI+UmV0dXJucyB5b3VyIG93biByb2xlPC90ZXh0Pgo8dGV4dCB4PSIyOCIgeT0iMTE4IiBzdHlsZT0iZm9udDogNzAwIDEwcHggSW50ZXIsIHNhbnMtc2VyaWY7IGxldHRlci1zcGFjaW5nOiAxLjNweDsgZmlsbDogIzk0YTNiODsgZmlsbDojNjQ3NDhiIj5QRVJNSVNTSU9OUyDCtyBNQVkgSTwvdGV4dD4KPHJlY3QgeD0iMjgiIHk9IjEyNiIgd2lkdGg9IjI1MCIgaGVpZ2h0PSI2MCIgcng9IjEyIiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6I2ZmZmZmZjtzdHJva2U6I2NiZDVlMSIvPgo8dGV4dCB4PSIxNTMiIHk9IjE1MiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwZjE3MmE7IGZvbnQtc2l6ZToxMS41cHgiPllvdXIgQVdTIElBTSBwb2xpY3k8L3RleHQ+Cjx0ZXh0IHg9IjE1MyIgeT0iMTcwIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YiI+QWxsb3cgYW5kIERlbnkgcnVsZXM8L3RleHQ+CjxsaW5lIHgxPSIyNzgiIHkxPSIxNTYiIHgyPSIzNTIiIHkyPSIxNTYiIHN0cm9rZS13aWR0aD0iMiIgbWFya2VyLWVuZD0idXJsKCNpZGF1dGh6LWFrcykiIHN0eWxlPSJzdHJva2U6IzA0Nzg1NyIvPgo8dGV4dCB4PSIzMTUiIHk9IjE0OCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzA0Nzg1NzsgZm9udC1zaXplOjguNXB4Ij5jaGVja2VkPC90ZXh0Pgo8cmVjdCB4PSIzNTYiIHk9IjEyNiIgd2lkdGg9IjQ1MiIgaGVpZ2h0PSI2MCIgcng9IjEyIiBzdHJva2Utd2lkdGg9IjEuNyIgc3R5bGU9ImZpbGw6I2VjZmRmNTtzdHJva2U6IzA0Nzg1NyIvPgo8dGV4dCB4PSIzNzQiIHk9IjE1MCIgc3R5bGU9ImZvbnQ6IDcwMCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwNDc4NTc7IGZvbnQtc2l6ZToxMS41cHgiPkFXUyByZXF1ZXN0IGNoZWNrPC90ZXh0Pgo8dGV4dCB4PSIzNzQiIHk9IjE3MCIgc3R5bGU9ImZvbnQ6IDEwLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzA0Nzg1NzsgZm9udC1zaXplOjEwcHgiPkRlbnkgb3ZlcnJpZGVzIGFsbG93PC90ZXh0Pgo8L3N2Zz4=)

![Identity: your IRSA role is linked to Microsoft Entra Workload ID, and get-caller-identity returns your own role. Permissions: the Cloud Adapter deployment checks each AWS request against your AWS IAM policy, and a deny overrides an allow. Azure permissions are granted separately.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjAwIiB2aWV3Qm94PSIwIDAgODM2IDIwMCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJJZGVudGl0eTogeW91ciBJUlNBIHJvbGUgaXMgbGlua2VkIHRvIE1pY3Jvc29mdCBFbnRyYSBXb3JrbG9hZCBJRCwgYW5kIGdldC1jYWxsZXItaWRlbnRpdHkgcmV0dXJucyB5b3VyIG93biByb2xlLiBQZXJtaXNzaW9uczogdGhlIGFwcGxpYW5jZSBjaGVja3MgZWFjaCBBV1MgcmVxdWVzdCBhZ2FpbnN0IHlvdXIgQVdTIElBTSBwb2xpY3ksIGFuZCBhIGRlbnkgb3ZlcnJpZGVzIGFuIGFsbG93LiBBenVyZSBwZXJtaXNzaW9ucyBhcmUgZ3JhbnRlZCBzZXBhcmF0ZWx5LiI+PHN0eWxlPnRleHR7Zm9udC1mYW1pbHk6SW50ZXIsLWFwcGxlLXN5c3RlbSxCbGlua01hY1N5c3RlbUZvbnQsJ1NlZ29lIFVJJyxSb2JvdG8sJ0hlbHZldGljYSBOZXVlJyxBcmlhbCxzYW5zLXNlcmlmO2ZpbGw6I2NiZDVlMX08L3N0eWxlPgo8ZGVmcz48bWFya2VyIGlkPSJpZGF1dGh6LWFrcyIgdmlld0JveD0iMCAwIDEwIDEwIiByZWZYPSI4IiByZWZZPSI1IiBtYXJrZXJXaWR0aD0iNyIgbWFya2VySGVpZ2h0PSI3IiBvcmllbnQ9ImF1dG8tc3RhcnQtcmV2ZXJzZSI+PHBhdGggZD0iTTAsMCBMMTAsNSBMMCwxMCB6IiBzdHlsZT0iZmlsbDojNmVlN2I3Ii8+PC9tYXJrZXI+PC9kZWZzPgo8dGV4dCB4PSIyOCIgeT0iMjIiIHN0eWxlPSJmb250OiA3MDAgMTBweCBJbnRlciwgc2Fucy1zZXJpZjsgbGV0dGVyLXNwYWNpbmc6IDEuM3B4OyBmaWxsOiAjNjQ3NDhiOyBmaWxsOiM5NGEzYjgiPklERU5USVRZIMK3IFdITyBBTSBJPC90ZXh0Pgo8cmVjdCB4PSIyOCIgeT0iMzAiIHdpZHRoPSIyNTAiIGhlaWdodD0iNjAiIHJ4PSIxMiIgc3Ryb2tlLXdpZHRoPSIxLjUiIHN0eWxlPSJmaWxsOiMxZTI5M2I7c3Ryb2tlOiM0NzU1NjkiLz4KPHRleHQgeD0iMTUzIiB5PSI1NiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICNmMWY1Zjk7IGZvbnQtc2l6ZToxMS41cHgiPllvdXIgSVJTQSByb2xlPC90ZXh0Pgo8dGV4dCB4PSIxNTMiIHk9Ijc0IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiOCI+VGhlIHJvbGUgYSBwb2QgcnVucyBhczwvdGV4dD4KPGxpbmUgeDE9IjI3OCIgeTE9IjYwIiB4Mj0iMzUyIiB5Mj0iNjAiIHN0cm9rZS13aWR0aD0iMiIgbWFya2VyLWVuZD0idXJsKCNpZGF1dGh6LWFrcykiIHN0eWxlPSJzdHJva2U6IzZlZTdiNyIvPgo8dGV4dCB4PSIzMTUiIHk9IjUyIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTAuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNmVlN2I3OyBmb250LXNpemU6OC41cHgiPmxpbmtlZDwvdGV4dD4KPHJlY3QgeD0iMzU2IiB5PSIzMCIgd2lkdGg9IjQ1MiIgaGVpZ2h0PSI2MCIgcng9IjEyIiBzdHJva2Utd2lkdGg9IjEuNyIgc3R5bGU9ImZpbGw6IzA2NGUzYjtzdHJva2U6IzZlZTdiNyIvPgo8dGV4dCB4PSIzNzQiIHk9IjU0IiBzdHlsZT0iZm9udDogNzAwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzZlZTdiNzsgZm9udC1zaXplOjExLjVweCI+TWljcm9zb2Z0IEVudHJhIFdvcmtsb2FkIElEPC90ZXh0Pgo8dGV4dCB4PSIzNzQiIHk9Ijc0IiBzdHlsZT0iZm9udDogMTAuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNmVlN2I3OyBmb250LXNpemU6MTBweCI+UmV0dXJucyB5b3VyIG93biByb2xlPC90ZXh0Pgo8dGV4dCB4PSIyOCIgeT0iMTE4IiBzdHlsZT0iZm9udDogNzAwIDEwcHggSW50ZXIsIHNhbnMtc2VyaWY7IGxldHRlci1zcGFjaW5nOiAxLjNweDsgZmlsbDogIzY0NzQ4YjsgZmlsbDojOTRhM2I4Ij5QRVJNSVNTSU9OUyDCtyBNQVkgSTwvdGV4dD4KPHJlY3QgeD0iMjgiIHk9IjEyNiIgd2lkdGg9IjI1MCIgaGVpZ2h0PSI2MCIgcng9IjEyIiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6IzFlMjkzYjtzdHJva2U6IzQ3NTU2OSIvPgo8dGV4dCB4PSIxNTMiIHk9IjE1MiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICNmMWY1Zjk7IGZvbnQtc2l6ZToxMS41cHgiPllvdXIgQVdTIElBTSBwb2xpY3k8L3RleHQ+Cjx0ZXh0IHg9IjE1MyIgeT0iMTcwIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiOCI+QWxsb3cgYW5kIERlbnkgcnVsZXM8L3RleHQ+CjxsaW5lIHgxPSIyNzgiIHkxPSIxNTYiIHgyPSIzNTIiIHkyPSIxNTYiIHN0cm9rZS13aWR0aD0iMiIgbWFya2VyLWVuZD0idXJsKCNpZGF1dGh6LWFrcykiIHN0eWxlPSJzdHJva2U6IzZlZTdiNyIvPgo8dGV4dCB4PSIzMTUiIHk9IjE0OCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzZlZTdiNzsgZm9udC1zaXplOjguNXB4Ij5jaGVja2VkPC90ZXh0Pgo8cmVjdCB4PSIzNTYiIHk9IjEyNiIgd2lkdGg9IjQ1MiIgaGVpZ2h0PSI2MCIgcng9IjEyIiBzdHJva2Utd2lkdGg9IjEuNyIgc3R5bGU9ImZpbGw6IzA2NGUzYjtzdHJva2U6IzZlZTdiNyIvPgo8dGV4dCB4PSIzNzQiIHk9IjE1MCIgc3R5bGU9ImZvbnQ6IDcwMCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2ZWU3Yjc7IGZvbnQtc2l6ZToxMS41cHgiPkFXUyByZXF1ZXN0IGNoZWNrPC90ZXh0Pgo8dGV4dCB4PSIzNzQiIHk9IjE3MCIgc3R5bGU9ImZvbnQ6IDEwLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzZlZTdiNzsgZm9udC1zaXplOjEwcHgiPkRlbnkgb3ZlcnJpZGVzIGFsbG93PC90ZXh0Pgo8L3N2Zz4=)

Your pod keeps its AWS role and AWS policy; Azure permissions are granted separately.

#### Limitations

The workload, the managed control plane, node pools, pod networking and per-workload identity are all kept. The differences below are reported when you build; none is dropped without notice.

Where EKS and AKS differ

* **Fargate is not supported.** AKS has no Fargate equivalent; its virtual nodes are a different model. Pods that Fargate would run are scheduled onto node pools, and a cluster that uses only Fargate stops the build with an error.
* **The Kubernetes version behaves differently: AKS uses its recommended default.** You get a supported version near the minor version you asked for, not the exact one. The build reports the version chosen.
* **A private control-plane endpoint is not supported.** The AKS control plane has a public endpoint, and the build reports this.
* **The EKS cluster endpoint, ARN and auth token are not supported.** References to them are pointed at the AKS endpoint and certificate authority. If a reference cannot be repointed, the build stops with an error.
* **Very large GPUs are not supported.** An accelerator with no matching Azure VM size stops the build with an error instead of moving to a smaller machine.

#### Other considerations

* **Before going live.** Adapt the identity annotations, storage classes and controllers in your manifests to AKS, then re-apply them. Each migrated pod gets the Azure workload identity annotations instead of an IRSA role annotation.
* **Who runs what.** Microsoft runs the control plane. You size the node pools, including the required system pool.
* **Cost.** The AKS control plane is free on the base tier; the Uptime SLA tier costs extra. You are billed for the node pools you run, including the system pool. Set the autoscaler limits for the load you expect.

#### Management and credentials on AKS

Supported cluster, node-group, add-on and association changes reconcile onto AKS asynchronously. Entra Workload ID grants access only through separately configured Azure permissions; AWS SDK calls need the selected AWS credential exchange. See [cluster management and credential separation](https://docs.tensor9.com/cloud-adapter-early-access/service-catalog/aws/compute-containers/eks-cluster.md#runtime-cluster-management-and-credentials) for the common model and its managed-backend restriction.

#### Example monthly charges

This Tensor9 Cloud Adapter scenario estimates service charges for the named origin and target services. Adapter hosting and commercial Tensor9 fees need separate allocations. [How Tensor9 estimates costs](https://docs.tensor9.com/cloud-adapter-early-access/costs/overview.md) explains the method and what the estimates include.

##### Managed Kubernetes and discovery (EKS) · Worker CPU-hours per month

Feature: Managed Kubernetes and discovery (EKS).

Estimated monthly service charges by Worker CPU-hours per month. Adapter hosting and Tensor9 fees are excluded. Source: us-east-1; target: eastus; currency: USD.

![Managed Kubernetes and discovery (EKS) · Worker CPU-hours per month: monthly service charges by Worker CPU-hours per month. Exact values are in the following table.](https://docs.tensor9.com/images/cloud-adapter-early-access/diagrams/service-cost/0d85ea3ff24274096cfd4c885dc4541e8b0055b3ab4cfc29710e64a68f9aef9d-light.svg)

![Managed Kubernetes and discovery (EKS) · Worker CPU-hours per month: monthly service charges by Worker CPU-hours per month. Exact values are in the following table.](https://docs.tensor9.com/images/cloud-adapter-early-access/diagrams/service-cost/65f8bd50b8781e8c0efe41bb8259aff5ca8370fbd7d2977bebcb03a444359ee9-dark.svg)

Comparison pills describe all sampled scale points; amounts beside each service are for the named workload. Costs The Same means within 20% at every point. Costs Depend includes mixed results and unpriced samples.

Sampled monthly charges in USD, rounded to cents. Difference means target minus origin; a positive difference means the target costs more.

| Worker CPU-hours per month (vCPU-hour/month) | EKS Cluster | AKS Cluster | Difference |
| -: | -: | -: | -: |
| 0 | 156.80 | 100.74 | -56.06 |
| 1,460 | 211.48 | 156.15 | -55.33 |
| 5,840 | 375.51 | 322.37 | -53.14 |
| 23,360 | 1,031.64 | 987.25 | -44.38 |
| 93,440 | 3,656.13 | 3,646.79 | -9.34 |
| 373,760 | 14,154.12 | 14,284.93 | 130.82 |

**Curve assumptions**

| Assumption | Value | Unit |
| - | -: | - |
| Origin list price · Allocated cluster control plane | 0.1 | USD/cluster-hour |
| Origin list price · Allocated worker CPU | 0.03745 | USD/vCPU-hour |
| Origin list price · Allocated worker memory | 0.0035875 | USD/GiB-hour |
| Origin list price · Cluster management requests | 0 | USD/Requests |
| Target / origin worker allocation | 1.15 | multiplier |
| Target price guess · read | 0 | USD/read |
| Target price guess · write | 0 | USD/write |
| Target price guess · provider operation | 0 | USD/provider operation |
| Target list price · GiB-month | 0.0803 | USD/GiB-month |
| Target price guess · published GiB | 0 | USD/published GiB |
| Target price guess · delivered GiB | 0 | USD/delivered GiB |
| Target list price · network GiB | 0.087 | USD/network GiB |
| Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| Target list price · vCPU-hour | 0.033 | USD/vCPU-hour |
| Target list price · GiB-hour | 0.00375 | USD/GiB-hour |
| Target list price · resource-hour | 0 | USD/resource-hour |
| Target price guess · resource-month | 0 | USD/resource-month |
| Target price guess · input token | 0 | USD/input token |
| Target price guess · output token | 0 | USD/output token |
| Target monthly base charge | 0 | USD/month |
| Approximate target service minimum | 0 | USD/month |
| Minimum primary CPU | 2 | vCPU |
| Minimum primary RAM | 8 | GiB |
| Minimum primary disk | 100 | GiB |
| Additional full-price standby copy | 0 | 0 or 1 |
| Allocated share of provisioned cost | 1 | fraction |
| Read/write work per vCPU-second | 1,500 | operations/vCPU-second |
| Planning peak / mean work | 2 | multiplier |
| Planning primary CPU utilization | 0.7 | fraction |
| Resident state reserved in RAM | 0.1 | fraction |
| Planning disk utilization | 0.8 | fraction |
| Maintenance and log disk reserve | 20 | GiB |
| Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| Dependent object sink write price guess | 0.000005 | USD/write |

* Only this native meter varies; all other source usage and translation assumptions retain the displayed defaults. Other native meters and workload assumptions retain their explicitly displayed default quantities. Workload translation and capacity assumptions are not benchmark measurements.
* Native monthly usage priced at the cited provider list prices; listed target allowances apply where present, excluding invoice credits, taxes and negotiated discounts. Rates as of 2026-10-22: us-east-1 → eastus, USD/month.
* Source prices are reference charges, not an invoice. Target lines cover selected service usage/configuration only; adapter hosting and Tensor9 fees are excluded.
* Samples of explicit prices are not performance measurements or capacity qualification. No interpolation or break-even guarantee is implied.
* Variant assumptions show the first axis sample; any axis-dependent configuration is described by this curve's workload note.
* Rates are cited provider list prices, editable for discounts, commitments or another region. Workload translation and capacity coefficients remain editable planning assumptions, not benchmark measurements or a commercial quote.
* Default-zero rates are explicit assumptions, not evidence that the deployed service or resource is free.
* Provisioned-unit minimums use an editable approximate allocation floor. Modeled target service cost is max(usage/allocation, minimum), with billable network, durable staging and dependent sinks added separately; actual RU/TU sizing, scaling increments and throughput remain unqualified.
* Durable staging is priced once: provisioned targets include adapter state in their selected allocation; native targets add a separate staging allocation when required. Adapter hosting is a separate allocation and must exclude resources already priced as staging, workers or target capacity.
* A declared adapter mapping and cost model do not establish implementation availability or service equivalence.
* This is a declared directed mapping; a planning estimate does not establish deployment or request-serving support.
* Origin unit prices are cited provider list prices; capacity coefficients and translation assumptions are editable authored planning guesses, not measured capacity or a provider quote.
* Management requests do not reveal resource allocation or workload traffic. Provisioned resources and traffic are independent inputs.
* The discovery adapter does not itself own or provision the cluster. Allocate existing cluster capacity once across adapters.
* Cluster control-plane hours bill at the listed management fee and worker CPU/RAM at the provider's VM decomposition; allocate a shared cluster once across adapters. The compiler emits the AKS Free tier unless the origin uses Karpenter, when Node Auto-Provisioning requires sku\_tier Standard (USD 0.10/cluster-hour); edit the control-plane rate for that case. Azure: Dsv5 decomposed against Esv5; Premium SSD v2 disk; internet egress.
* AWS Price List API, AmazonEKS offer: [https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AmazonEKS/current/us-east-1/index.json](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AmazonEKS/current/us-east-1/index.json)
* AWS Price List API, AmazonEC2 offer (CSV): [https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AmazonEC2/current/us-east-1/index.csv](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AmazonEC2/current/us-east-1/index.csv)
* Amazon EKS pricing: [https://aws.amazon.com/eks/pricing/](https://aws.amazon.com/eks/pricing/)
* Azure Retail Prices API: [https://prices.azure.com/api/retail/prices](https://prices.azure.com/api/retail/prices)

Cost scope: Modeled target native service and explicitly modeled state allocation; hosting and Tensor9 fees only when supplied.

Excluded costs and workload features:

* Worker disks, GPUs, ingress, network traffic, extended support and observability.
* Taxes, discounts, credits and free-tier allowances not explicitly listed by this model.
* Unmodeled dependent services, task execution and operations outside the selected workload family.

List prices read: 2026-10-22. Model: `plan-6a931ee23628cbfccc0fa64e705381b4de4a686b` / `2026-10-22.planning.2`. Curve: `workload-1`.

Sources: [AWS Price List API, AmazonEKS offer](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AmazonEKS/current/us-east-1/index.json), [AWS Price List API, AmazonEC2 offer (CSV)](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AmazonEC2/current/us-east-1/index.csv), [Amazon EKS pricing](https://aws.amazon.com/eks/pricing/), [Azure Retail Prices API](https://prices.azure.com/api/retail/prices).

##### Managed Kubernetes and discovery (EKS) · Cluster-hours per month

Feature: Managed Kubernetes and discovery (EKS).

Estimated monthly service charges by Cluster-hours per month. Adapter hosting and Tensor9 fees are excluded. Source: us-east-1; target: eastus; currency: USD.

![Managed Kubernetes and discovery (EKS) · Cluster-hours per month: monthly service charges by Cluster-hours per month. Exact values are in the following table.](https://docs.tensor9.com/images/cloud-adapter-early-access/diagrams/service-cost/997ad019db209e32e15bd7b8a4559b69030d45ab1f09b1f6af012b2f0b13cd74-light.svg)

![Managed Kubernetes and discovery (EKS) · Cluster-hours per month: monthly service charges by Cluster-hours per month. Exact values are in the following table.](https://docs.tensor9.com/images/cloud-adapter-early-access/diagrams/service-cost/699db04510c7cfcfe5e5736e51af8c0d81cdd7a8b29e6b6b2f1f43e3e7e7ef5a-dark.svg)

Comparison pills describe all sampled scale points; amounts beside each service are for the named workload. Costs The Same means within 20% at every point. Costs Depend includes mixed results and unpriced samples.

Sampled monthly charges in USD, rounded to cents. Difference means target minus origin; a positive difference means the target costs more.

| Cluster-hours per month (cluster-hour/month) | EKS Cluster | AKS Cluster | Difference |
| -: | -: | -: | -: |
| 0 | 302.51 | 322.37 | 19.86 |
| 730 | 375.51 | 322.37 | -53.14 |
| 3,650 | 667.51 | 322.37 | -345.14 |
| 7,300 | 1,032.51 | 322.37 | -710.14 |
| 36,500 | 3,952.51 | 322.37 | -3,630.14 |

**Curve assumptions**

| Assumption | Value | Unit |
| - | -: | - |
| Origin list price · Allocated cluster control plane | 0.1 | USD/cluster-hour |
| Origin list price · Allocated worker CPU | 0.03745 | USD/vCPU-hour |
| Origin list price · Allocated worker memory | 0.0035875 | USD/GiB-hour |
| Origin list price · Cluster management requests | 0 | USD/Requests |
| Target / origin worker allocation | 1.15 | multiplier |
| Target price guess · read | 0 | USD/read |
| Target price guess · write | 0 | USD/write |
| Target price guess · provider operation | 0 | USD/provider operation |
| Target list price · GiB-month | 0.0803 | USD/GiB-month |
| Target price guess · published GiB | 0 | USD/published GiB |
| Target price guess · delivered GiB | 0 | USD/delivered GiB |
| Target list price · network GiB | 0.087 | USD/network GiB |
| Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| Target list price · vCPU-hour | 0.033 | USD/vCPU-hour |
| Target list price · GiB-hour | 0.00375 | USD/GiB-hour |
| Target list price · resource-hour | 0 | USD/resource-hour |
| Target price guess · resource-month | 0 | USD/resource-month |
| Target price guess · input token | 0 | USD/input token |
| Target price guess · output token | 0 | USD/output token |
| Target monthly base charge | 0 | USD/month |
| Approximate target service minimum | 0 | USD/month |
| Minimum primary CPU | 2 | vCPU |
| Minimum primary RAM | 8 | GiB |
| Minimum primary disk | 100 | GiB |
| Additional full-price standby copy | 0 | 0 or 1 |
| Allocated share of provisioned cost | 1 | fraction |
| Read/write work per vCPU-second | 1,500 | operations/vCPU-second |
| Planning peak / mean work | 2 | multiplier |
| Planning primary CPU utilization | 0.7 | fraction |
| Resident state reserved in RAM | 0.1 | fraction |
| Planning disk utilization | 0.8 | fraction |
| Maintenance and log disk reserve | 20 | GiB |
| Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| Dependent object sink write price guess | 0.000005 | USD/write |

* Only this native meter varies; all other source usage and translation assumptions retain the displayed defaults. Other native meters and workload assumptions retain their explicitly displayed default quantities. Workload translation and capacity assumptions are not benchmark measurements.
* Native monthly usage priced at the cited provider list prices; listed target allowances apply where present, excluding invoice credits, taxes and negotiated discounts. Rates as of 2026-10-22: us-east-1 → eastus, USD/month.
* Source prices are reference charges, not an invoice. Target lines cover selected service usage/configuration only; adapter hosting and Tensor9 fees are excluded.
* Samples of explicit prices are not performance measurements or capacity qualification. No interpolation or break-even guarantee is implied.
* Variant assumptions show the first axis sample; any axis-dependent configuration is described by this curve's workload note.
* Rates are cited provider list prices, editable for discounts, commitments or another region. Workload translation and capacity coefficients remain editable planning assumptions, not benchmark measurements or a commercial quote.
* Default-zero rates are explicit assumptions, not evidence that the deployed service or resource is free.
* Provisioned-unit minimums use an editable approximate allocation floor. Modeled target service cost is max(usage/allocation, minimum), with billable network, durable staging and dependent sinks added separately; actual RU/TU sizing, scaling increments and throughput remain unqualified.
* Durable staging is priced once: provisioned targets include adapter state in their selected allocation; native targets add a separate staging allocation when required. Adapter hosting is a separate allocation and must exclude resources already priced as staging, workers or target capacity.
* A declared adapter mapping and cost model do not establish implementation availability or service equivalence.
* This is a declared directed mapping; a planning estimate does not establish deployment or request-serving support.
* Origin unit prices are cited provider list prices; capacity coefficients and translation assumptions are editable authored planning guesses, not measured capacity or a provider quote.
* Management requests do not reveal resource allocation or workload traffic. Provisioned resources and traffic are independent inputs.
* The discovery adapter does not itself own or provision the cluster. Allocate existing cluster capacity once across adapters.
* Cluster control-plane hours bill at the listed management fee and worker CPU/RAM at the provider's VM decomposition; allocate a shared cluster once across adapters. The compiler emits the AKS Free tier unless the origin uses Karpenter, when Node Auto-Provisioning requires sku\_tier Standard (USD 0.10/cluster-hour); edit the control-plane rate for that case. Azure: Dsv5 decomposed against Esv5; Premium SSD v2 disk; internet egress.
* AWS Price List API, AmazonEKS offer: [https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AmazonEKS/current/us-east-1/index.json](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AmazonEKS/current/us-east-1/index.json)
* AWS Price List API, AmazonEC2 offer (CSV): [https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AmazonEC2/current/us-east-1/index.csv](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AmazonEC2/current/us-east-1/index.csv)
* Amazon EKS pricing: [https://aws.amazon.com/eks/pricing/](https://aws.amazon.com/eks/pricing/)
* Azure Retail Prices API: [https://prices.azure.com/api/retail/prices](https://prices.azure.com/api/retail/prices)

Cost scope: Modeled target native service and explicitly modeled state allocation; hosting and Tensor9 fees only when supplied.

Excluded costs and workload features:

* Worker disks, GPUs, ingress, network traffic, extended support and observability.
* Taxes, discounts, credits and free-tier allowances not explicitly listed by this model.
* Unmodeled dependent services, task execution and operations outside the selected workload family.

List prices read: 2026-10-22. Model: `plan-6a931ee23628cbfccc0fa64e705381b4de4a686b` / `2026-10-22.planning.2`. Curve: `workload-2`.

Sources: [AWS Price List API, AmazonEKS offer](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AmazonEKS/current/us-east-1/index.json), [AWS Price List API, AmazonEC2 offer (CSV)](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AmazonEC2/current/us-east-1/index.csv), [Amazon EKS pricing](https://aws.amazon.com/eks/pricing/), [Azure Retail Prices API](https://prices.azure.com/api/retail/prices).

**Managed Kubernetes and discovery (EKS) → AKS Cluster: Authored native-usage planning example.** Native monthly usage priced at the cited provider list prices; listed target allowances apply where present, excluding invoice credits, taxes and negotiated discounts.

Scenario source region: us-east-1. Scenario target region: eastus. Currency: USD.

| Monthly component | USD |
| - | -: |
| Origin: Allocated cluster control plane | 73.00 |
| Origin: Allocated worker CPU | 218.71 |
| Origin: Allocated worker memory | 83.80 |
| Origin: Cluster management requests | 0.00 |
| Target: Target retained physical data | 0.00 |
| Target: Additional broker replica storage | 0.00 |
| Target: Target native provider operations | 0.00 |
| Target: Execution or worker CPU | 221.63 |
| Target: Execution or worker RAM | 100.74 |
| Target: Selected billable network | 0.00 |
| Target: Independent native resources | 0.00 |
| Target: Independent native resources | 0.00 |
| **Origin service subtotal** | **375.51** |
| **Target service subtotal** | **322.37** |

Unestimated components: Adapter hosting, Tensor9 fees. A modeled adapted total and savings require these costs.

Cost scope: Modeled target native service and explicitly modeled state allocation; hosting and Tensor9 fees only when supplied.

Excluded costs and workload features:

* Worker disks, GPUs, ingress, network traffic, extended support and observability.
* Taxes, discounts, credits and free-tier allowances not explicitly listed by this model.
* Unmodeled dependent services, task execution and operations outside the selected workload family.

**Scenario assumptions**

| Input | Value | Unit |
| - | -: | - |
| Origin list price · Allocated cluster control plane | 0.1 | USD/cluster-hour |
| Origin list price · Allocated worker CPU | 0.03745 | USD/vCPU-hour |
| Origin list price · Allocated worker memory | 0.0035875 | USD/GiB-hour |
| Origin list price · Cluster management requests | 0 | USD/Requests |
| Target / origin worker allocation | 1.15 | multiplier |
| Target price guess · read | 0 | USD/read |
| Target price guess · write | 0 | USD/write |
| Target price guess · provider operation | 0 | USD/provider operation |
| Target list price · GiB-month | 0.0803 | USD/GiB-month |
| Target price guess · published GiB | 0 | USD/published GiB |
| Target price guess · delivered GiB | 0 | USD/delivered GiB |
| Target list price · network GiB | 0.087 | USD/network GiB |
| Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| Target list price · vCPU-hour | 0.033 | USD/vCPU-hour |
| Target list price · GiB-hour | 0.00375 | USD/GiB-hour |
| Target list price · resource-hour | 0 | USD/resource-hour |
| Target price guess · resource-month | 0 | USD/resource-month |
| Target price guess · input token | 0 | USD/input token |
| Target price guess · output token | 0 | USD/output token |
| Target monthly base charge | 0 | USD/month |
| Approximate target service minimum | 0 | USD/month |
| Minimum primary CPU | 2 | vCPU |
| Minimum primary RAM | 8 | GiB |
| Minimum primary disk | 100 | GiB |
| Additional full-price standby copy | 0 | 0 or 1 |
| Allocated share of provisioned cost | 1 | fraction |
| Read/write work per vCPU-second | 1,500 | operations/vCPU-second |
| Planning peak / mean work | 2 | multiplier |
| Planning primary CPU utilization | 0.7 | fraction |
| Resident state reserved in RAM | 0.1 | fraction |
| Planning disk utilization | 0.8 | fraction |
| Maintenance and log disk reserve | 20 | GiB |
| Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| Dependent object sink write price guess | 0.000005 | USD/write |
| Allocated cluster control plane | 730 | cluster-hour |
| Allocated worker CPU | 5,840 | vCPU-hour |
| Allocated worker memory | 23,360 | GiB-hour |
| Cluster management requests | 1,000,000 | Requests |

* Translated reads: 0 operations.

* Translated writes: 0 operations.

* Translated resident physical data: 0 GiB-month.

* Native provider operations: 1,000,000 operations.

* Published payload: 0 GiB.

* Delivered payload: 0 GiB.

* Allocated execution CPU: 6,716 vCPU-hour.

* Allocated execution RAM: 26,864 GiB-hour.

* Independent resource allocation: 730 resource-hour.

* Independent inventory: 0 resource-month.

* Input tokens: 0 tokens.

* Output tokens: 0 tokens.

* Billable network: 0 GiB.

* Dependent object sink retained data: 0 GiB-month.

* Dependent object sink writes: 0 writes.

* Rates are cited provider list prices, editable for discounts, commitments or another region. Workload translation and capacity coefficients remain editable planning assumptions, not benchmark measurements or a commercial quote.

* Default-zero rates are explicit assumptions, not evidence that the deployed service or resource is free.

* Provisioned-unit minimums use an editable approximate allocation floor. Modeled target service cost is max(usage/allocation, minimum), with billable network, durable staging and dependent sinks added separately; actual RU/TU sizing, scaling increments and throughput remain unqualified.

* Durable staging is priced once: provisioned targets include adapter state in their selected allocation; native targets add a separate staging allocation when required. Adapter hosting is a separate allocation and must exclude resources already priced as staging, workers or target capacity.

* A declared adapter mapping and cost model do not establish implementation availability or service equivalence.

* This is a declared directed mapping; a planning estimate does not establish deployment or request-serving support.

* Origin unit prices are cited provider list prices; capacity coefficients and translation assumptions are editable authored planning guesses, not measured capacity or a provider quote.

* Management requests do not reveal resource allocation or workload traffic. Provisioned resources and traffic are independent inputs.

* The discovery adapter does not itself own or provision the cluster. Allocate existing cluster capacity once across adapters.

* Cluster control-plane hours bill at the listed management fee and worker CPU/RAM at the provider's VM decomposition; allocate a shared cluster once across adapters. The compiler emits the AKS Free tier unless the origin uses Karpenter, when Node Auto-Provisioning requires sku\_tier Standard (USD 0.10/cluster-hour); edit the control-plane rate for that case. Azure: Dsv5 decomposed against Esv5; Premium SSD v2 disk; internet egress.

List prices read: 2026-10-22. Model: `plan-6a931ee23628cbfccc0fa64e705381b4de4a686b` / `2026-10-22.planning.2`. Scenario: `planning-example`.

Sources: [AWS Price List API, AmazonEKS offer](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AmazonEKS/current/us-east-1/index.json), [AWS Price List API, AmazonEC2 offer (CSV)](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AmazonEC2/current/us-east-1/index.csv), [Amazon EKS pricing](https://aws.amazon.com/eks/pricing/), [Azure Retail Prices API](https://prices.azure.com/api/retail/prices).

## On Google Cloud

### GKE Cluster

| Operation | Area | Support | Depth | Notes |
| - | - | - | - | - |
| DescribeCluster / ListClusters | EKS management API | Supported | Common | if a workload calls the EKS management API at runtime, it is translated to the backend's managed-Kubernetes API |
| DescribeNodegroup / ListNodegroups | EKS management API | Supported | Most usage | answered against the compiled GKE node pools |
| CreateCluster / DeleteCluster / UpdateClusterVersion | Provisioning | Supported | Most usage | Maximum adaptation accepts supported cluster lifecycle requests and reconciles them onto GKE. Creation and deletion complete asynchronously; describes expose observed readiness. |
| Fargate profile | Serverless nodes | Out of scope | Full surface | no GKE-Standard analog; fargate-selected pods reschedule onto real node pools, and a Fargate-only cluster stops the build |
| In-cluster Kubernetes API (client-go / in-cluster config) | Workload | Supported | Full surface | native GKE API server: standard workload verbs and objects; cloud-specific annotations and controllers need backend configuration |

#### How it works

Your Deployments, Services and other Kubernetes objects keep working, because GKE serves the same Kubernetes API as EKS. At build time, Tensor9 turns your EKS cluster definition into a regional GKE Standard cluster. Google operates the control plane: the API server, controllers, upgrades, availability and scaling. A regional control plane spans several zones, as EKS does.

GKE has two modes. In Autopilot, Google also runs the nodes; in Standard, you keep node pools and machine types. Tensor9 uses Standard, so each EKS node group becomes a node pool you size. EKS lets you choose an exact Kubernetes minor version. GKE keeps the control plane on a **release channel** (STABLE) instead, so you get a supported version near the one you asked for, and the build reports which version was chosen.

![Your EKS cluster becomes a regional GKE Standard cluster that Google runs. Both serve the same Kubernetes API. GKE picks the exact version from its STABLE release channel, and the build reports it.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMTc2IiB2aWV3Qm94PSIwIDAgODM2IDE3NiIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJZb3VyIEVLUyBjbHVzdGVyIGJlY29tZXMgYSByZWdpb25hbCBHS0UgU3RhbmRhcmQgY2x1c3RlciB0aGF0IEdvb2dsZSBydW5zLiBCb3RoIHNlcnZlIHRoZSBzYW1lIEt1YmVybmV0ZXMgQVBJLiBHS0UgcGlja3MgdGhlIGV4YWN0IHZlcnNpb24gZnJvbSBpdHMgU1RBQkxFIHJlbGVhc2UgY2hhbm5lbCwgYW5kIHRoZSBidWlsZCByZXBvcnRzIGl0LiI+PHN0eWxlPnRleHR7Zm9udC1mYW1pbHk6SW50ZXIsLWFwcGxlLXN5c3RlbSxCbGlua01hY1N5c3RlbUZvbnQsJ1NlZ29lIFVJJyxSb2JvdG8sJ0hlbHZldGljYSBOZXVlJyxBcmlhbCxzYW5zLXNlcmlmO2ZpbGw6IzMzNDE1NX08L3N0eWxlPgo8ZGVmcz48bWFya2VyIGlkPSJjcC1na2UiIHZpZXdCb3g9IjAgMCAxMCAxMCIgcmVmWD0iOCIgcmVmWT0iNSIgbWFya2VyV2lkdGg9IjciIG1hcmtlckhlaWdodD0iNyIgb3JpZW50PSJhdXRvLXN0YXJ0LXJldmVyc2UiPjxwYXRoIGQ9Ik0wLDAgTDEwLDUgTDAsMTAgeiIgc3R5bGU9ImZpbGw6IzA0Nzg1NyIvPjwvbWFya2VyPjwvZGVmcz4KPHJlY3QgeD0iMjgiIHk9IjQwIiB3aWR0aD0iMzQwIiBoZWlnaHQ9IjcyIiByeD0iMTIiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojZmZmZmZmO3N0cm9rZTojY2JkNWUxIi8+Cjx0ZXh0IHg9IjE5OCIgeT0iNzIiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMGYxNzJhOyBmb250LXNpemU6MTEuNXB4Ij5FS1MgY29udHJvbCBwbGFuZTwvdGV4dD4KPHRleHQgeD0iMTk4IiB5PSI5MiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGIiPlJ1biBieSBBV1M8L3RleHQ+CjxsaW5lIHgxPSIzNzAiIHkxPSI3NiIgeDI9IjQ1MiIgeTI9Ijc2IiBzdHJva2Utd2lkdGg9IjIiIG1hcmtlci1lbmQ9InVybCgjY3AtZ2tlKSIgc3R5bGU9InN0cm9rZTojMDQ3ODU3Ii8+Cjx0ZXh0IHg9IjQxMSIgeT0iNjgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMC41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwNDc4NTc7IGZvbnQtc2l6ZTo5cHgiPnNhbWUgQVBJPC90ZXh0Pgo8cmVjdCB4PSI0NjYiIHk9IjQwIiB3aWR0aD0iMzQyIiBoZWlnaHQ9IjcyIiByeD0iMTIiIHN0cm9rZS13aWR0aD0iMS43IiBzdHlsZT0iZmlsbDojZWNmZGY1O3N0cm9rZTojMDQ3ODU3Ii8+Cjx0ZXh0IHg9IjYzNyIgeT0iNzIiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA3MDAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMDQ3ODU3OyBmb250LXNpemU6MTEuNXB4Ij5HS0UgU3RhbmRhcmQgY29udHJvbCBwbGFuZTwvdGV4dD4KPHRleHQgeD0iNjM3IiB5PSI5MiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzA0Nzg1NyI+UnVuIGJ5IEdvb2dsZSwgcmVnaW9uYWw8L3RleHQ+CjxyZWN0IHg9IjI4IiB5PSIxMjgiIHdpZHRoPSI3ODAiIGhlaWdodD0iMzQiIHJ4PSIxMCIgc3Ryb2tlLXdpZHRoPSIxLjQiIHN0eWxlPSJmaWxsOiNmOGZhZmM7c3Ryb2tlOiNjYmQ1ZTEiLz4KPHRleHQgeD0iNDE4IiB5PSIxNTAiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiIj5WZXJzaW9uOiBwaWNrZWQgYnkgR0tFJ3MgU1RBQkxFIHJlbGVhc2UgY2hhbm5lbDsgdGhlIGJ1aWxkIHJlcG9ydHMgd2hpY2ggb25lLjwvdGV4dD4KPC9zdmc+)

![Your EKS cluster becomes a regional GKE Standard cluster that Google runs. Both serve the same Kubernetes API. GKE picks the exact version from its STABLE release channel, and the build reports it.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMTc2IiB2aWV3Qm94PSIwIDAgODM2IDE3NiIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJZb3VyIEVLUyBjbHVzdGVyIGJlY29tZXMgYSByZWdpb25hbCBHS0UgU3RhbmRhcmQgY2x1c3RlciB0aGF0IEdvb2dsZSBydW5zLiBCb3RoIHNlcnZlIHRoZSBzYW1lIEt1YmVybmV0ZXMgQVBJLiBHS0UgcGlja3MgdGhlIGV4YWN0IHZlcnNpb24gZnJvbSBpdHMgU1RBQkxFIHJlbGVhc2UgY2hhbm5lbCwgYW5kIHRoZSBidWlsZCByZXBvcnRzIGl0LiI+PHN0eWxlPnRleHR7Zm9udC1mYW1pbHk6SW50ZXIsLWFwcGxlLXN5c3RlbSxCbGlua01hY1N5c3RlbUZvbnQsJ1NlZ29lIFVJJyxSb2JvdG8sJ0hlbHZldGljYSBOZXVlJyxBcmlhbCxzYW5zLXNlcmlmO2ZpbGw6I2NiZDVlMX08L3N0eWxlPgo8ZGVmcz48bWFya2VyIGlkPSJjcC1na2UiIHZpZXdCb3g9IjAgMCAxMCAxMCIgcmVmWD0iOCIgcmVmWT0iNSIgbWFya2VyV2lkdGg9IjciIG1hcmtlckhlaWdodD0iNyIgb3JpZW50PSJhdXRvLXN0YXJ0LXJldmVyc2UiPjxwYXRoIGQ9Ik0wLDAgTDEwLDUgTDAsMTAgeiIgc3R5bGU9ImZpbGw6IzZlZTdiNyIvPjwvbWFya2VyPjwvZGVmcz4KPHJlY3QgeD0iMjgiIHk9IjQwIiB3aWR0aD0iMzQwIiBoZWlnaHQ9IjcyIiByeD0iMTIiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojMWUyOTNiO3N0cm9rZTojNDc1NTY5Ii8+Cjx0ZXh0IHg9IjE5OCIgeT0iNzIiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjZjFmNWY5OyBmb250LXNpemU6MTEuNXB4Ij5FS1MgY29udHJvbCBwbGFuZTwvdGV4dD4KPHRleHQgeD0iMTk4IiB5PSI5MiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjgiPlJ1biBieSBBV1M8L3RleHQ+CjxsaW5lIHgxPSIzNzAiIHkxPSI3NiIgeDI9IjQ1MiIgeTI9Ijc2IiBzdHJva2Utd2lkdGg9IjIiIG1hcmtlci1lbmQ9InVybCgjY3AtZ2tlKSIgc3R5bGU9InN0cm9rZTojNmVlN2I3Ii8+Cjx0ZXh0IHg9IjQxMSIgeT0iNjgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMC41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2ZWU3Yjc7IGZvbnQtc2l6ZTo5cHgiPnNhbWUgQVBJPC90ZXh0Pgo8cmVjdCB4PSI0NjYiIHk9IjQwIiB3aWR0aD0iMzQyIiBoZWlnaHQ9IjcyIiByeD0iMTIiIHN0cm9rZS13aWR0aD0iMS43IiBzdHlsZT0iZmlsbDojMDY0ZTNiO3N0cm9rZTojNmVlN2I3Ii8+Cjx0ZXh0IHg9IjYzNyIgeT0iNzIiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA3MDAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNmVlN2I3OyBmb250LXNpemU6MTEuNXB4Ij5HS0UgU3RhbmRhcmQgY29udHJvbCBwbGFuZTwvdGV4dD4KPHRleHQgeD0iNjM3IiB5PSI5MiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzZlZTdiNyI+UnVuIGJ5IEdvb2dsZSwgcmVnaW9uYWw8L3RleHQ+CjxyZWN0IHg9IjI4IiB5PSIxMjgiIHdpZHRoPSI3ODAiIGhlaWdodD0iMzQiIHJ4PSIxMCIgc3Ryb2tlLXdpZHRoPSIxLjQiIHN0eWxlPSJmaWxsOiMwZjE3MmE7c3Ryb2tlOiM0NzU1NjkiLz4KPHRleHQgeD0iNDE4IiB5PSIxNTAiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4Ij5WZXJzaW9uOiBwaWNrZWQgYnkgR0tFJ3MgU1RBQkxFIHJlbGVhc2UgY2hhbm5lbDsgdGhlIGJ1aWxkIHJlcG9ydHMgd2hpY2ggb25lLjwvdGV4dD4KPC9zdmc+)

Tensor9 creates a regional GKE Standard cluster that Google operates.

#### Add-ons and your manifests

Tensor9 creates the cluster, its node pools, Workload Identity and VPC-native networking. The core EKS add-ons (the VPC CNI, CoreDNS, kube-proxy and the EBS CSI driver) are replaced by GKE's own built-in components. A non-core EKS add-on with no GKE equivalent is dropped, and the build reports it.

GKE also offers optional managed features, such as the GKE Gateway controller, Config Connector, Managed Service for Prometheus, Backup for GKE, the Filestore CSI driver and node auto-provisioning. Tensor9 does not turn these on.

Standard Kubernetes objects need no change. Review the AWS-specific parts of your manifests and Helm values (identity annotations, storage classes, ingress controllers and add-ons) and adapt them to GKE.

#### Nodes and scaling

Each EKS node group becomes one GKE **node pool**. The instance type maps to a Google machine type of the same hardware class: general-purpose (m5) becomes n2 or e2, compute-optimized (c5) becomes c2, Graviton (Arm) becomes t2a, and a GPU node becomes g2 with an NVIDIA L4. When nothing more specific fits, the default is e2-medium. A compute-optimized group never lands on a general-purpose machine.

Your node-group scaling settings become the GKE **cluster autoscaler**, with minimum and maximum node counts across the region. If a GPU node group maps to a different accelerator, for example a T4 becoming an L4, the build warns you.

#### Identity and permissions (IRSA → GKE Workload Identity)

On EKS, **IRSA** (IAM Roles for Service Accounts) gives a pod an IAM role to run as, and the role's policies decide what it may do. Both are kept, as two separate parts.

**Who the pod is.** Identity calls such as `aws sts get-caller-identity` and `iam:GetRole` are answered inside the Cloud Adapter deployment, from the identity given to the pod. They return your own role and account (the same account the instance metadata returns) without contacting AWS. On GKE, the pod's Kubernetes service account is also linked to a Google service account through GKE Workload Identity (the `iam.gke.io/gcp-service-account` annotation). At startup the Cloud Adapter deployment checks that the pod really runs as that Google service account. If the check fails, the Cloud Adapter deployment does not answer identity calls for that pod, rather than return a role it cannot prove.

**What the pod may do.** Tensor9 converts the supported rules of your AWS IAM policies at build time. The Cloud Adapter deployment checks each AWS request from the pod (role, action and resource) against them, and an explicit deny wins over an allow. Policy updates are verified before the Cloud Adapter deployment uses them. Native Google Cloud permissions are granted separately to the Google service account; they do not replace the AWS policy or supply its AWS role session. The STS or EKS Auth adapter you select supplies AWS credentials for supported AWS API calls.

![Identity: your IRSA role is linked to GKE Workload Identity, and get-caller-identity returns your own role. Permissions: the Cloud Adapter deployment checks each AWS request against your AWS IAM policy, and a deny overrides an allow. Google Cloud permissions are granted separately.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjAwIiB2aWV3Qm94PSIwIDAgODM2IDIwMCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJJZGVudGl0eTogeW91ciBJUlNBIHJvbGUgaXMgbGlua2VkIHRvIEdLRSBXb3JrbG9hZCBJZGVudGl0eSwgYW5kIGdldC1jYWxsZXItaWRlbnRpdHkgcmV0dXJucyB5b3VyIG93biByb2xlLiBQZXJtaXNzaW9uczogdGhlIGFwcGxpYW5jZSBjaGVja3MgZWFjaCBBV1MgcmVxdWVzdCBhZ2FpbnN0IHlvdXIgQVdTIElBTSBwb2xpY3ksIGFuZCBhIGRlbnkgb3ZlcnJpZGVzIGFuIGFsbG93LiBHb29nbGUgQ2xvdWQgcGVybWlzc2lvbnMgYXJlIGdyYW50ZWQgc2VwYXJhdGVseS4iPjxzdHlsZT50ZXh0e2ZvbnQtZmFtaWx5OkludGVyLC1hcHBsZS1zeXN0ZW0sQmxpbmtNYWNTeXN0ZW1Gb250LCdTZWdvZSBVSScsUm9ib3RvLCdIZWx2ZXRpY2EgTmV1ZScsQXJpYWwsc2Fucy1zZXJpZjtmaWxsOiMzMzQxNTV9PC9zdHlsZT4KPGRlZnM+PG1hcmtlciBpZD0iaWRhdXRoei1na2UiIHZpZXdCb3g9IjAgMCAxMCAxMCIgcmVmWD0iOCIgcmVmWT0iNSIgbWFya2VyV2lkdGg9IjciIG1hcmtlckhlaWdodD0iNyIgb3JpZW50PSJhdXRvLXN0YXJ0LXJldmVyc2UiPjxwYXRoIGQ9Ik0wLDAgTDEwLDUgTDAsMTAgeiIgc3R5bGU9ImZpbGw6IzA0Nzg1NyIvPjwvbWFya2VyPjwvZGVmcz4KPHRleHQgeD0iMjgiIHk9IjIyIiBzdHlsZT0iZm9udDogNzAwIDEwcHggSW50ZXIsIHNhbnMtc2VyaWY7IGxldHRlci1zcGFjaW5nOiAxLjNweDsgZmlsbDogIzk0YTNiODsgZmlsbDojNjQ3NDhiIj5JREVOVElUWSDCtyBXSE8gQU0gSTwvdGV4dD4KPHJlY3QgeD0iMjgiIHk9IjMwIiB3aWR0aD0iMjUwIiBoZWlnaHQ9IjYwIiByeD0iMTIiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojZmZmZmZmO3N0cm9rZTojY2JkNWUxIi8+Cjx0ZXh0IHg9IjE1MyIgeT0iNTYiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMGYxNzJhOyBmb250LXNpemU6MTEuNXB4Ij5Zb3VyIElSU0Egcm9sZTwvdGV4dD4KPHRleHQgeD0iMTUzIiB5PSI3NCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGIiPlRoZSByb2xlIGEgcG9kIHJ1bnMgYXM8L3RleHQ+CjxsaW5lIHgxPSIyNzgiIHkxPSI2MCIgeDI9IjM1MiIgeTI9IjYwIiBzdHJva2Utd2lkdGg9IjIiIG1hcmtlci1lbmQ9InVybCgjaWRhdXRoei1na2UpIiBzdHlsZT0ic3Ryb2tlOiMwNDc4NTciLz4KPHRleHQgeD0iMzE1IiB5PSI1MiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzA0Nzg1NzsgZm9udC1zaXplOjguNXB4Ij5saW5rZWQ8L3RleHQ+CjxyZWN0IHg9IjM1NiIgeT0iMzAiIHdpZHRoPSI0NTIiIGhlaWdodD0iNjAiIHJ4PSIxMiIgc3Ryb2tlLXdpZHRoPSIxLjciIHN0eWxlPSJmaWxsOiNlY2ZkZjU7c3Ryb2tlOiMwNDc4NTciLz4KPHRleHQgeD0iMzc0IiB5PSI1NCIgc3R5bGU9ImZvbnQ6IDcwMCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwNDc4NTc7IGZvbnQtc2l6ZToxMS41cHgiPkdLRSBXb3JrbG9hZCBJZGVudGl0eTwvdGV4dD4KPHRleHQgeD0iMzc0IiB5PSI3NCIgc3R5bGU9ImZvbnQ6IDEwLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzA0Nzg1NzsgZm9udC1zaXplOjEwcHgiPlJldHVybnMgeW91ciBvd24gcm9sZTwvdGV4dD4KPHRleHQgeD0iMjgiIHk9IjExOCIgc3R5bGU9ImZvbnQ6IDcwMCAxMHB4IEludGVyLCBzYW5zLXNlcmlmOyBsZXR0ZXItc3BhY2luZzogMS4zcHg7IGZpbGw6ICM5NGEzYjg7IGZpbGw6IzY0NzQ4YiI+UEVSTUlTU0lPTlMgwrcgTUFZIEk8L3RleHQ+CjxyZWN0IHg9IjI4IiB5PSIxMjYiIHdpZHRoPSIyNTAiIGhlaWdodD0iNjAiIHJ4PSIxMiIgc3Ryb2tlLXdpZHRoPSIxLjUiIHN0eWxlPSJmaWxsOiNmZmZmZmY7c3Ryb2tlOiNjYmQ1ZTEiLz4KPHRleHQgeD0iMTUzIiB5PSIxNTIiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMGYxNzJhOyBmb250LXNpemU6MTEuNXB4Ij5Zb3VyIEFXUyBJQU0gcG9saWN5PC90ZXh0Pgo8dGV4dCB4PSIxNTMiIHk9IjE3MCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGIiPkFsbG93IGFuZCBEZW55IHJ1bGVzPC90ZXh0Pgo8bGluZSB4MT0iMjc4IiB5MT0iMTU2IiB4Mj0iMzUyIiB5Mj0iMTU2IiBzdHJva2Utd2lkdGg9IjIiIG1hcmtlci1lbmQ9InVybCgjaWRhdXRoei1na2UpIiBzdHlsZT0ic3Ryb2tlOiMwNDc4NTciLz4KPHRleHQgeD0iMzE1IiB5PSIxNDgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMC41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwNDc4NTc7IGZvbnQtc2l6ZTo4LjVweCI+Y2hlY2tlZDwvdGV4dD4KPHJlY3QgeD0iMzU2IiB5PSIxMjYiIHdpZHRoPSI0NTIiIGhlaWdodD0iNjAiIHJ4PSIxMiIgc3Ryb2tlLXdpZHRoPSIxLjciIHN0eWxlPSJmaWxsOiNlY2ZkZjU7c3Ryb2tlOiMwNDc4NTciLz4KPHRleHQgeD0iMzc0IiB5PSIxNTAiIHN0eWxlPSJmb250OiA3MDAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMDQ3ODU3OyBmb250LXNpemU6MTEuNXB4Ij5BV1MgcmVxdWVzdCBjaGVjazwvdGV4dD4KPHRleHQgeD0iMzc0IiB5PSIxNzAiIHN0eWxlPSJmb250OiAxMC41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwNDc4NTc7IGZvbnQtc2l6ZToxMHB4Ij5EZW55IG92ZXJyaWRlcyBhbGxvdzwvdGV4dD4KPC9zdmc+)

![Identity: your IRSA role is linked to GKE Workload Identity, and get-caller-identity returns your own role. Permissions: the Cloud Adapter deployment checks each AWS request against your AWS IAM policy, and a deny overrides an allow. Google Cloud permissions are granted separately.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjAwIiB2aWV3Qm94PSIwIDAgODM2IDIwMCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJJZGVudGl0eTogeW91ciBJUlNBIHJvbGUgaXMgbGlua2VkIHRvIEdLRSBXb3JrbG9hZCBJZGVudGl0eSwgYW5kIGdldC1jYWxsZXItaWRlbnRpdHkgcmV0dXJucyB5b3VyIG93biByb2xlLiBQZXJtaXNzaW9uczogdGhlIGFwcGxpYW5jZSBjaGVja3MgZWFjaCBBV1MgcmVxdWVzdCBhZ2FpbnN0IHlvdXIgQVdTIElBTSBwb2xpY3ksIGFuZCBhIGRlbnkgb3ZlcnJpZGVzIGFuIGFsbG93LiBHb29nbGUgQ2xvdWQgcGVybWlzc2lvbnMgYXJlIGdyYW50ZWQgc2VwYXJhdGVseS4iPjxzdHlsZT50ZXh0e2ZvbnQtZmFtaWx5OkludGVyLC1hcHBsZS1zeXN0ZW0sQmxpbmtNYWNTeXN0ZW1Gb250LCdTZWdvZSBVSScsUm9ib3RvLCdIZWx2ZXRpY2EgTmV1ZScsQXJpYWwsc2Fucy1zZXJpZjtmaWxsOiNjYmQ1ZTF9PC9zdHlsZT4KPGRlZnM+PG1hcmtlciBpZD0iaWRhdXRoei1na2UiIHZpZXdCb3g9IjAgMCAxMCAxMCIgcmVmWD0iOCIgcmVmWT0iNSIgbWFya2VyV2lkdGg9IjciIG1hcmtlckhlaWdodD0iNyIgb3JpZW50PSJhdXRvLXN0YXJ0LXJldmVyc2UiPjxwYXRoIGQ9Ik0wLDAgTDEwLDUgTDAsMTAgeiIgc3R5bGU9ImZpbGw6IzZlZTdiNyIvPjwvbWFya2VyPjwvZGVmcz4KPHRleHQgeD0iMjgiIHk9IjIyIiBzdHlsZT0iZm9udDogNzAwIDEwcHggSW50ZXIsIHNhbnMtc2VyaWY7IGxldHRlci1zcGFjaW5nOiAxLjNweDsgZmlsbDogIzY0NzQ4YjsgZmlsbDojOTRhM2I4Ij5JREVOVElUWSDCtyBXSE8gQU0gSTwvdGV4dD4KPHJlY3QgeD0iMjgiIHk9IjMwIiB3aWR0aD0iMjUwIiBoZWlnaHQ9IjYwIiByeD0iMTIiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojMWUyOTNiO3N0cm9rZTojNDc1NTY5Ii8+Cjx0ZXh0IHg9IjE1MyIgeT0iNTYiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjZjFmNWY5OyBmb250LXNpemU6MTEuNXB4Ij5Zb3VyIElSU0Egcm9sZTwvdGV4dD4KPHRleHQgeD0iMTUzIiB5PSI3NCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjgiPlRoZSByb2xlIGEgcG9kIHJ1bnMgYXM8L3RleHQ+CjxsaW5lIHgxPSIyNzgiIHkxPSI2MCIgeDI9IjM1MiIgeTI9IjYwIiBzdHJva2Utd2lkdGg9IjIiIG1hcmtlci1lbmQ9InVybCgjaWRhdXRoei1na2UpIiBzdHlsZT0ic3Ryb2tlOiM2ZWU3YjciLz4KPHRleHQgeD0iMzE1IiB5PSI1MiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzZlZTdiNzsgZm9udC1zaXplOjguNXB4Ij5saW5rZWQ8L3RleHQ+CjxyZWN0IHg9IjM1NiIgeT0iMzAiIHdpZHRoPSI0NTIiIGhlaWdodD0iNjAiIHJ4PSIxMiIgc3Ryb2tlLXdpZHRoPSIxLjciIHN0eWxlPSJmaWxsOiMwNjRlM2I7c3Ryb2tlOiM2ZWU3YjciLz4KPHRleHQgeD0iMzc0IiB5PSI1NCIgc3R5bGU9ImZvbnQ6IDcwMCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2ZWU3Yjc7IGZvbnQtc2l6ZToxMS41cHgiPkdLRSBXb3JrbG9hZCBJZGVudGl0eTwvdGV4dD4KPHRleHQgeD0iMzc0IiB5PSI3NCIgc3R5bGU9ImZvbnQ6IDEwLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzZlZTdiNzsgZm9udC1zaXplOjEwcHgiPlJldHVybnMgeW91ciBvd24gcm9sZTwvdGV4dD4KPHRleHQgeD0iMjgiIHk9IjExOCIgc3R5bGU9ImZvbnQ6IDcwMCAxMHB4IEludGVyLCBzYW5zLXNlcmlmOyBsZXR0ZXItc3BhY2luZzogMS4zcHg7IGZpbGw6ICM2NDc0OGI7IGZpbGw6Izk0YTNiOCI+UEVSTUlTU0lPTlMgwrcgTUFZIEk8L3RleHQ+CjxyZWN0IHg9IjI4IiB5PSIxMjYiIHdpZHRoPSIyNTAiIGhlaWdodD0iNjAiIHJ4PSIxMiIgc3Ryb2tlLXdpZHRoPSIxLjUiIHN0eWxlPSJmaWxsOiMxZTI5M2I7c3Ryb2tlOiM0NzU1NjkiLz4KPHRleHQgeD0iMTUzIiB5PSIxNTIiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjZjFmNWY5OyBmb250LXNpemU6MTEuNXB4Ij5Zb3VyIEFXUyBJQU0gcG9saWN5PC90ZXh0Pgo8dGV4dCB4PSIxNTMiIHk9IjE3MCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjgiPkFsbG93IGFuZCBEZW55IHJ1bGVzPC90ZXh0Pgo8bGluZSB4MT0iMjc4IiB5MT0iMTU2IiB4Mj0iMzUyIiB5Mj0iMTU2IiBzdHJva2Utd2lkdGg9IjIiIG1hcmtlci1lbmQ9InVybCgjaWRhdXRoei1na2UpIiBzdHlsZT0ic3Ryb2tlOiM2ZWU3YjciLz4KPHRleHQgeD0iMzE1IiB5PSIxNDgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMC41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2ZWU3Yjc7IGZvbnQtc2l6ZTo4LjVweCI+Y2hlY2tlZDwvdGV4dD4KPHJlY3QgeD0iMzU2IiB5PSIxMjYiIHdpZHRoPSI0NTIiIGhlaWdodD0iNjAiIHJ4PSIxMiIgc3Ryb2tlLXdpZHRoPSIxLjciIHN0eWxlPSJmaWxsOiMwNjRlM2I7c3Ryb2tlOiM2ZWU3YjciLz4KPHRleHQgeD0iMzc0IiB5PSIxNTAiIHN0eWxlPSJmb250OiA3MDAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNmVlN2I3OyBmb250LXNpemU6MTEuNXB4Ij5BV1MgcmVxdWVzdCBjaGVjazwvdGV4dD4KPHRleHQgeD0iMzc0IiB5PSIxNzAiIHN0eWxlPSJmb250OiAxMC41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2ZWU3Yjc7IGZvbnQtc2l6ZToxMHB4Ij5EZW55IG92ZXJyaWRlcyBhbGxvdzwvdGV4dD4KPC9zdmc+)

Your pod keeps its AWS role and AWS policy; Google Cloud permissions are granted separately.

#### Limitations

The workload, the managed control plane, node pools, VPC-native pod networking (alias IPs, with your pod and service secondary ranges) and workload identity are all kept. The differences below are reported when you build; none is dropped without notice.

Where EKS and GKE differ

* **Fargate is not supported.** GKE Standard has no Fargate equivalent. Pods that Fargate would run are scheduled onto node pools, and a cluster that uses only Fargate stops the build with an error.
* **The Kubernetes version behaves differently: GKE picks it from a release channel.** You get a supported version near the minor version you asked for, not the exact one. The build reports the version chosen.
* **A private control-plane endpoint is not supported.** The GKE control plane has a public endpoint, and the build reports this.
* **The EKS cluster endpoint, ARN and auth token are not supported.** References to them are pointed at GKE's own endpoint and certificate authority. If a reference cannot be repointed, the build stops with an error.
* **Very large GPUs are not supported.** A node group that asks for an A100- or H100-class accelerator has no matching GKE machine type, so the build stops with an error instead of using a smaller GPU.

#### Other considerations

* **Before going live.** Adapt the identity annotations, storage classes and controllers in your manifests to GKE, then re-apply them to the new cluster.
* **Who runs what.** Google runs the control plane: upgrades, API server availability and scaling. You set node-pool sizes, capacity and cost on Google Cloud.
* **Persistent data.** A PersistentVolume binds to GKE's persistent disk or Filestore CSI driver, but the data behind it is not copied. Migrate or re-create it separately, or the new cluster starts without it.
* **Cost.** A regional GKE Standard cluster has an hourly management fee, and you are billed for the node pools you size. Set the autoscaler limits for the load you expect.

#### Runtime cluster management and credentials

With maximum adaptation, the EKS management API handles supported cluster lifecycle requests at runtime on managed Kubernetes backends. A self-managed backend keeps using the existing cluster named in its backend-specific configuration. The adapter saves accepted cluster, node-group, add-on and pod-identity-association requests, and a background process applies the matching configuration to the target's Kubernetes service. Creation and deletion are asynchronous: a returned cluster record does not mean its endpoint is ready, and describe calls report what the backend actually shows.

Kubernetes workload requests and AWS credential exchanges are separate from cluster management. The target cloud's own workload identity grants access to that cloud. An unchanged AWS SDK instead needs the selected STS or EKS Auth adapter to get an AWS session for the configured IAM role. Creating a cloud identity alone does not do that exchange. Check the cluster's token issuer, the service-account binding and the role trust together, then test the application's real API calls.

#### Example monthly charges

This Tensor9 Cloud Adapter scenario estimates service charges for the named origin and target services. Adapter hosting and commercial Tensor9 fees need separate allocations. [How Tensor9 estimates costs](https://docs.tensor9.com/cloud-adapter-early-access/costs/overview.md) explains the method and what the estimates include.

##### Managed Kubernetes and discovery (EKS) · Worker CPU-hours per month

Feature: Managed Kubernetes and discovery (EKS).

Estimated monthly service charges by Worker CPU-hours per month. Adapter hosting and Tensor9 fees are excluded. Source: us-east-1; target: us-central1; currency: USD.

![Managed Kubernetes and discovery (EKS) · Worker CPU-hours per month: monthly service charges by Worker CPU-hours per month. Exact values are in the following table.](https://docs.tensor9.com/images/cloud-adapter-early-access/diagrams/service-cost/afba5cb4832e09ec00824b3b129b4ddc15902ef0cd4177889d62decf9891bebb-light.svg)

![Managed Kubernetes and discovery (EKS) · Worker CPU-hours per month: monthly service charges by Worker CPU-hours per month. Exact values are in the following table.](https://docs.tensor9.com/images/cloud-adapter-early-access/diagrams/service-cost/774871cf3ee91ec76d15c66a154b01c2ea637b7dab143f310f9d109b69665149-dark.svg)

Comparison pills describe all sampled scale points; amounts beside each service are for the named workload. Costs The Same means within 20% at every point. Costs Depend includes mixed results and unpriced samples.

Sampled monthly charges in USD, rounded to cents. Difference means target minus origin; a positive difference means the target costs more.

| Worker CPU-hours per month (vCPU-hour/month) | EKS Cluster | GKE Cluster | Difference |
| -: | -: | -: | -: |
| 0 | 156.80 | 186.82 | 30.02 |
| 1,460 | 211.48 | 239.90 | 28.42 |
| 5,840 | 375.51 | 399.12 | 23.61 |
| 23,360 | 1,031.64 | 1,036.02 | 4.38 |
| 93,440 | 3,656.13 | 3,583.61 | -72.52 |
| 373,760 | 14,154.12 | 13,773.99 | -380.13 |

**Curve assumptions**

| Assumption | Value | Unit |
| - | -: | - |
| Origin list price · Allocated cluster control plane | 0.1 | USD/cluster-hour |
| Origin list price · Allocated worker CPU | 0.03745 | USD/vCPU-hour |
| Origin list price · Allocated worker memory | 0.0035875 | USD/GiB-hour |
| Origin list price · Cluster management requests | 0 | USD/Requests |
| Target / origin worker allocation | 1.15 | multiplier |
| Target price guess · read | 0 | USD/read |
| Target price guess · write | 0 | USD/write |
| Target price guess · provider operation | 0 | USD/provider operation |
| Target list price · GiB-month | 0.1 | USD/GiB-month |
| Target price guess · published GiB | 0 | USD/published GiB |
| Target price guess · delivered GiB | 0 | USD/delivered GiB |
| Target list price · network GiB | 0.12 | USD/network GiB |
| Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| Target list price · vCPU-hour | 0.031611 | USD/vCPU-hour |
| Target list price · GiB-hour | 0.004237 | USD/GiB-hour |
| Target list price · resource-hour | 0.1 | USD/resource-hour |
| Target price guess · resource-month | 0 | USD/resource-month |
| Target price guess · input token | 0 | USD/input token |
| Target price guess · output token | 0 | USD/output token |
| Target monthly base charge | 0 | USD/month |
| Approximate target service minimum | 0 | USD/month |
| Minimum primary CPU | 2 | vCPU |
| Minimum primary RAM | 8 | GiB |
| Minimum primary disk | 100 | GiB |
| Additional full-price standby copy | 0 | 0 or 1 |
| Allocated share of provisioned cost | 1 | fraction |
| Read/write work per vCPU-second | 1,500 | operations/vCPU-second |
| Planning peak / mean work | 2 | multiplier |
| Planning primary CPU utilization | 0.7 | fraction |
| Resident state reserved in RAM | 0.1 | fraction |
| Planning disk utilization | 0.8 | fraction |
| Maintenance and log disk reserve | 20 | GiB |
| Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| Dependent object sink write price guess | 0.000005 | USD/write |

* Only this native meter varies; all other source usage and translation assumptions retain the displayed defaults. Other native meters and workload assumptions retain their explicitly displayed default quantities. Workload translation and capacity assumptions are not benchmark measurements.
* Native monthly usage priced at the cited provider list prices; listed target allowances apply where present, excluding invoice credits, taxes and negotiated discounts. Rates as of 2026-10-22: us-east-1 → us-central1, USD/month.
* Source prices are reference charges, not an invoice. Target lines cover selected service usage/configuration only; adapter hosting and Tensor9 fees are excluded.
* Samples of explicit prices are not performance measurements or capacity qualification. No interpolation or break-even guarantee is implied.
* Variant assumptions show the first axis sample; any axis-dependent configuration is described by this curve's workload note.
* Rates are cited provider list prices, editable for discounts, commitments or another region. Workload translation and capacity coefficients remain editable planning assumptions, not benchmark measurements or a commercial quote.
* Default-zero rates are explicit assumptions, not evidence that the deployed service or resource is free.
* Provisioned-unit minimums use an editable approximate allocation floor. Modeled target service cost is max(usage/allocation, minimum), with billable network, durable staging and dependent sinks added separately; actual RU/TU sizing, scaling increments and throughput remain unqualified.
* Durable staging is priced once: provisioned targets include adapter state in their selected allocation; native targets add a separate staging allocation when required. Adapter hosting is a separate allocation and must exclude resources already priced as staging, workers or target capacity.
* A declared adapter mapping and cost model do not establish implementation availability or service equivalence.
* This is a declared directed mapping; a planning estimate does not establish deployment or request-serving support.
* Origin unit prices are cited provider list prices; capacity coefficients and translation assumptions are editable authored planning guesses, not measured capacity or a provider quote.
* Management requests do not reveal resource allocation or workload traffic. Provisioned resources and traffic are independent inputs.
* The discovery adapter does not itself own or provision the cluster. Allocate existing cluster capacity once across adapters.
* Cluster control-plane hours bill at the listed management fee and worker CPU/RAM at the provider's VM decomposition; allocate a shared cluster once across adapters. The GKE free tier credits USD 74.40 a month per billing account, equivalent to one zonal or Autopilot cluster; it does not apply to regional clusters and is not applied here. Google: N2 predefined vCPU and memory (E2 lists 0.02181159 and 0.00292353); pd-balanced disk; Premium Tier egress.
* AWS Price List API, AmazonEKS offer: [https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AmazonEKS/current/us-east-1/index.json](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AmazonEKS/current/us-east-1/index.json)
* AWS Price List API, AmazonEC2 offer (CSV): [https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AmazonEC2/current/us-east-1/index.csv](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AmazonEC2/current/us-east-1/index.csv)
* Amazon EKS pricing: [https://aws.amazon.com/eks/pricing/](https://aws.amazon.com/eks/pricing/)
* Compute Engine general-purpose machine pricing: [https://cloud.google.com/products/compute/pricing/general-purpose](https://cloud.google.com/products/compute/pricing/general-purpose)
* Disk and image pricing: [https://cloud.google.com/compute/disks-image-pricing](https://cloud.google.com/compute/disks-image-pricing)
* Network pricing: [https://cloud.google.com/vpc/network-pricing](https://cloud.google.com/vpc/network-pricing)
* Google Kubernetes Engine pricing: [https://cloud.google.com/kubernetes-engine/pricing](https://cloud.google.com/kubernetes-engine/pricing)

Cost scope: Modeled target native service and explicitly modeled state allocation; hosting and Tensor9 fees only when supplied.

Excluded costs and workload features:

* Worker disks, GPUs, ingress, network traffic, extended support and observability.
* Taxes, discounts, credits and free-tier allowances not explicitly listed by this model.
* Unmodeled dependent services, task execution and operations outside the selected workload family.

List prices read: 2026-10-22. Model: `plan-b27aee57c58705505372fd0eb653bbf06b3c15f6` / `2026-10-22.planning.2`. Curve: `workload-1`.

Sources: [AWS Price List API, AmazonEKS offer](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AmazonEKS/current/us-east-1/index.json), [AWS Price List API, AmazonEC2 offer (CSV)](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AmazonEC2/current/us-east-1/index.csv), [Amazon EKS pricing](https://aws.amazon.com/eks/pricing/), [Compute Engine general-purpose machine pricing](https://cloud.google.com/products/compute/pricing/general-purpose), [Disk and image pricing](https://cloud.google.com/compute/disks-image-pricing), [Network pricing](https://cloud.google.com/vpc/network-pricing), [Google Kubernetes Engine pricing](https://cloud.google.com/kubernetes-engine/pricing).

##### Managed Kubernetes and discovery (EKS) · Cluster-hours per month

Feature: Managed Kubernetes and discovery (EKS).

Estimated monthly service charges by Cluster-hours per month. Adapter hosting and Tensor9 fees are excluded. Source: us-east-1; target: us-central1; currency: USD.

![Managed Kubernetes and discovery (EKS) · Cluster-hours per month: monthly service charges by Cluster-hours per month. Exact values are in the following table.](https://docs.tensor9.com/images/cloud-adapter-early-access/diagrams/service-cost/7e9d323c673e211afc00797d301a7db8dc18c7629f698f33ec905afe1b4ea039-light.svg)

![Managed Kubernetes and discovery (EKS) · Cluster-hours per month: monthly service charges by Cluster-hours per month. Exact values are in the following table.](https://docs.tensor9.com/images/cloud-adapter-early-access/diagrams/service-cost/e3212d7941f3839e12ebac3607a9044a9915d7a8b81b2881e232f2fd1859667e-dark.svg)

Comparison pills describe all sampled scale points; amounts beside each service are for the named workload. Costs The Same means within 20% at every point. Costs Depend includes mixed results and unpriced samples.

Sampled monthly charges in USD, rounded to cents. Difference means target minus origin; a positive difference means the target costs more.

| Cluster-hours per month (cluster-hour/month) | EKS Cluster | GKE Cluster | Difference |
| -: | -: | -: | -: |
| 0 | 302.51 | 326.12 | 23.61 |
| 730 | 375.51 | 399.12 | 23.61 |
| 3,650 | 667.51 | 691.12 | 23.61 |
| 7,300 | 1,032.51 | 1,056.12 | 23.61 |
| 36,500 | 3,952.51 | 3,976.12 | 23.61 |

**Curve assumptions**

| Assumption | Value | Unit |
| - | -: | - |
| Origin list price · Allocated cluster control plane | 0.1 | USD/cluster-hour |
| Origin list price · Allocated worker CPU | 0.03745 | USD/vCPU-hour |
| Origin list price · Allocated worker memory | 0.0035875 | USD/GiB-hour |
| Origin list price · Cluster management requests | 0 | USD/Requests |
| Target / origin worker allocation | 1.15 | multiplier |
| Target price guess · read | 0 | USD/read |
| Target price guess · write | 0 | USD/write |
| Target price guess · provider operation | 0 | USD/provider operation |
| Target list price · GiB-month | 0.1 | USD/GiB-month |
| Target price guess · published GiB | 0 | USD/published GiB |
| Target price guess · delivered GiB | 0 | USD/delivered GiB |
| Target list price · network GiB | 0.12 | USD/network GiB |
| Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| Target list price · vCPU-hour | 0.031611 | USD/vCPU-hour |
| Target list price · GiB-hour | 0.004237 | USD/GiB-hour |
| Target list price · resource-hour | 0.1 | USD/resource-hour |
| Target price guess · resource-month | 0 | USD/resource-month |
| Target price guess · input token | 0 | USD/input token |
| Target price guess · output token | 0 | USD/output token |
| Target monthly base charge | 0 | USD/month |
| Approximate target service minimum | 0 | USD/month |
| Minimum primary CPU | 2 | vCPU |
| Minimum primary RAM | 8 | GiB |
| Minimum primary disk | 100 | GiB |
| Additional full-price standby copy | 0 | 0 or 1 |
| Allocated share of provisioned cost | 1 | fraction |
| Read/write work per vCPU-second | 1,500 | operations/vCPU-second |
| Planning peak / mean work | 2 | multiplier |
| Planning primary CPU utilization | 0.7 | fraction |
| Resident state reserved in RAM | 0.1 | fraction |
| Planning disk utilization | 0.8 | fraction |
| Maintenance and log disk reserve | 20 | GiB |
| Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| Dependent object sink write price guess | 0.000005 | USD/write |

* Only this native meter varies; all other source usage and translation assumptions retain the displayed defaults. Other native meters and workload assumptions retain their explicitly displayed default quantities. Workload translation and capacity assumptions are not benchmark measurements.
* Native monthly usage priced at the cited provider list prices; listed target allowances apply where present, excluding invoice credits, taxes and negotiated discounts. Rates as of 2026-10-22: us-east-1 → us-central1, USD/month.
* Source prices are reference charges, not an invoice. Target lines cover selected service usage/configuration only; adapter hosting and Tensor9 fees are excluded.
* Samples of explicit prices are not performance measurements or capacity qualification. No interpolation or break-even guarantee is implied.
* Variant assumptions show the first axis sample; any axis-dependent configuration is described by this curve's workload note.
* Rates are cited provider list prices, editable for discounts, commitments or another region. Workload translation and capacity coefficients remain editable planning assumptions, not benchmark measurements or a commercial quote.
* Default-zero rates are explicit assumptions, not evidence that the deployed service or resource is free.
* Provisioned-unit minimums use an editable approximate allocation floor. Modeled target service cost is max(usage/allocation, minimum), with billable network, durable staging and dependent sinks added separately; actual RU/TU sizing, scaling increments and throughput remain unqualified.
* Durable staging is priced once: provisioned targets include adapter state in their selected allocation; native targets add a separate staging allocation when required. Adapter hosting is a separate allocation and must exclude resources already priced as staging, workers or target capacity.
* A declared adapter mapping and cost model do not establish implementation availability or service equivalence.
* This is a declared directed mapping; a planning estimate does not establish deployment or request-serving support.
* Origin unit prices are cited provider list prices; capacity coefficients and translation assumptions are editable authored planning guesses, not measured capacity or a provider quote.
* Management requests do not reveal resource allocation or workload traffic. Provisioned resources and traffic are independent inputs.
* The discovery adapter does not itself own or provision the cluster. Allocate existing cluster capacity once across adapters.
* Cluster control-plane hours bill at the listed management fee and worker CPU/RAM at the provider's VM decomposition; allocate a shared cluster once across adapters. The GKE free tier credits USD 74.40 a month per billing account, equivalent to one zonal or Autopilot cluster; it does not apply to regional clusters and is not applied here. Google: N2 predefined vCPU and memory (E2 lists 0.02181159 and 0.00292353); pd-balanced disk; Premium Tier egress.
* AWS Price List API, AmazonEKS offer: [https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AmazonEKS/current/us-east-1/index.json](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AmazonEKS/current/us-east-1/index.json)
* AWS Price List API, AmazonEC2 offer (CSV): [https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AmazonEC2/current/us-east-1/index.csv](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AmazonEC2/current/us-east-1/index.csv)
* Amazon EKS pricing: [https://aws.amazon.com/eks/pricing/](https://aws.amazon.com/eks/pricing/)
* Compute Engine general-purpose machine pricing: [https://cloud.google.com/products/compute/pricing/general-purpose](https://cloud.google.com/products/compute/pricing/general-purpose)
* Disk and image pricing: [https://cloud.google.com/compute/disks-image-pricing](https://cloud.google.com/compute/disks-image-pricing)
* Network pricing: [https://cloud.google.com/vpc/network-pricing](https://cloud.google.com/vpc/network-pricing)
* Google Kubernetes Engine pricing: [https://cloud.google.com/kubernetes-engine/pricing](https://cloud.google.com/kubernetes-engine/pricing)

Cost scope: Modeled target native service and explicitly modeled state allocation; hosting and Tensor9 fees only when supplied.

Excluded costs and workload features:

* Worker disks, GPUs, ingress, network traffic, extended support and observability.
* Taxes, discounts, credits and free-tier allowances not explicitly listed by this model.
* Unmodeled dependent services, task execution and operations outside the selected workload family.

List prices read: 2026-10-22. Model: `plan-b27aee57c58705505372fd0eb653bbf06b3c15f6` / `2026-10-22.planning.2`. Curve: `workload-2`.

Sources: [AWS Price List API, AmazonEKS offer](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AmazonEKS/current/us-east-1/index.json), [AWS Price List API, AmazonEC2 offer (CSV)](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AmazonEC2/current/us-east-1/index.csv), [Amazon EKS pricing](https://aws.amazon.com/eks/pricing/), [Compute Engine general-purpose machine pricing](https://cloud.google.com/products/compute/pricing/general-purpose), [Disk and image pricing](https://cloud.google.com/compute/disks-image-pricing), [Network pricing](https://cloud.google.com/vpc/network-pricing), [Google Kubernetes Engine pricing](https://cloud.google.com/kubernetes-engine/pricing).

**Managed Kubernetes and discovery (EKS) → GKE Cluster: Authored native-usage planning example.** Native monthly usage priced at the cited provider list prices; listed target allowances apply where present, excluding invoice credits, taxes and negotiated discounts.

Scenario source region: us-east-1. Scenario target region: us-central1. Currency: USD.

| Monthly component | USD |
| - | -: |
| Origin: Allocated cluster control plane | 73.00 |
| Origin: Allocated worker CPU | 218.71 |
| Origin: Allocated worker memory | 83.80 |
| Origin: Cluster management requests | 0.00 |
| Target: Target retained physical data | 0.00 |
| Target: Additional broker replica storage | 0.00 |
| Target: Target native provider operations | 0.00 |
| Target: Execution or worker CPU | 212.30 |
| Target: Execution or worker RAM | 113.82 |
| Target: Selected billable network | 0.00 |
| Target: Independent native resources | 73.00 |
| Target: Independent native resources | 0.00 |
| **Origin service subtotal** | **375.51** |
| **Target service subtotal** | **399.12** |

Unestimated components: Adapter hosting, Tensor9 fees. A modeled adapted total and savings require these costs.

Cost scope: Modeled target native service and explicitly modeled state allocation; hosting and Tensor9 fees only when supplied.

Excluded costs and workload features:

* Worker disks, GPUs, ingress, network traffic, extended support and observability.
* Taxes, discounts, credits and free-tier allowances not explicitly listed by this model.
* Unmodeled dependent services, task execution and operations outside the selected workload family.

**Scenario assumptions**

| Input | Value | Unit |
| - | -: | - |
| Origin list price · Allocated cluster control plane | 0.1 | USD/cluster-hour |
| Origin list price · Allocated worker CPU | 0.03745 | USD/vCPU-hour |
| Origin list price · Allocated worker memory | 0.0035875 | USD/GiB-hour |
| Origin list price · Cluster management requests | 0 | USD/Requests |
| Target / origin worker allocation | 1.15 | multiplier |
| Target price guess · read | 0 | USD/read |
| Target price guess · write | 0 | USD/write |
| Target price guess · provider operation | 0 | USD/provider operation |
| Target list price · GiB-month | 0.1 | USD/GiB-month |
| Target price guess · published GiB | 0 | USD/published GiB |
| Target price guess · delivered GiB | 0 | USD/delivered GiB |
| Target list price · network GiB | 0.12 | USD/network GiB |
| Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| Target list price · vCPU-hour | 0.031611 | USD/vCPU-hour |
| Target list price · GiB-hour | 0.004237 | USD/GiB-hour |
| Target list price · resource-hour | 0.1 | USD/resource-hour |
| Target price guess · resource-month | 0 | USD/resource-month |
| Target price guess · input token | 0 | USD/input token |
| Target price guess · output token | 0 | USD/output token |
| Target monthly base charge | 0 | USD/month |
| Approximate target service minimum | 0 | USD/month |
| Minimum primary CPU | 2 | vCPU |
| Minimum primary RAM | 8 | GiB |
| Minimum primary disk | 100 | GiB |
| Additional full-price standby copy | 0 | 0 or 1 |
| Allocated share of provisioned cost | 1 | fraction |
| Read/write work per vCPU-second | 1,500 | operations/vCPU-second |
| Planning peak / mean work | 2 | multiplier |
| Planning primary CPU utilization | 0.7 | fraction |
| Resident state reserved in RAM | 0.1 | fraction |
| Planning disk utilization | 0.8 | fraction |
| Maintenance and log disk reserve | 20 | GiB |
| Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| Dependent object sink write price guess | 0.000005 | USD/write |
| Allocated cluster control plane | 730 | cluster-hour |
| Allocated worker CPU | 5,840 | vCPU-hour |
| Allocated worker memory | 23,360 | GiB-hour |
| Cluster management requests | 1,000,000 | Requests |

* Translated reads: 0 operations.

* Translated writes: 0 operations.

* Translated resident physical data: 0 GiB-month.

* Native provider operations: 1,000,000 operations.

* Published payload: 0 GiB.

* Delivered payload: 0 GiB.

* Allocated execution CPU: 6,716 vCPU-hour.

* Allocated execution RAM: 26,864 GiB-hour.

* Independent resource allocation: 730 resource-hour.

* Independent inventory: 0 resource-month.

* Input tokens: 0 tokens.

* Output tokens: 0 tokens.

* Billable network: 0 GiB.

* Dependent object sink retained data: 0 GiB-month.

* Dependent object sink writes: 0 writes.

* Rates are cited provider list prices, editable for discounts, commitments or another region. Workload translation and capacity coefficients remain editable planning assumptions, not benchmark measurements or a commercial quote.

* Default-zero rates are explicit assumptions, not evidence that the deployed service or resource is free.

* Provisioned-unit minimums use an editable approximate allocation floor. Modeled target service cost is max(usage/allocation, minimum), with billable network, durable staging and dependent sinks added separately; actual RU/TU sizing, scaling increments and throughput remain unqualified.

* Durable staging is priced once: provisioned targets include adapter state in their selected allocation; native targets add a separate staging allocation when required. Adapter hosting is a separate allocation and must exclude resources already priced as staging, workers or target capacity.

* A declared adapter mapping and cost model do not establish implementation availability or service equivalence.

* This is a declared directed mapping; a planning estimate does not establish deployment or request-serving support.

* Origin unit prices are cited provider list prices; capacity coefficients and translation assumptions are editable authored planning guesses, not measured capacity or a provider quote.

* Management requests do not reveal resource allocation or workload traffic. Provisioned resources and traffic are independent inputs.

* The discovery adapter does not itself own or provision the cluster. Allocate existing cluster capacity once across adapters.

* Cluster control-plane hours bill at the listed management fee and worker CPU/RAM at the provider's VM decomposition; allocate a shared cluster once across adapters. The GKE free tier credits USD 74.40 a month per billing account, equivalent to one zonal or Autopilot cluster; it does not apply to regional clusters and is not applied here. Google: N2 predefined vCPU and memory (E2 lists 0.02181159 and 0.00292353); pd-balanced disk; Premium Tier egress.

List prices read: 2026-10-22. Model: `plan-b27aee57c58705505372fd0eb653bbf06b3c15f6` / `2026-10-22.planning.2`. Scenario: `planning-example`.

Sources: [AWS Price List API, AmazonEKS offer](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AmazonEKS/current/us-east-1/index.json), [AWS Price List API, AmazonEC2 offer (CSV)](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AmazonEC2/current/us-east-1/index.csv), [Amazon EKS pricing](https://aws.amazon.com/eks/pricing/), [Compute Engine general-purpose machine pricing](https://cloud.google.com/products/compute/pricing/general-purpose), [Disk and image pricing](https://cloud.google.com/compute/disks-image-pricing), [Network pricing](https://cloud.google.com/vpc/network-pricing), [Google Kubernetes Engine pricing](https://cloud.google.com/kubernetes-engine/pricing).

## On OCI

### OKE Cluster

| Operation | Area | Support | Depth | Notes |
| - | - | - | - | - |
| DescribeCluster / ListClusters | EKS management API | Supported | Common | if a workload calls the EKS management API at runtime, it is translated to the backend's managed-Kubernetes API |
| Node-group autoscaling bounds | Node pools | Partial | Most usage | the desired size is applied; cluster-autoscaler min/max is unsupported on the node-pool resource; the build reports its omission |
| CreateCluster / DeleteCluster / node pools | Provisioning | Supported | Most usage | Max lifecycle requests reconcile an enhanced OKE cluster and node pools; readiness is asynchronous and backend settings apply |
| Fargate profile | Serverless nodes | Out of scope | Full surface | no OKE analog; pods reschedule onto node pools; Fargate-only cluster stops the build |
| In-cluster Kubernetes API (client-go / in-cluster config) | Workload | Supported | Full surface | native OKE API server: standard workload verbs and objects; cloud-specific integrations need backend configuration |

#### How it works

Your Deployments, Services and other Kubernetes objects keep working, because OKE serves the same Kubernetes API as EKS. At build time, Tensor9 turns your EKS cluster definition into an enhanced OKE cluster , OKE's fuller tier, which includes the cluster autoscaler, workload identity and higher node limits. Oracle operates the control plane. Its API endpoint is **private**, so the cluster is reached over your own VCN rather than a public address.

OKE can run nodes as managed node pools, as virtual nodes that Oracle runs for you, or as self-managed nodes. Tensor9 uses **managed node pools**, so the sizing you chose is kept. EKS lets you choose an exact minor version; OKE uses a **supported patch** of that minor version, chosen when the plan is made and reported by the build.

![Your EKS cluster becomes an enhanced OKE cluster that Oracle runs, with a private API endpoint. Both serve the same Kubernetes API. OKE uses a supported patch of the minor version you asked for, and the build reports it.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMTc2IiB2aWV3Qm94PSIwIDAgODM2IDE3NiIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJZb3VyIEVLUyBjbHVzdGVyIGJlY29tZXMgYW4gZW5oYW5jZWQgT0tFIGNsdXN0ZXIgdGhhdCBPcmFjbGUgcnVucywgd2l0aCBhIHByaXZhdGUgQVBJIGVuZHBvaW50LiBCb3RoIHNlcnZlIHRoZSBzYW1lIEt1YmVybmV0ZXMgQVBJLiBPS0UgdXNlcyBhIHN1cHBvcnRlZCBwYXRjaCBvZiB0aGUgbWlub3IgdmVyc2lvbiB5b3UgYXNrZWQgZm9yLCBhbmQgdGhlIGJ1aWxkIHJlcG9ydHMgaXQuIj48c3R5bGU+dGV4dHtmb250LWZhbWlseTpJbnRlciwtYXBwbGUtc3lzdGVtLEJsaW5rTWFjU3lzdGVtRm9udCwnU2Vnb2UgVUknLFJvYm90bywnSGVsdmV0aWNhIE5ldWUnLEFyaWFsLHNhbnMtc2VyaWY7ZmlsbDojMzM0MTU1fTwvc3R5bGU+CjxkZWZzPjxtYXJrZXIgaWQ9ImNwLW9rZSIgdmlld0JveD0iMCAwIDEwIDEwIiByZWZYPSI4IiByZWZZPSI1IiBtYXJrZXJXaWR0aD0iNyIgbWFya2VySGVpZ2h0PSI3IiBvcmllbnQ9ImF1dG8tc3RhcnQtcmV2ZXJzZSI+PHBhdGggZD0iTTAsMCBMMTAsNSBMMCwxMCB6IiBzdHlsZT0iZmlsbDojMDQ3ODU3Ii8+PC9tYXJrZXI+PC9kZWZzPgo8cmVjdCB4PSIyOCIgeT0iNDAiIHdpZHRoPSIzNDAiIGhlaWdodD0iNzIiIHJ4PSIxMiIgc3Ryb2tlLXdpZHRoPSIxLjUiIHN0eWxlPSJmaWxsOiNmZmZmZmY7c3Ryb2tlOiNjYmQ1ZTEiLz4KPHRleHQgeD0iMTk4IiB5PSI3MiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwZjE3MmE7IGZvbnQtc2l6ZToxMS41cHgiPkVLUyBjb250cm9sIHBsYW5lPC90ZXh0Pgo8dGV4dCB4PSIxOTgiIHk9IjkyIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YiI+UnVuIGJ5IEFXUzwvdGV4dD4KPGxpbmUgeDE9IjM3MCIgeTE9Ijc2IiB4Mj0iNDUyIiB5Mj0iNzYiIHN0cm9rZS13aWR0aD0iMiIgbWFya2VyLWVuZD0idXJsKCNjcC1va2UpIiBzdHlsZT0ic3Ryb2tlOiMwNDc4NTciLz4KPHRleHQgeD0iNDExIiB5PSI2OCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzA0Nzg1NzsgZm9udC1zaXplOjlweCI+c2FtZSBBUEk8L3RleHQ+CjxyZWN0IHg9IjQ2NiIgeT0iNDAiIHdpZHRoPSIzNDIiIGhlaWdodD0iNzIiIHJ4PSIxMiIgc3Ryb2tlLXdpZHRoPSIxLjciIHN0eWxlPSJmaWxsOiNlY2ZkZjU7c3Ryb2tlOiMwNDc4NTciLz4KPHRleHQgeD0iNjM3IiB5PSI3MiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDcwMCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwNDc4NTc7IGZvbnQtc2l6ZToxMS41cHgiPk9LRSBlbmhhbmNlZCBjb250cm9sIHBsYW5lPC90ZXh0Pgo8dGV4dCB4PSI2MzciIHk9IjkyIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTAuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMDQ3ODU3Ij5SdW4gYnkgT3JhY2xlLCBwcml2YXRlPC90ZXh0Pgo8cmVjdCB4PSIyOCIgeT0iMTI4IiB3aWR0aD0iNzgwIiBoZWlnaHQ9IjM0IiByeD0iMTAiIHN0cm9rZS13aWR0aD0iMS40IiBzdHlsZT0iZmlsbDojZjhmYWZjO3N0cm9rZTojY2JkNWUxIi8+Cjx0ZXh0IHg9IjQxOCIgeT0iMTUwIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YiI+VmVyc2lvbjogYSBzdXBwb3J0ZWQgcGF0Y2ggb2YgdGhlIG1pbm9yIHZlcnNpb24geW91IGFza2VkIGZvcjsgdGhlIGJ1aWxkIHJlcG9ydHMgaXQuPC90ZXh0Pgo8L3N2Zz4=)

![Your EKS cluster becomes an enhanced OKE cluster that Oracle runs, with a private API endpoint. Both serve the same Kubernetes API. OKE uses a supported patch of the minor version you asked for, and the build reports it.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMTc2IiB2aWV3Qm94PSIwIDAgODM2IDE3NiIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJZb3VyIEVLUyBjbHVzdGVyIGJlY29tZXMgYW4gZW5oYW5jZWQgT0tFIGNsdXN0ZXIgdGhhdCBPcmFjbGUgcnVucywgd2l0aCBhIHByaXZhdGUgQVBJIGVuZHBvaW50LiBCb3RoIHNlcnZlIHRoZSBzYW1lIEt1YmVybmV0ZXMgQVBJLiBPS0UgdXNlcyBhIHN1cHBvcnRlZCBwYXRjaCBvZiB0aGUgbWlub3IgdmVyc2lvbiB5b3UgYXNrZWQgZm9yLCBhbmQgdGhlIGJ1aWxkIHJlcG9ydHMgaXQuIj48c3R5bGU+dGV4dHtmb250LWZhbWlseTpJbnRlciwtYXBwbGUtc3lzdGVtLEJsaW5rTWFjU3lzdGVtRm9udCwnU2Vnb2UgVUknLFJvYm90bywnSGVsdmV0aWNhIE5ldWUnLEFyaWFsLHNhbnMtc2VyaWY7ZmlsbDojY2JkNWUxfTwvc3R5bGU+CjxkZWZzPjxtYXJrZXIgaWQ9ImNwLW9rZSIgdmlld0JveD0iMCAwIDEwIDEwIiByZWZYPSI4IiByZWZZPSI1IiBtYXJrZXJXaWR0aD0iNyIgbWFya2VySGVpZ2h0PSI3IiBvcmllbnQ9ImF1dG8tc3RhcnQtcmV2ZXJzZSI+PHBhdGggZD0iTTAsMCBMMTAsNSBMMCwxMCB6IiBzdHlsZT0iZmlsbDojNmVlN2I3Ii8+PC9tYXJrZXI+PC9kZWZzPgo8cmVjdCB4PSIyOCIgeT0iNDAiIHdpZHRoPSIzNDAiIGhlaWdodD0iNzIiIHJ4PSIxMiIgc3Ryb2tlLXdpZHRoPSIxLjUiIHN0eWxlPSJmaWxsOiMxZTI5M2I7c3Ryb2tlOiM0NzU1NjkiLz4KPHRleHQgeD0iMTk4IiB5PSI3MiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICNmMWY1Zjk7IGZvbnQtc2l6ZToxMS41cHgiPkVLUyBjb250cm9sIHBsYW5lPC90ZXh0Pgo8dGV4dCB4PSIxOTgiIHk9IjkyIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiOCI+UnVuIGJ5IEFXUzwvdGV4dD4KPGxpbmUgeDE9IjM3MCIgeTE9Ijc2IiB4Mj0iNDUyIiB5Mj0iNzYiIHN0cm9rZS13aWR0aD0iMiIgbWFya2VyLWVuZD0idXJsKCNjcC1va2UpIiBzdHlsZT0ic3Ryb2tlOiM2ZWU3YjciLz4KPHRleHQgeD0iNDExIiB5PSI2OCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzZlZTdiNzsgZm9udC1zaXplOjlweCI+c2FtZSBBUEk8L3RleHQ+CjxyZWN0IHg9IjQ2NiIgeT0iNDAiIHdpZHRoPSIzNDIiIGhlaWdodD0iNzIiIHJ4PSIxMiIgc3Ryb2tlLXdpZHRoPSIxLjciIHN0eWxlPSJmaWxsOiMwNjRlM2I7c3Ryb2tlOiM2ZWU3YjciLz4KPHRleHQgeD0iNjM3IiB5PSI3MiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDcwMCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2ZWU3Yjc7IGZvbnQtc2l6ZToxMS41cHgiPk9LRSBlbmhhbmNlZCBjb250cm9sIHBsYW5lPC90ZXh0Pgo8dGV4dCB4PSI2MzciIHk9IjkyIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTAuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNmVlN2I3Ij5SdW4gYnkgT3JhY2xlLCBwcml2YXRlPC90ZXh0Pgo8cmVjdCB4PSIyOCIgeT0iMTI4IiB3aWR0aD0iNzgwIiBoZWlnaHQ9IjM0IiByeD0iMTAiIHN0cm9rZS13aWR0aD0iMS40IiBzdHlsZT0iZmlsbDojMGYxNzJhO3N0cm9rZTojNDc1NTY5Ii8+Cjx0ZXh0IHg9IjQxOCIgeT0iMTUwIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiOCI+VmVyc2lvbjogYSBzdXBwb3J0ZWQgcGF0Y2ggb2YgdGhlIG1pbm9yIHZlcnNpb24geW91IGFza2VkIGZvcjsgdGhlIGJ1aWxkIHJlcG9ydHMgaXQuPC90ZXh0Pgo8L3N2Zz4=)

Tensor9 creates an enhanced OKE cluster that Oracle operates, reached through a private endpoint.

#### Add-ons and your manifests

Tensor9 creates the enhanced cluster, its managed node pools on flexible shapes, the OCI workload identity binding and VCN-native pod networking. Your core EKS add-ons are replaced by OKE's own built-in components. A non-core EKS add-on with no OKE equivalent is dropped, and the build reports it.

The enhanced tier includes cluster add-ons that Oracle operates and keeps up to date, the cluster autoscaler among them, along with OKE Workload Identity.

Standard Kubernetes objects need no change. Review the AWS-specific parts of your manifests and Helm values (identity annotations, storage classes, ingress controllers and add-ons) and adapt them to OKE.

#### Nodes and scaling

Each EKS node group becomes one OKE **node pool** on an OCI **flexible shape**, which takes your OCPU and memory sizing directly instead of rounding to a fixed instance size. Pod networking is **VCN-native**: pods get IP addresses from your VCN, as they get VPC addresses on EKS.

The node pool is created at your desired size. The cluster autoscaler's minimum and maximum have no setting on an OKE node pool, so they are dropped and the build reports it (see Limitations).

#### Identity and permissions (IRSA → OCI workload identity)

On EKS, **IRSA** (IAM Roles for Service Accounts) gives a pod an IAM role to run as, and the role's policies decide what it may do. Both are kept, as two separate parts.

**Who the pod is.** Identity calls such as `aws sts get-caller-identity` and `iam:GetRole` are answered inside the Cloud Adapter deployment, from the identity given to the pod. They return your own role and account (the same account the instance metadata returns) without contacting AWS. On OKE, the pod is also linked to OCI through OCI workload identity : OCI IAM policies select the workload by cluster, namespace and service account.

**What the pod may do.** Tensor9 converts the supported rules of your AWS IAM policies at build time. The Cloud Adapter deployment checks each AWS request from the pod (role, action and resource) against them, and an explicit deny wins over an allow. Policy updates are verified before the Cloud Adapter deployment uses them. Native OCI permissions are granted separately to the workload; they do not replace the AWS policy or supply its AWS role session. The STS or EKS Auth adapter you select supplies AWS credentials for supported AWS API calls.

![Identity: your IRSA role is linked to OCI workload identity, and get-caller-identity returns your own role. Permissions: the Cloud Adapter deployment checks each AWS request against your AWS IAM policy, and a deny overrides an allow. OCI permissions are granted separately.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjAwIiB2aWV3Qm94PSIwIDAgODM2IDIwMCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJJZGVudGl0eTogeW91ciBJUlNBIHJvbGUgaXMgbGlua2VkIHRvIE9DSSB3b3JrbG9hZCBpZGVudGl0eSwgYW5kIGdldC1jYWxsZXItaWRlbnRpdHkgcmV0dXJucyB5b3VyIG93biByb2xlLiBQZXJtaXNzaW9uczogdGhlIGFwcGxpYW5jZSBjaGVja3MgZWFjaCBBV1MgcmVxdWVzdCBhZ2FpbnN0IHlvdXIgQVdTIElBTSBwb2xpY3ksIGFuZCBhIGRlbnkgb3ZlcnJpZGVzIGFuIGFsbG93LiBPQ0kgcGVybWlzc2lvbnMgYXJlIGdyYW50ZWQgc2VwYXJhdGVseS4iPjxzdHlsZT50ZXh0e2ZvbnQtZmFtaWx5OkludGVyLC1hcHBsZS1zeXN0ZW0sQmxpbmtNYWNTeXN0ZW1Gb250LCdTZWdvZSBVSScsUm9ib3RvLCdIZWx2ZXRpY2EgTmV1ZScsQXJpYWwsc2Fucy1zZXJpZjtmaWxsOiMzMzQxNTV9PC9zdHlsZT4KPGRlZnM+PG1hcmtlciBpZD0iaWRhdXRoei1va2UiIHZpZXdCb3g9IjAgMCAxMCAxMCIgcmVmWD0iOCIgcmVmWT0iNSIgbWFya2VyV2lkdGg9IjciIG1hcmtlckhlaWdodD0iNyIgb3JpZW50PSJhdXRvLXN0YXJ0LXJldmVyc2UiPjxwYXRoIGQ9Ik0wLDAgTDEwLDUgTDAsMTAgeiIgc3R5bGU9ImZpbGw6IzA0Nzg1NyIvPjwvbWFya2VyPjwvZGVmcz4KPHRleHQgeD0iMjgiIHk9IjIyIiBzdHlsZT0iZm9udDogNzAwIDEwcHggSW50ZXIsIHNhbnMtc2VyaWY7IGxldHRlci1zcGFjaW5nOiAxLjNweDsgZmlsbDogIzk0YTNiODsgZmlsbDojNjQ3NDhiIj5JREVOVElUWSDCtyBXSE8gQU0gSTwvdGV4dD4KPHJlY3QgeD0iMjgiIHk9IjMwIiB3aWR0aD0iMjUwIiBoZWlnaHQ9IjYwIiByeD0iMTIiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojZmZmZmZmO3N0cm9rZTojY2JkNWUxIi8+Cjx0ZXh0IHg9IjE1MyIgeT0iNTYiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMGYxNzJhOyBmb250LXNpemU6MTEuNXB4Ij5Zb3VyIElSU0Egcm9sZTwvdGV4dD4KPHRleHQgeD0iMTUzIiB5PSI3NCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGIiPlRoZSByb2xlIGEgcG9kIHJ1bnMgYXM8L3RleHQ+CjxsaW5lIHgxPSIyNzgiIHkxPSI2MCIgeDI9IjM1MiIgeTI9IjYwIiBzdHJva2Utd2lkdGg9IjIiIG1hcmtlci1lbmQ9InVybCgjaWRhdXRoei1va2UpIiBzdHlsZT0ic3Ryb2tlOiMwNDc4NTciLz4KPHRleHQgeD0iMzE1IiB5PSI1MiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzA0Nzg1NzsgZm9udC1zaXplOjguNXB4Ij5saW5rZWQ8L3RleHQ+CjxyZWN0IHg9IjM1NiIgeT0iMzAiIHdpZHRoPSI0NTIiIGhlaWdodD0iNjAiIHJ4PSIxMiIgc3Ryb2tlLXdpZHRoPSIxLjciIHN0eWxlPSJmaWxsOiNlY2ZkZjU7c3Ryb2tlOiMwNDc4NTciLz4KPHRleHQgeD0iMzc0IiB5PSI1NCIgc3R5bGU9ImZvbnQ6IDcwMCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwNDc4NTc7IGZvbnQtc2l6ZToxMS41cHgiPk9DSSB3b3JrbG9hZCBpZGVudGl0eTwvdGV4dD4KPHRleHQgeD0iMzc0IiB5PSI3NCIgc3R5bGU9ImZvbnQ6IDEwLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzA0Nzg1NzsgZm9udC1zaXplOjEwcHgiPlJldHVybnMgeW91ciBvd24gcm9sZTwvdGV4dD4KPHRleHQgeD0iMjgiIHk9IjExOCIgc3R5bGU9ImZvbnQ6IDcwMCAxMHB4IEludGVyLCBzYW5zLXNlcmlmOyBsZXR0ZXItc3BhY2luZzogMS4zcHg7IGZpbGw6ICM5NGEzYjg7IGZpbGw6IzY0NzQ4YiI+UEVSTUlTU0lPTlMgwrcgTUFZIEk8L3RleHQ+CjxyZWN0IHg9IjI4IiB5PSIxMjYiIHdpZHRoPSIyNTAiIGhlaWdodD0iNjAiIHJ4PSIxMiIgc3Ryb2tlLXdpZHRoPSIxLjUiIHN0eWxlPSJmaWxsOiNmZmZmZmY7c3Ryb2tlOiNjYmQ1ZTEiLz4KPHRleHQgeD0iMTUzIiB5PSIxNTIiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMGYxNzJhOyBmb250LXNpemU6MTEuNXB4Ij5Zb3VyIEFXUyBJQU0gcG9saWN5PC90ZXh0Pgo8dGV4dCB4PSIxNTMiIHk9IjE3MCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGIiPkFsbG93IGFuZCBEZW55IHJ1bGVzPC90ZXh0Pgo8bGluZSB4MT0iMjc4IiB5MT0iMTU2IiB4Mj0iMzUyIiB5Mj0iMTU2IiBzdHJva2Utd2lkdGg9IjIiIG1hcmtlci1lbmQ9InVybCgjaWRhdXRoei1va2UpIiBzdHlsZT0ic3Ryb2tlOiMwNDc4NTciLz4KPHRleHQgeD0iMzE1IiB5PSIxNDgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMC41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwNDc4NTc7IGZvbnQtc2l6ZTo4LjVweCI+Y2hlY2tlZDwvdGV4dD4KPHJlY3QgeD0iMzU2IiB5PSIxMjYiIHdpZHRoPSI0NTIiIGhlaWdodD0iNjAiIHJ4PSIxMiIgc3Ryb2tlLXdpZHRoPSIxLjciIHN0eWxlPSJmaWxsOiNlY2ZkZjU7c3Ryb2tlOiMwNDc4NTciLz4KPHRleHQgeD0iMzc0IiB5PSIxNTAiIHN0eWxlPSJmb250OiA3MDAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMDQ3ODU3OyBmb250LXNpemU6MTEuNXB4Ij5BV1MgcmVxdWVzdCBjaGVjazwvdGV4dD4KPHRleHQgeD0iMzc0IiB5PSIxNzAiIHN0eWxlPSJmb250OiAxMC41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwNDc4NTc7IGZvbnQtc2l6ZToxMHB4Ij5EZW55IG92ZXJyaWRlcyBhbGxvdzwvdGV4dD4KPC9zdmc+)

![Identity: your IRSA role is linked to OCI workload identity, and get-caller-identity returns your own role. Permissions: the Cloud Adapter deployment checks each AWS request against your AWS IAM policy, and a deny overrides an allow. OCI permissions are granted separately.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjAwIiB2aWV3Qm94PSIwIDAgODM2IDIwMCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJJZGVudGl0eTogeW91ciBJUlNBIHJvbGUgaXMgbGlua2VkIHRvIE9DSSB3b3JrbG9hZCBpZGVudGl0eSwgYW5kIGdldC1jYWxsZXItaWRlbnRpdHkgcmV0dXJucyB5b3VyIG93biByb2xlLiBQZXJtaXNzaW9uczogdGhlIGFwcGxpYW5jZSBjaGVja3MgZWFjaCBBV1MgcmVxdWVzdCBhZ2FpbnN0IHlvdXIgQVdTIElBTSBwb2xpY3ksIGFuZCBhIGRlbnkgb3ZlcnJpZGVzIGFuIGFsbG93LiBPQ0kgcGVybWlzc2lvbnMgYXJlIGdyYW50ZWQgc2VwYXJhdGVseS4iPjxzdHlsZT50ZXh0e2ZvbnQtZmFtaWx5OkludGVyLC1hcHBsZS1zeXN0ZW0sQmxpbmtNYWNTeXN0ZW1Gb250LCdTZWdvZSBVSScsUm9ib3RvLCdIZWx2ZXRpY2EgTmV1ZScsQXJpYWwsc2Fucy1zZXJpZjtmaWxsOiNjYmQ1ZTF9PC9zdHlsZT4KPGRlZnM+PG1hcmtlciBpZD0iaWRhdXRoei1va2UiIHZpZXdCb3g9IjAgMCAxMCAxMCIgcmVmWD0iOCIgcmVmWT0iNSIgbWFya2VyV2lkdGg9IjciIG1hcmtlckhlaWdodD0iNyIgb3JpZW50PSJhdXRvLXN0YXJ0LXJldmVyc2UiPjxwYXRoIGQ9Ik0wLDAgTDEwLDUgTDAsMTAgeiIgc3R5bGU9ImZpbGw6IzZlZTdiNyIvPjwvbWFya2VyPjwvZGVmcz4KPHRleHQgeD0iMjgiIHk9IjIyIiBzdHlsZT0iZm9udDogNzAwIDEwcHggSW50ZXIsIHNhbnMtc2VyaWY7IGxldHRlci1zcGFjaW5nOiAxLjNweDsgZmlsbDogIzY0NzQ4YjsgZmlsbDojOTRhM2I4Ij5JREVOVElUWSDCtyBXSE8gQU0gSTwvdGV4dD4KPHJlY3QgeD0iMjgiIHk9IjMwIiB3aWR0aD0iMjUwIiBoZWlnaHQ9IjYwIiByeD0iMTIiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojMWUyOTNiO3N0cm9rZTojNDc1NTY5Ii8+Cjx0ZXh0IHg9IjE1MyIgeT0iNTYiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjZjFmNWY5OyBmb250LXNpemU6MTEuNXB4Ij5Zb3VyIElSU0Egcm9sZTwvdGV4dD4KPHRleHQgeD0iMTUzIiB5PSI3NCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjgiPlRoZSByb2xlIGEgcG9kIHJ1bnMgYXM8L3RleHQ+CjxsaW5lIHgxPSIyNzgiIHkxPSI2MCIgeDI9IjM1MiIgeTI9IjYwIiBzdHJva2Utd2lkdGg9IjIiIG1hcmtlci1lbmQ9InVybCgjaWRhdXRoei1va2UpIiBzdHlsZT0ic3Ryb2tlOiM2ZWU3YjciLz4KPHRleHQgeD0iMzE1IiB5PSI1MiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzZlZTdiNzsgZm9udC1zaXplOjguNXB4Ij5saW5rZWQ8L3RleHQ+CjxyZWN0IHg9IjM1NiIgeT0iMzAiIHdpZHRoPSI0NTIiIGhlaWdodD0iNjAiIHJ4PSIxMiIgc3Ryb2tlLXdpZHRoPSIxLjciIHN0eWxlPSJmaWxsOiMwNjRlM2I7c3Ryb2tlOiM2ZWU3YjciLz4KPHRleHQgeD0iMzc0IiB5PSI1NCIgc3R5bGU9ImZvbnQ6IDcwMCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2ZWU3Yjc7IGZvbnQtc2l6ZToxMS41cHgiPk9DSSB3b3JrbG9hZCBpZGVudGl0eTwvdGV4dD4KPHRleHQgeD0iMzc0IiB5PSI3NCIgc3R5bGU9ImZvbnQ6IDEwLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzZlZTdiNzsgZm9udC1zaXplOjEwcHgiPlJldHVybnMgeW91ciBvd24gcm9sZTwvdGV4dD4KPHRleHQgeD0iMjgiIHk9IjExOCIgc3R5bGU9ImZvbnQ6IDcwMCAxMHB4IEludGVyLCBzYW5zLXNlcmlmOyBsZXR0ZXItc3BhY2luZzogMS4zcHg7IGZpbGw6ICM2NDc0OGI7IGZpbGw6Izk0YTNiOCI+UEVSTUlTU0lPTlMgwrcgTUFZIEk8L3RleHQ+CjxyZWN0IHg9IjI4IiB5PSIxMjYiIHdpZHRoPSIyNTAiIGhlaWdodD0iNjAiIHJ4PSIxMiIgc3Ryb2tlLXdpZHRoPSIxLjUiIHN0eWxlPSJmaWxsOiMxZTI5M2I7c3Ryb2tlOiM0NzU1NjkiLz4KPHRleHQgeD0iMTUzIiB5PSIxNTIiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjZjFmNWY5OyBmb250LXNpemU6MTEuNXB4Ij5Zb3VyIEFXUyBJQU0gcG9saWN5PC90ZXh0Pgo8dGV4dCB4PSIxNTMiIHk9IjE3MCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjgiPkFsbG93IGFuZCBEZW55IHJ1bGVzPC90ZXh0Pgo8bGluZSB4MT0iMjc4IiB5MT0iMTU2IiB4Mj0iMzUyIiB5Mj0iMTU2IiBzdHJva2Utd2lkdGg9IjIiIG1hcmtlci1lbmQ9InVybCgjaWRhdXRoei1va2UpIiBzdHlsZT0ic3Ryb2tlOiM2ZWU3YjciLz4KPHRleHQgeD0iMzE1IiB5PSIxNDgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMC41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2ZWU3Yjc7IGZvbnQtc2l6ZTo4LjVweCI+Y2hlY2tlZDwvdGV4dD4KPHJlY3QgeD0iMzU2IiB5PSIxMjYiIHdpZHRoPSI0NTIiIGhlaWdodD0iNjAiIHJ4PSIxMiIgc3Ryb2tlLXdpZHRoPSIxLjciIHN0eWxlPSJmaWxsOiMwNjRlM2I7c3Ryb2tlOiM2ZWU3YjciLz4KPHRleHQgeD0iMzc0IiB5PSIxNTAiIHN0eWxlPSJmb250OiA3MDAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNmVlN2I3OyBmb250LXNpemU6MTEuNXB4Ij5BV1MgcmVxdWVzdCBjaGVjazwvdGV4dD4KPHRleHQgeD0iMzc0IiB5PSIxNzAiIHN0eWxlPSJmb250OiAxMC41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2ZWU3Yjc7IGZvbnQtc2l6ZToxMHB4Ij5EZW55IG92ZXJyaWRlcyBhbGxvdzwvdGV4dD4KPC9zdmc+)

Your pod keeps its AWS role and AWS policy; OCI permissions are granted separately.

#### Limitations

The workload, the managed control plane, node pools on flexible shapes, VCN-native pod networking and a private endpoint are all kept. The differences below are reported when you build; none is dropped without notice.

Where EKS and OKE differ

* **Fargate is not supported.** OKE has no Fargate equivalent. Pods that Fargate would run are scheduled onto node pools, and a cluster that uses only Fargate stops the build with an error.
* **The Kubernetes version behaves differently: OKE uses a supported patch.** You get a supported patch of the minor version you asked for, chosen when the plan is made. The build reports the version chosen.
* **Cluster autoscaler limits are not supported.** The node pool is created at your desired size; the autoscaler minimum and maximum have no OKE node-pool setting, so they are dropped and reported.
* **The EKS cluster endpoint, ARN and auth token are not supported.** References to them are pointed at the OKE endpoint and certificate authority. If a reference cannot be repointed, the build stops with an error.
* **Very large GPUs are not supported.** An accelerator with no matching OCI shape stops the build with an error instead of moving to a smaller shape.

#### Other considerations

* **Before going live.** Review OCI identity policies, storage classes and VCN networking alongside your Kubernetes manifests, then re-apply them to the new cluster.
* **Cluster administration.** The API endpoint is private, so administering the cluster needs access from inside the VCN, such as a bastion or private access. If your EKS cluster had a public endpoint, the build warns you.
* **Scaling limits.** Set node scaling limits on OCI after cutover, because the autoscaler minimum and maximum are not kept.
* **Cost.** OKE's enhanced tier has a per-cluster charge, and you are billed for the managed node pools you size by OCPU and memory, instead of an EKS control-plane fee plus fixed instance types.

#### Management and credentials on OKE

Supported cluster and node-pool changes reconcile onto OKE asynchronously. OCI workload identity and its native grants remain separate from STS or EKS Auth role sessions used for AWS adapter calls. See [cluster management and credential separation](https://docs.tensor9.com/cloud-adapter-early-access/service-catalog/aws/compute-containers/eks-cluster.md#runtime-cluster-management-and-credentials) for the common model and its managed-backend restriction.

#### Example monthly charges

This Tensor9 Cloud Adapter scenario estimates service charges for the named origin and target services. Adapter hosting and commercial Tensor9 fees need separate allocations. [How Tensor9 estimates costs](https://docs.tensor9.com/cloud-adapter-early-access/costs/overview.md) explains the method and what the estimates include.

##### Managed Kubernetes and discovery (EKS) · Worker CPU-hours per month

Feature: Managed Kubernetes and discovery (EKS).

Estimated monthly service charges by Worker CPU-hours per month. Adapter hosting and Tensor9 fees are excluded. Source: us-east-1; target: us-ashburn-1; currency: USD.

![Managed Kubernetes and discovery (EKS) · Worker CPU-hours per month: monthly service charges by Worker CPU-hours per month. Exact values are in the following table.](https://docs.tensor9.com/images/cloud-adapter-early-access/diagrams/service-cost/83da706c56fd7ee7720e158fbe31061c276a427ff21719882a98b60b004db40c-light.svg)

![Managed Kubernetes and discovery (EKS) · Worker CPU-hours per month: monthly service charges by Worker CPU-hours per month. Exact values are in the following table.](https://docs.tensor9.com/images/cloud-adapter-early-access/diagrams/service-cost/e8367ff1b272c43aa392abc5d05647c3a9ad37996f7f7ddbb29ed64e5e6f1d65-dark.svg)

Comparison pills describe all sampled scale points; amounts beside each service are for the named workload. Costs The Same means within 20% at every point. Costs Depend includes mixed results and unpriced samples.

Sampled monthly charges in USD, rounded to cents. Difference means target minus origin; a positive difference means the target costs more.

| Worker CPU-hours per month (vCPU-hour/month) | EKS Cluster | OKE Cluster | Difference |
| -: | -: | -: | -: |
| 0 | 156.80 | 126.73 | -30.08 |
| 1,460 | 211.48 | 151.91 | -59.57 |
| 5,840 | 375.51 | 227.47 | -148.04 |
| 23,360 | 1,031.64 | 529.69 | -501.95 |
| 93,440 | 3,656.13 | 1,738.57 | -1,917.56 |
| 373,760 | 14,154.12 | 6,574.09 | -7,580.03 |

**Curve assumptions**

| Assumption | Value | Unit |
| - | -: | - |
| Origin list price · Allocated cluster control plane | 0.1 | USD/cluster-hour |
| Origin list price · Allocated worker CPU | 0.03745 | USD/vCPU-hour |
| Origin list price · Allocated worker memory | 0.0035875 | USD/GiB-hour |
| Origin list price · Cluster management requests | 0 | USD/Requests |
| Target / origin worker allocation | 1.15 | multiplier |
| Target price guess · read | 0 | USD/read |
| Target price guess · write | 0 | USD/write |
| Target price guess · provider operation | 0 | USD/provider operation |
| Target list price · GiB-month | 0.0425 | USD/GiB-month |
| Target price guess · published GiB | 0 | USD/published GiB |
| Target price guess · delivered GiB | 0 | USD/delivered GiB |
| Target list price · network GiB | 0 | USD/network GiB |
| Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| Target list price · vCPU-hour | 0.015 | USD/vCPU-hour |
| Target list price · GiB-hour | 0.002 | USD/GiB-hour |
| Target list price · resource-hour | 0.1 | USD/resource-hour |
| Target price guess · resource-month | 0 | USD/resource-month |
| Target price guess · input token | 0 | USD/input token |
| Target price guess · output token | 0 | USD/output token |
| Target monthly base charge | 0 | USD/month |
| Approximate target service minimum | 0 | USD/month |
| Minimum primary CPU | 2 | vCPU |
| Minimum primary RAM | 8 | GiB |
| Minimum primary disk | 100 | GiB |
| Additional full-price standby copy | 0 | 0 or 1 |
| Allocated share of provisioned cost | 1 | fraction |
| Read/write work per vCPU-second | 1,500 | operations/vCPU-second |
| Planning peak / mean work | 2 | multiplier |
| Planning primary CPU utilization | 0.7 | fraction |
| Resident state reserved in RAM | 0.1 | fraction |
| Planning disk utilization | 0.8 | fraction |
| Maintenance and log disk reserve | 20 | GiB |
| Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| Dependent object sink write price guess | 0.000005 | USD/write |

* Only this native meter varies; all other source usage and translation assumptions retain the displayed defaults. Other native meters and workload assumptions retain their explicitly displayed default quantities. Workload translation and capacity assumptions are not benchmark measurements.
* Native monthly usage priced at the cited provider list prices; listed target allowances apply where present, excluding invoice credits, taxes and negotiated discounts. Rates as of 2026-10-22: us-east-1 → us-ashburn-1, USD/month.
* Source prices are reference charges, not an invoice. Target lines cover selected service usage/configuration only; adapter hosting and Tensor9 fees are excluded.
* Samples of explicit prices are not performance measurements or capacity qualification. No interpolation or break-even guarantee is implied.
* Variant assumptions show the first axis sample; any axis-dependent configuration is described by this curve's workload note.
* Rates are cited provider list prices, editable for discounts, commitments or another region. Workload translation and capacity coefficients remain editable planning assumptions, not benchmark measurements or a commercial quote.
* Default-zero rates are explicit assumptions, not evidence that the deployed service or resource is free.
* Provisioned-unit minimums use an editable approximate allocation floor. Modeled target service cost is max(usage/allocation, minimum), with billable network, durable staging and dependent sinks added separately; actual RU/TU sizing, scaling increments and throughput remain unqualified.
* Durable staging is priced once: provisioned targets include adapter state in their selected allocation; native targets add a separate staging allocation when required. Adapter hosting is a separate allocation and must exclude resources already priced as staging, workers or target capacity.
* A declared adapter mapping and cost model do not establish implementation availability or service equivalence.
* This is a declared directed mapping; a planning estimate does not establish deployment or request-serving support.
* Origin unit prices are cited provider list prices; capacity coefficients and translation assumptions are editable authored planning guesses, not measured capacity or a provider quote.
* Management requests do not reveal resource allocation or workload traffic. Provisioned resources and traffic are independent inputs.
* The discovery adapter does not itself own or provision the cluster. Allocate existing cluster capacity once across adapters.
* Cluster control-plane hours bill at the listed management fee and worker CPU/RAM at the provider's VM decomposition; allocate a shared cluster once across adapters. The compiler emits type ENHANCED\_CLUSTER (the EKS standard tier's equivalent); a Basic cluster is free. OCI: E5 flexible shape (the shape this repo emits); Balanced block volume; first 10 TB of egress free.
* AWS Price List API, AmazonEKS offer: [https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AmazonEKS/current/us-east-1/index.json](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AmazonEKS/current/us-east-1/index.json)
* AWS Price List API, AmazonEC2 offer (CSV): [https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AmazonEC2/current/us-east-1/index.csv](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AmazonEC2/current/us-east-1/index.csv)
* Amazon EKS pricing: [https://aws.amazon.com/eks/pricing/](https://aws.amazon.com/eks/pricing/)
* OCI price list API: [https://apexapps.oracle.com/pls/apex/cetools/api/v1/products/](https://apexapps.oracle.com/pls/apex/cetools/api/v1/products/)

Cost scope: Modeled target native service and explicitly modeled state allocation; hosting and Tensor9 fees only when supplied.

Excluded costs and workload features:

* Worker disks, GPUs, ingress, network traffic, extended support and observability.
* Taxes, discounts, credits and free-tier allowances not explicitly listed by this model.
* Unmodeled dependent services, task execution and operations outside the selected workload family.

List prices read: 2026-10-22. Model: `plan-00d4314e21f00831443da77b5e630dfa0a1c813c` / `2026-10-22.planning.2`. Curve: `workload-1`.

Sources: [AWS Price List API, AmazonEKS offer](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AmazonEKS/current/us-east-1/index.json), [AWS Price List API, AmazonEC2 offer (CSV)](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AmazonEC2/current/us-east-1/index.csv), [Amazon EKS pricing](https://aws.amazon.com/eks/pricing/), [OCI price list API](https://apexapps.oracle.com/pls/apex/cetools/api/v1/products/).

##### Managed Kubernetes and discovery (EKS) · Cluster-hours per month

Feature: Managed Kubernetes and discovery (EKS).

Estimated monthly service charges by Cluster-hours per month. Adapter hosting and Tensor9 fees are excluded. Source: us-east-1; target: us-ashburn-1; currency: USD.

![Managed Kubernetes and discovery (EKS) · Cluster-hours per month: monthly service charges by Cluster-hours per month. Exact values are in the following table.](https://docs.tensor9.com/images/cloud-adapter-early-access/diagrams/service-cost/0dd04d82bcd7df56cc983befa1b3b23e00f49559fb3915fc30af0e3ef6bec740-light.svg)

![Managed Kubernetes and discovery (EKS) · Cluster-hours per month: monthly service charges by Cluster-hours per month. Exact values are in the following table.](https://docs.tensor9.com/images/cloud-adapter-early-access/diagrams/service-cost/3e040301286c402b3e9d0a03c8ab59dc800ac2985352ede1330f9e3d7222cc03-dark.svg)

Comparison pills describe all sampled scale points; amounts beside each service are for the named workload. Costs The Same means within 20% at every point. Costs Depend includes mixed results and unpriced samples.

Sampled monthly charges in USD, rounded to cents. Difference means target minus origin; a positive difference means the target costs more.

| Cluster-hours per month (cluster-hour/month) | EKS Cluster | OKE Cluster | Difference |
| -: | -: | -: | -: |
| 0 | 302.51 | 154.47 | -148.04 |
| 730 | 375.51 | 227.47 | -148.04 |
| 3,650 | 667.51 | 519.47 | -148.04 |
| 7,300 | 1,032.51 | 884.47 | -148.04 |
| 36,500 | 3,952.51 | 3,804.47 | -148.04 |

**Curve assumptions**

| Assumption | Value | Unit |
| - | -: | - |
| Origin list price · Allocated cluster control plane | 0.1 | USD/cluster-hour |
| Origin list price · Allocated worker CPU | 0.03745 | USD/vCPU-hour |
| Origin list price · Allocated worker memory | 0.0035875 | USD/GiB-hour |
| Origin list price · Cluster management requests | 0 | USD/Requests |
| Target / origin worker allocation | 1.15 | multiplier |
| Target price guess · read | 0 | USD/read |
| Target price guess · write | 0 | USD/write |
| Target price guess · provider operation | 0 | USD/provider operation |
| Target list price · GiB-month | 0.0425 | USD/GiB-month |
| Target price guess · published GiB | 0 | USD/published GiB |
| Target price guess · delivered GiB | 0 | USD/delivered GiB |
| Target list price · network GiB | 0 | USD/network GiB |
| Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| Target list price · vCPU-hour | 0.015 | USD/vCPU-hour |
| Target list price · GiB-hour | 0.002 | USD/GiB-hour |
| Target list price · resource-hour | 0.1 | USD/resource-hour |
| Target price guess · resource-month | 0 | USD/resource-month |
| Target price guess · input token | 0 | USD/input token |
| Target price guess · output token | 0 | USD/output token |
| Target monthly base charge | 0 | USD/month |
| Approximate target service minimum | 0 | USD/month |
| Minimum primary CPU | 2 | vCPU |
| Minimum primary RAM | 8 | GiB |
| Minimum primary disk | 100 | GiB |
| Additional full-price standby copy | 0 | 0 or 1 |
| Allocated share of provisioned cost | 1 | fraction |
| Read/write work per vCPU-second | 1,500 | operations/vCPU-second |
| Planning peak / mean work | 2 | multiplier |
| Planning primary CPU utilization | 0.7 | fraction |
| Resident state reserved in RAM | 0.1 | fraction |
| Planning disk utilization | 0.8 | fraction |
| Maintenance and log disk reserve | 20 | GiB |
| Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| Dependent object sink write price guess | 0.000005 | USD/write |

* Only this native meter varies; all other source usage and translation assumptions retain the displayed defaults. Other native meters and workload assumptions retain their explicitly displayed default quantities. Workload translation and capacity assumptions are not benchmark measurements.
* Native monthly usage priced at the cited provider list prices; listed target allowances apply where present, excluding invoice credits, taxes and negotiated discounts. Rates as of 2026-10-22: us-east-1 → us-ashburn-1, USD/month.
* Source prices are reference charges, not an invoice. Target lines cover selected service usage/configuration only; adapter hosting and Tensor9 fees are excluded.
* Samples of explicit prices are not performance measurements or capacity qualification. No interpolation or break-even guarantee is implied.
* Variant assumptions show the first axis sample; any axis-dependent configuration is described by this curve's workload note.
* Rates are cited provider list prices, editable for discounts, commitments or another region. Workload translation and capacity coefficients remain editable planning assumptions, not benchmark measurements or a commercial quote.
* Default-zero rates are explicit assumptions, not evidence that the deployed service or resource is free.
* Provisioned-unit minimums use an editable approximate allocation floor. Modeled target service cost is max(usage/allocation, minimum), with billable network, durable staging and dependent sinks added separately; actual RU/TU sizing, scaling increments and throughput remain unqualified.
* Durable staging is priced once: provisioned targets include adapter state in their selected allocation; native targets add a separate staging allocation when required. Adapter hosting is a separate allocation and must exclude resources already priced as staging, workers or target capacity.
* A declared adapter mapping and cost model do not establish implementation availability or service equivalence.
* This is a declared directed mapping; a planning estimate does not establish deployment or request-serving support.
* Origin unit prices are cited provider list prices; capacity coefficients and translation assumptions are editable authored planning guesses, not measured capacity or a provider quote.
* Management requests do not reveal resource allocation or workload traffic. Provisioned resources and traffic are independent inputs.
* The discovery adapter does not itself own or provision the cluster. Allocate existing cluster capacity once across adapters.
* Cluster control-plane hours bill at the listed management fee and worker CPU/RAM at the provider's VM decomposition; allocate a shared cluster once across adapters. The compiler emits type ENHANCED\_CLUSTER (the EKS standard tier's equivalent); a Basic cluster is free. OCI: E5 flexible shape (the shape this repo emits); Balanced block volume; first 10 TB of egress free.
* AWS Price List API, AmazonEKS offer: [https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AmazonEKS/current/us-east-1/index.json](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AmazonEKS/current/us-east-1/index.json)
* AWS Price List API, AmazonEC2 offer (CSV): [https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AmazonEC2/current/us-east-1/index.csv](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AmazonEC2/current/us-east-1/index.csv)
* Amazon EKS pricing: [https://aws.amazon.com/eks/pricing/](https://aws.amazon.com/eks/pricing/)
* OCI price list API: [https://apexapps.oracle.com/pls/apex/cetools/api/v1/products/](https://apexapps.oracle.com/pls/apex/cetools/api/v1/products/)

Cost scope: Modeled target native service and explicitly modeled state allocation; hosting and Tensor9 fees only when supplied.

Excluded costs and workload features:

* Worker disks, GPUs, ingress, network traffic, extended support and observability.
* Taxes, discounts, credits and free-tier allowances not explicitly listed by this model.
* Unmodeled dependent services, task execution and operations outside the selected workload family.

List prices read: 2026-10-22. Model: `plan-00d4314e21f00831443da77b5e630dfa0a1c813c` / `2026-10-22.planning.2`. Curve: `workload-2`.

Sources: [AWS Price List API, AmazonEKS offer](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AmazonEKS/current/us-east-1/index.json), [AWS Price List API, AmazonEC2 offer (CSV)](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AmazonEC2/current/us-east-1/index.csv), [Amazon EKS pricing](https://aws.amazon.com/eks/pricing/), [OCI price list API](https://apexapps.oracle.com/pls/apex/cetools/api/v1/products/).

**Managed Kubernetes and discovery (EKS) → OKE Cluster: Authored native-usage planning example.** Native monthly usage priced at the cited provider list prices; listed target allowances apply where present, excluding invoice credits, taxes and negotiated discounts.

Scenario source region: us-east-1. Scenario target region: us-ashburn-1. Currency: USD.

| Monthly component | USD |
| - | -: |
| Origin: Allocated cluster control plane | 73.00 |
| Origin: Allocated worker CPU | 218.71 |
| Origin: Allocated worker memory | 83.80 |
| Origin: Cluster management requests | 0.00 |
| Target: Target retained physical data | 0.00 |
| Target: Additional broker replica storage | 0.00 |
| Target: Target native provider operations | 0.00 |
| Target: Execution or worker CPU | 100.74 |
| Target: Execution or worker RAM | 53.73 |
| Target: Selected billable network | 0.00 |
| Target: Independent native resources | 73.00 |
| Target: Independent native resources | 0.00 |
| **Origin service subtotal** | **375.51** |
| **Target service subtotal** | **227.47** |

Unestimated components: Adapter hosting, Tensor9 fees. A modeled adapted total and savings require these costs.

Cost scope: Modeled target native service and explicitly modeled state allocation; hosting and Tensor9 fees only when supplied.

Excluded costs and workload features:

* Worker disks, GPUs, ingress, network traffic, extended support and observability.
* Taxes, discounts, credits and free-tier allowances not explicitly listed by this model.
* Unmodeled dependent services, task execution and operations outside the selected workload family.

**Scenario assumptions**

| Input | Value | Unit |
| - | -: | - |
| Origin list price · Allocated cluster control plane | 0.1 | USD/cluster-hour |
| Origin list price · Allocated worker CPU | 0.03745 | USD/vCPU-hour |
| Origin list price · Allocated worker memory | 0.0035875 | USD/GiB-hour |
| Origin list price · Cluster management requests | 0 | USD/Requests |
| Target / origin worker allocation | 1.15 | multiplier |
| Target price guess · read | 0 | USD/read |
| Target price guess · write | 0 | USD/write |
| Target price guess · provider operation | 0 | USD/provider operation |
| Target list price · GiB-month | 0.0425 | USD/GiB-month |
| Target price guess · published GiB | 0 | USD/published GiB |
| Target price guess · delivered GiB | 0 | USD/delivered GiB |
| Target list price · network GiB | 0 | USD/network GiB |
| Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| Target list price · vCPU-hour | 0.015 | USD/vCPU-hour |
| Target list price · GiB-hour | 0.002 | USD/GiB-hour |
| Target list price · resource-hour | 0.1 | USD/resource-hour |
| Target price guess · resource-month | 0 | USD/resource-month |
| Target price guess · input token | 0 | USD/input token |
| Target price guess · output token | 0 | USD/output token |
| Target monthly base charge | 0 | USD/month |
| Approximate target service minimum | 0 | USD/month |
| Minimum primary CPU | 2 | vCPU |
| Minimum primary RAM | 8 | GiB |
| Minimum primary disk | 100 | GiB |
| Additional full-price standby copy | 0 | 0 or 1 |
| Allocated share of provisioned cost | 1 | fraction |
| Read/write work per vCPU-second | 1,500 | operations/vCPU-second |
| Planning peak / mean work | 2 | multiplier |
| Planning primary CPU utilization | 0.7 | fraction |
| Resident state reserved in RAM | 0.1 | fraction |
| Planning disk utilization | 0.8 | fraction |
| Maintenance and log disk reserve | 20 | GiB |
| Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| Dependent object sink write price guess | 0.000005 | USD/write |
| Allocated cluster control plane | 730 | cluster-hour |
| Allocated worker CPU | 5,840 | vCPU-hour |
| Allocated worker memory | 23,360 | GiB-hour |
| Cluster management requests | 1,000,000 | Requests |

* Translated reads: 0 operations.

* Translated writes: 0 operations.

* Translated resident physical data: 0 GiB-month.

* Native provider operations: 1,000,000 operations.

* Published payload: 0 GiB.

* Delivered payload: 0 GiB.

* Allocated execution CPU: 6,716 vCPU-hour.

* Allocated execution RAM: 26,864 GiB-hour.

* Independent resource allocation: 730 resource-hour.

* Independent inventory: 0 resource-month.

* Input tokens: 0 tokens.

* Output tokens: 0 tokens.

* Billable network: 0 GiB.

* Dependent object sink retained data: 0 GiB-month.

* Dependent object sink writes: 0 writes.

* Rates are cited provider list prices, editable for discounts, commitments or another region. Workload translation and capacity coefficients remain editable planning assumptions, not benchmark measurements or a commercial quote.

* Default-zero rates are explicit assumptions, not evidence that the deployed service or resource is free.

* Provisioned-unit minimums use an editable approximate allocation floor. Modeled target service cost is max(usage/allocation, minimum), with billable network, durable staging and dependent sinks added separately; actual RU/TU sizing, scaling increments and throughput remain unqualified.

* Durable staging is priced once: provisioned targets include adapter state in their selected allocation; native targets add a separate staging allocation when required. Adapter hosting is a separate allocation and must exclude resources already priced as staging, workers or target capacity.

* A declared adapter mapping and cost model do not establish implementation availability or service equivalence.

* This is a declared directed mapping; a planning estimate does not establish deployment or request-serving support.

* Origin unit prices are cited provider list prices; capacity coefficients and translation assumptions are editable authored planning guesses, not measured capacity or a provider quote.

* Management requests do not reveal resource allocation or workload traffic. Provisioned resources and traffic are independent inputs.

* The discovery adapter does not itself own or provision the cluster. Allocate existing cluster capacity once across adapters.

* Cluster control-plane hours bill at the listed management fee and worker CPU/RAM at the provider's VM decomposition; allocate a shared cluster once across adapters. The compiler emits type ENHANCED\_CLUSTER (the EKS standard tier's equivalent); a Basic cluster is free. OCI: E5 flexible shape (the shape this repo emits); Balanced block volume; first 10 TB of egress free.

List prices read: 2026-10-22. Model: `plan-00d4314e21f00831443da77b5e630dfa0a1c813c` / `2026-10-22.planning.2`. Scenario: `planning-example`.

Sources: [AWS Price List API, AmazonEKS offer](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AmazonEKS/current/us-east-1/index.json), [AWS Price List API, AmazonEC2 offer (CSV)](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AmazonEC2/current/us-east-1/index.csv), [Amazon EKS pricing](https://aws.amazon.com/eks/pricing/), [OCI price list API](https://apexapps.oracle.com/pls/apex/cetools/api/v1/products/).

## Costs

Estimated monthly service charges for each backend with a published cost model, at one sampled workload from that model's cost curve. Adapter hosting and Tensor9 fees are excluded. [How Tensor9 estimates costs](https://docs.tensor9.com/cloud-adapter-early-access/costs/overview.md) explains the method, what the estimates include and how to read their qualifications.

| Backend | Sampled workload | Price basis | Origin USD/month | Backend USD/month | Difference | Mapping |
| - | - | - | -: | -: | -: | - |
| AKS Cluster | Worker CPU-hours per month: 23,360 vCPU-hour/month | Cited list prices, 2026-10-22 | 1,031.64 | 987.25 | -44.38 | Service adapter |
| GKE Cluster | Worker CPU-hours per month: 23,360 vCPU-hour/month | Cited list prices, 2026-10-22 | 1,031.64 | 1,036.02 | +4.38 | Service adapter |
| Kubernetes Cluster | Worker CPU-hours per month: 23,360 vCPU-hour/month; one copy | Cited list prices, 2026-10-22 | 1,031.64 | 2,288.68 | +1,257.04 | Native or deployment |
| OKE Cluster | Worker CPU-hours per month: 23,360 vCPU-hour/month | Cited list prices, 2026-10-22 | 1,031.64 | 529.69 | -501.95 | Service adapter |

Difference means backend minus origin; a positive difference means the backend costs more. Workloads and target configurations differ by model, so compare each row's difference at its stated workload rather than charges across rows.
Cost curves across workload sizes, with every assumption and exclusion: [EKS Cluster costs](https://docs.tensor9.com/cloud-adapter-early-access/costs/additional-services/aws-eks-cluster).

## Service level agreements

> [!WARNING]
>
> These tables show Tensor9's standard service levels and adapters whose standard terms are still being defined. Your signed agreement determines the SLAs, covered adapters and operations, limits, remedies and support terms that apply to your deployment.

Listed terms cover requests sent through this service adapter. They do not cover direct connections to the target service or replace the cloud provider's own SLA. Each origin-to-target pair has its own terms or an explicit pending status.

See the [SLA tables](https://docs.tensor9.com/cloud-adapter-early-access/support/service-adapter-slas.md), [measurement rules](https://docs.tensor9.com/cloud-adapter-early-access/support/service-levels.md), and [scaling conditions](https://docs.tensor9.com/cloud-adapter-early-access/support/scaling-and-limits.md).

### EKS Cluster to AKS Cluster

| SLA | Service level | What is covered | Conditions |
| - | - | - | - |
| Cluster, workload and identity reads adapter-added latency | +8 ms monthly p99 | `aws::1.0.0::eks`: `DescribeCluster`, `ListClusters` | One point read or at most 100 returned resources; manifest/status at most 1 MiB. |
| Cluster and workload desired-state admission adapter-added latency | +20 ms monthly p99 | `aws::1.0.0::eks`: `CreateCluster`, `CreateNodegroup`, `DeleteCluster`, `DeleteNodegroup` | One cluster/service/task definition; at most 20 containers and at most 100 environment/secret/network entries; readiness separate. |
| Documented adapter behavior | Preserve the supported behavior documented for this adapter | `aws::1.0.0::eks`: `DescribeCluster`, `ListClusters`, `CreateCluster`, `CreateNodegroup`, `DeleteCluster`, `DeleteNodegroup` | Accepted desired state is durable and generation ordered. Workload identity binds only the intended service account/role, secrets are not emitted into public fields, and observed status never claims readiness before the target reports it. Unsupported scheduling or networking modes fail before partial creation. |
| Endpoint reachability | 99.9% per calendar month | Adapter endpoint reachability | The agreed production deployment has healthy target connectivity and receives a valid adapter health probe. This measures the adapter endpoint, not the target provider's service. |
| Adapter autoscaling and limits | Automatic scaling within the workload and deployment limits in your agreement | Adapter behavior across requests | Your agreement states the maximum request rate, burst size, request and response sizes, concurrency, and target calls per request. Tensor9 maintains adapter capacity inside that envelope. Target-service quotas and capacity are separate. |

**Adapter-added latency.** A + prefix marks time added by the adapter, not the total time your application waits. Total request time includes adapter processing, backend service time and network time. The backend provider's SLA applies independently. Only separately measured target-service wait may be subtracted, and only when your agreement permits it; internal metadata, coordination and retry processing still count. For one request, 12 ms of adapter processing plus 90 ms waiting for the backend means at least 102 ms total. This example does not add monthly p99 values.

**What Tensor9 covers.** These service levels cover the adapter between the origin API and target API. They do not replace the target provider's SLA.

**How latency is counted.** Adapter work, including metadata and coordination, counts. Only separately measured permitted target waits are excluded.

**Which terms apply.** Your signed agreement names the covered operations, workload limits, remedies, and final service levels for your deployment.

#### What this adapter does

Cluster, workload and identity calls validate AWS-shaped intent, record the desired resource and reconcile native objects on azure::1.0.0::aks::cluster. In-cluster Kubernetes traffic and application packet flow are not proxied by this control-plane estimate. Provider provisioning and image pull time are readiness phases; adapter validation, durable admission and status conversion remain covered.

#### How the latency targets were chosen

**Cluster, workload and identity reads: +8 ms monthly p99 (adapter-added).** `DescribeCluster`, `ListClusters`. Indexed state read and AWS response mapping.

**Cluster and workload desired-state admission: +20 ms monthly p99 (adapter-added).** `CreateCluster`, `CreateNodegroup`, `DeleteCluster`, `DeleteNodegroup`. Validation, durable generation commit and reconciliation scheduling.

Your signed agreement sets the terms for your deployment. A target does not add an operation or option that the compatibility tables mark unavailable.

#### What counts toward latency

For a request-response row, measure from the agreed ingress boundary to dispatch of the complete response. A row that explicitly names a first response chunk ends at that chunk; its number does not cover the rest of the stream. A long-poll row names the intentional wait and when adapter delay starts. Include parsing, authorization, admission, translation, serialization, adapter-owned storage and coordination, retries and response handling. Subtract only separately measured target-workload waits and external network segments allowed by the measurement rules. The adapter's own response handling and dispatch remain covered. A database used for adapter metadata is still adapter work, even if a cloud provider hosts it.

For concurrent calls, exclude the union of permitted wait intervals, not the sum of overlapping spans. Calculate each request's adapter duration first, then the monthly p99. Do not subtract one service's p99 from another's. Known adapter timeouts are over-budget samples; failed or incomplete requests cannot disappear to improve the percentile. Missing measurements do not become zero latency. An SDK call span alone does not prove how much of its duration can be excluded.

#### Endpoint reachability and request failures

The endpoint-reachability target measures adapter health checks. Correctly forwarding a target quota or permission error is different from producing that error because the adapter sent the wrong request. Adapter-caused failures remain Tensor9's responsibility even when the target is healthy.

Correctness and data-integrity requirements apply to every supported request. Endpoint reachability does not measure request correctness or grant an allowance for incorrect results.

#### Scaling and target-service capacity

Independent clusters, services, tasks and identity associations reconcile concurrently. Mutations for one object serialize by generation, list calls are bounded pages, and status polling must not starve writes. Qualification fixes object count, manifest size, container count, tag count and concurrent reconcilers.

Tell Tensor9 the expected steady rate, bursts, concurrency, payload sizes and operation mix. Tensor9 sizes and scales the adapter for the agreed load; you choose and monitor the target service's capacity with Tensor9's help. A latency budget is not a requests-per-second rating. Larger requests and higher rates need explicit terms, not silent inheritance of a small-request SLA.

#### Data and behavior guarantees

Accepted desired state is durable and generation ordered. Workload identity binds only the intended service account/role, secrets are not emitted into public fields, and observed status never claims readiness before the target reports it. Unsupported scheduling or networking modes fail before partial creation.

#### Example and diagnosis

CreateCluster records a bounded cluster specification and returns its stable identity. Native provisioning may continue after the adapter response. DescribeCluster is a bounded read of desired plus observed state and must not report ACTIVE until the target control plane is actually ready.

Use `tensor9 explain` and the documented explain headers to understand the selected adapter and its behavior. Correlate available request diagnostics with the target provider's latency, throttling and capacity metrics. An explain report helps diagnose a request; it is not by itself a qualified SLA timing measurement. Share the operation, request shape, timestamps and request identifiers with support, with credentials and customer payloads removed.

### EKS Cluster to GKE Cluster

| SLA | Service level | What is covered | Conditions |
| - | - | - | - |
| Cluster, workload and identity reads adapter-added latency | +8 ms monthly p99 | `aws::1.0.0::eks`: `DescribeCluster`, `DescribeNodegroup`, `ListClusters`, `ListNodegroups` | One point read or at most 100 returned resources; manifest/status at most 1 MiB. |
| Cluster and workload desired-state admission adapter-added latency | +20 ms monthly p99 | `aws::1.0.0::eks`: `CreateCluster`, `DeleteCluster`, `UpdateClusterVersion` | One cluster/service/task definition; at most 20 containers and at most 100 environment/secret/network entries; readiness separate. |
| Documented adapter behavior | Preserve the supported behavior documented for this adapter | `aws::1.0.0::eks`: `DescribeCluster`, `DescribeNodegroup`, `ListClusters`, `ListNodegroups`, `CreateCluster`, `DeleteCluster`, `UpdateClusterVersion` | Accepted desired state is durable and generation ordered. Workload identity binds only the intended service account/role, secrets are not emitted into public fields, and observed status never claims readiness before the target reports it. Unsupported scheduling or networking modes fail before partial creation. |
| Endpoint reachability | 99.9% per calendar month | Adapter endpoint reachability | The agreed production deployment has healthy target connectivity and receives a valid adapter health probe. This measures the adapter endpoint, not the target provider's service. |
| Adapter autoscaling and limits | Automatic scaling within the workload and deployment limits in your agreement | Adapter behavior across requests | Your agreement states the maximum request rate, burst size, request and response sizes, concurrency, and target calls per request. Tensor9 maintains adapter capacity inside that envelope. Target-service quotas and capacity are separate. |

**Adapter-added latency.** A + prefix marks time added by the adapter, not the total time your application waits. Total request time includes adapter processing, backend service time and network time. The backend provider's SLA applies independently. Only separately measured target-service wait may be subtracted, and only when your agreement permits it; internal metadata, coordination and retry processing still count. For one request, 12 ms of adapter processing plus 90 ms waiting for the backend means at least 102 ms total. This example does not add monthly p99 values.

**What Tensor9 covers.** These service levels cover the adapter between the origin API and target API. They do not replace the target provider's SLA.

**How latency is counted.** Adapter work, including metadata and coordination, counts. Only separately measured permitted target waits are excluded.

**Which terms apply.** Your signed agreement names the covered operations, workload limits, remedies, and final service levels for your deployment.

#### What this adapter does

Cluster, workload and identity calls validate AWS-shaped intent, record the desired resource and reconcile native objects on google::1.0.0::gke::cluster. In-cluster Kubernetes traffic and application packet flow are not proxied by this control-plane estimate. Provider provisioning and image pull time are readiness phases; adapter validation, durable admission and status conversion remain covered.

#### How the latency targets were chosen

**Cluster, workload and identity reads: +8 ms monthly p99 (adapter-added).** `DescribeCluster`, `DescribeNodegroup`, `ListClusters`, `ListNodegroups`. Indexed state read and AWS response mapping.

**Cluster and workload desired-state admission: +20 ms monthly p99 (adapter-added).** `CreateCluster`, `DeleteCluster`, `UpdateClusterVersion`. Validation, durable generation commit and reconciliation scheduling.

Your signed agreement sets the terms for your deployment. A target does not add an operation or option that the compatibility tables mark unavailable.

#### What counts toward latency

For a request-response row, measure from the agreed ingress boundary to dispatch of the complete response. A row that explicitly names a first response chunk ends at that chunk; its number does not cover the rest of the stream. A long-poll row names the intentional wait and when adapter delay starts. Include parsing, authorization, admission, translation, serialization, adapter-owned storage and coordination, retries and response handling. Subtract only separately measured target-workload waits and external network segments allowed by the measurement rules. The adapter's own response handling and dispatch remain covered. A database used for adapter metadata is still adapter work, even if a cloud provider hosts it.

For concurrent calls, exclude the union of permitted wait intervals, not the sum of overlapping spans. Calculate each request's adapter duration first, then the monthly p99. Do not subtract one service's p99 from another's. Known adapter timeouts are over-budget samples; failed or incomplete requests cannot disappear to improve the percentile. Missing measurements do not become zero latency. An SDK call span alone does not prove how much of its duration can be excluded.

#### Endpoint reachability and request failures

The endpoint-reachability target measures adapter health checks. Correctly forwarding a target quota or permission error is different from producing that error because the adapter sent the wrong request. Adapter-caused failures remain Tensor9's responsibility even when the target is healthy.

Correctness and data-integrity requirements apply to every supported request. Endpoint reachability does not measure request correctness or grant an allowance for incorrect results.

#### Scaling and target-service capacity

Independent clusters, services, tasks and identity associations reconcile concurrently. Mutations for one object serialize by generation, list calls are bounded pages, and status polling must not starve writes. Qualification fixes object count, manifest size, container count, tag count and concurrent reconcilers.

Tell Tensor9 the expected steady rate, bursts, concurrency, payload sizes and operation mix. Tensor9 sizes and scales the adapter for the agreed load; you choose and monitor the target service's capacity with Tensor9's help. A latency budget is not a requests-per-second rating. Larger requests and higher rates need explicit terms, not silent inheritance of a small-request SLA.

#### Data and behavior guarantees

Accepted desired state is durable and generation ordered. Workload identity binds only the intended service account/role, secrets are not emitted into public fields, and observed status never claims readiness before the target reports it. Unsupported scheduling or networking modes fail before partial creation.

#### Example and diagnosis

CreateCluster records a bounded cluster specification and returns its stable identity. Native provisioning may continue after the adapter response. DescribeCluster is a bounded read of desired plus observed state and must not report ACTIVE until the target control plane is actually ready.

Use `tensor9 explain` and the documented explain headers to understand the selected adapter and its behavior. Correlate available request diagnostics with the target provider's latency, throttling and capacity metrics. An explain report helps diagnose a request; it is not by itself a qualified SLA timing measurement. Share the operation, request shape, timestamps and request identifiers with support, with credentials and customer payloads removed.

### EKS Cluster to Kubernetes Cluster

**SLA status:** Not applicable

Applications use the target cluster's Kubernetes API directly. This mapping does not expose an EKS management adapter endpoint. Kubernetes API availability and pod scheduling are not measured as service-adapter request latency.

### EKS Cluster to OKE Cluster

| SLA | Service level | What is covered | Conditions |
| - | - | - | - |
| Cluster, workload and identity reads adapter-added latency | +8 ms monthly p99 | `aws::1.0.0::eks`: `DescribeCluster`, `ListClusters` | One point read or at most 100 returned resources; manifest/status at most 1 MiB. |
| Cluster and workload desired-state admission adapter-added latency | +20 ms monthly p99 | `aws::1.0.0::eks`: `CreateCluster`, `CreateNodegroup`, `DeleteCluster`, `DeleteNodegroup`, `UpdateNodegroupConfig` | One cluster/service/task definition; at most 20 containers and at most 100 environment/secret/network entries; readiness separate. |
| Documented adapter behavior | Preserve the supported behavior documented for this adapter | `aws::1.0.0::eks`: `DescribeCluster`, `ListClusters`, `CreateCluster`, `CreateNodegroup`, `DeleteCluster`, `DeleteNodegroup`, `UpdateNodegroupConfig` | Accepted desired state is durable and generation ordered. Workload identity binds only the intended service account/role, secrets are not emitted into public fields, and observed status never claims readiness before the target reports it. Unsupported scheduling or networking modes fail before partial creation. |
| Endpoint reachability | 99.9% per calendar month | Adapter endpoint reachability | The agreed production deployment has healthy target connectivity and receives a valid adapter health probe. This measures the adapter endpoint, not the target provider's service. |
| Adapter autoscaling and limits | Automatic scaling within the workload and deployment limits in your agreement | Adapter behavior across requests | Your agreement states the maximum request rate, burst size, request and response sizes, concurrency, and target calls per request. Tensor9 maintains adapter capacity inside that envelope. Target-service quotas and capacity are separate. |

**Adapter-added latency.** A + prefix marks time added by the adapter, not the total time your application waits. Total request time includes adapter processing, backend service time and network time. The backend provider's SLA applies independently. Only separately measured target-service wait may be subtracted, and only when your agreement permits it; internal metadata, coordination and retry processing still count. For one request, 12 ms of adapter processing plus 90 ms waiting for the backend means at least 102 ms total. This example does not add monthly p99 values.

**What Tensor9 covers.** These service levels cover the adapter between the origin API and target API. They do not replace the target provider's SLA.

**How latency is counted.** Adapter work, including metadata and coordination, counts. Only separately measured permitted target waits are excluded.

**Which terms apply.** Your signed agreement names the covered operations, workload limits, remedies, and final service levels for your deployment.

#### What this adapter does

Cluster, workload and identity calls validate AWS-shaped intent, record the desired resource and reconcile native objects on oci::1.0.0::oke::cluster. In-cluster Kubernetes traffic and application packet flow are not proxied by this control-plane estimate. Provider provisioning and image pull time are readiness phases; adapter validation, durable admission and status conversion remain covered.

#### How the latency targets were chosen

**Cluster, workload and identity reads: +8 ms monthly p99 (adapter-added).** `DescribeCluster`, `ListClusters`. Indexed state read and AWS response mapping.

**Cluster and workload desired-state admission: +20 ms monthly p99 (adapter-added).** `CreateCluster`, `CreateNodegroup`, `DeleteCluster`, `DeleteNodegroup`, `UpdateNodegroupConfig`. Validation, durable generation commit and reconciliation scheduling.

Your signed agreement sets the terms for your deployment. A target does not add an operation or option that the compatibility tables mark unavailable.

#### What counts toward latency

For a request-response row, measure from the agreed ingress boundary to dispatch of the complete response. A row that explicitly names a first response chunk ends at that chunk; its number does not cover the rest of the stream. A long-poll row names the intentional wait and when adapter delay starts. Include parsing, authorization, admission, translation, serialization, adapter-owned storage and coordination, retries and response handling. Subtract only separately measured target-workload waits and external network segments allowed by the measurement rules. The adapter's own response handling and dispatch remain covered. A database used for adapter metadata is still adapter work, even if a cloud provider hosts it.

For concurrent calls, exclude the union of permitted wait intervals, not the sum of overlapping spans. Calculate each request's adapter duration first, then the monthly p99. Do not subtract one service's p99 from another's. Known adapter timeouts are over-budget samples; failed or incomplete requests cannot disappear to improve the percentile. Missing measurements do not become zero latency. An SDK call span alone does not prove how much of its duration can be excluded.

#### Endpoint reachability and request failures

The endpoint-reachability target measures adapter health checks. Correctly forwarding a target quota or permission error is different from producing that error because the adapter sent the wrong request. Adapter-caused failures remain Tensor9's responsibility even when the target is healthy.

Correctness and data-integrity requirements apply to every supported request. Endpoint reachability does not measure request correctness or grant an allowance for incorrect results.

#### Scaling and target-service capacity

Independent clusters, services, tasks and identity associations reconcile concurrently. Mutations for one object serialize by generation, list calls are bounded pages, and status polling must not starve writes. Qualification fixes object count, manifest size, container count, tag count and concurrent reconcilers.

Tell Tensor9 the expected steady rate, bursts, concurrency, payload sizes and operation mix. Tensor9 sizes and scales the adapter for the agreed load; you choose and monitor the target service's capacity with Tensor9's help. A latency budget is not a requests-per-second rating. Larger requests and higher rates need explicit terms, not silent inheritance of a small-request SLA.

#### Data and behavior guarantees

Accepted desired state is durable and generation ordered. Workload identity binds only the intended service account/role, secrets are not emitted into public fields, and observed status never claims readiness before the target reports it. Unsupported scheduling or networking modes fail before partial creation.

#### Example and diagnosis

CreateCluster records a bounded cluster specification and returns its stable identity. Native provisioning may continue after the adapter response. DescribeCluster is a bounded read of desired plus observed state and must not report ACTIVE until the target control plane is actually ready.

Use `tensor9 explain` and the documented explain headers to understand the selected adapter and its behavior. Correlate available request diagnostics with the target provider's latency, throttling and capacity metrics. An explain report helps diagnose a request; it is not by itself a qualified SLA timing measurement. Share the operation, request shape, timestamps and request identifiers with support, with credentials and customer payloads removed.

## Install and run

The documentation and SLAs are public. Downloading and running the Cloud Adapter binary requires an entitled customer account. Set `T9_API_KEY` as described in [Install and Authenticate](https://docs.tensor9.com/cloud-adapter-early-access/getting-started/install-and-authenticate.md), then list the adapters your account may use with this origin:

```sh theme={null}
tensor9 adapt svc list \
  -origin aws::1.0.0::eks::cluster
```

The result is limited to directed mappings for this origin that your account is entitled to use. Use a returned backend identifier when configuring the adapter or investigating a request.

Request binary access from [hello@tensor9.com](mailto:hello@tensor9.com) if your account does not yet include this direction.

## Existing data and credentials

Selecting a backend does not copy existing data, credentials or access policies. Plan and verify migration separately before changing an application's endpoint. Do not assume an identifier, credential or encrypted value from the origin service works unchanged on the target.

## Configure, tune and debug

Start with [setup](https://docs.tensor9.com/cloud-adapter-early-access/getting-started/overview.md) and [configuration](https://docs.tensor9.com/cloud-adapter-early-access/configuration/overview.md). Use [tuning](https://docs.tensor9.com/cloud-adapter-early-access/tuning/overview.md) to understand supported request tags, [debugging](https://docs.tensor9.com/cloud-adapter-early-access/debugging/overview.md) to investigate a request, and [High Fidelity Cloud Emulators](https://docs.tensor9.com/cloud-adapter-early-access/local-testing/overview.md) to validate a bounded reproduction.

For requests that go through an entitled service adapter, use [tensor9 explain](https://docs.tensor9.com/cloud-adapter-early-access/debugging/explain.md) and [x-t9-explain](https://docs.tensor9.com/cloud-adapter-early-access/debugging/response-headers.md) to inspect the selected mapping.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.