# Kubernetes Cost and Reliability Rules: A Practical Guide > A practical guide to Kubernetes cost and reliability rules across EKS, GKE, and AKS. Source: https://zop.dev/learn/kubernetes-cost-and-reliability-rules Published: 2026-07-01 · Author: avinash-gaurav · Tags: zopnight, learn --- Kubernetes cost and Kubernetes reliability share root causes more often than they share solutions. A deployment without resource requests can both waste node capacity and trigger eviction under pressure. A single-replica service is a cost win until it takes the platform down during a node restart. An HPA pinned at max replicas is a reliability red flag and a sign that the workload is capacity-constrained. Most cost optimization tools cover the cloud-native side: idle EC2 nodes, underused RDS instances, orphan EBS volumes. Most reliability tools cover the workload side: missing resource requests, single-replica services, HPAs at max. ZopNight covers both because the trade-offs only make sense together. This article walks through the workload rule families, how they interact with cloud-native rules, and how to use them to make better cost-versus-reliability decisions. This guide keeps the theory short and spends most of its length on what you can actually do. Every recommendation here is one ZopNight can help you execute, starting from a read-only connection. ## The five workload rule families Reliability rules cover deployments missing CPU or memory requests, missing limits, single-replica services in production namespaces, HPAs pinned at max replicas, and StatefulSets without PodDisruptionBudgets. Security rules cover privileged containers, root containers, host network usage, services without TLS, and IAM linkage gaps. Idle rules catch zero-replica deployments and underused node pools. Orphan rules catch unbound PersistentVolumeClaims, unreferenced ConfigMaps, and stale Secrets. Rightsizing rules catch over-requested namespaces and oversized HPAs. ## Why cost and reliability are linked A deployment that requests four CPUs but uses one wastes node capacity. The cluster autoscaler may keep extra nodes warm to satisfy the request. The cost finding (idle node pool) and the workload finding (over-requested deployment) describe the same problem from two angles. Fixing the workload request fixes the node-pool finding too. Treating them as separate problems leads to half-measures: you scale down the node pool, the eviction rate jumps, the cluster autoscaler scales it back up. ## How rules behave across EKS, GKE, and AKS The rule logic is shared across providers, the per-provider tuning differs. EKS, GKE, and AKS each receive 41 workload rules for 123 total. Provider-specific differences (IRSA on EKS, Workload Identity on GKE, AAD on AKS) are handled by the rule engine without changing the rule IDs. GKE Autopilot is a special case: idle node pool rules are skipped because nodes are managed by Google, but rightsizing rules apply with extra weight because Autopilot bills based on requests. ## A pragmatic adoption path Start with the reliability rules because they catch issues that cause incidents. Resource requests, limits, and PodDisruptionBudgets are usually the first wave. Move to idle and orphan rules next because they have clear cost impact. Add security rules once the platform team is comfortable with the exemption model for legitimate uses of privileged containers. Rightsizing rules are last because they require enough observed usage data to recommend confidently. Most teams reach steady state in eight to twelve weeks. ## Key takeaways - 123 Kubernetes workload rules across EKS, GKE, and AKS (41 each) cover reliability, security, idle, orphan, and rightsizing. - Workload findings and cloud-native findings often describe the same problem from two angles. - Provider differences (IRSA, Workload Identity, AAD) are handled by the rule engine, not by separate rule sets. - A pragmatic adoption path: reliability first, then idle/orphan, then security, then rightsizing. ## Where ZopNight fits ZopNight turns this from reading into doing. It ships 490 built-in audit rules across AWS (216), GCP (127), and Azure (147), 124 of those recommendations are wired to act end to end, 28 one-click and 96 guided, and it starts read-only so you can see the opportunity before you act on any of it. The most direct place to begin is scheduling non-production resources to your working hours, which is covered in the [FinOps](https://zop.dev/learn/finops) guide and shown concretely for [AWS EC2](https://zop.dev/zopnight/aws/ec2). ## How ZopNight schedules non-production resources The loop that does this is deliberately mechanical, and it starts read-only. You connect your cloud provider with a read-only role, and ZopNight discovers every non-production resources across your regions and accounts. It records a per-action permission verdict for each one, so you can see where it can list a resource but not yet stop it, and you review that inventory, filter it by status or type, and search for the specific resources you care about before anything is scheduled. Scheduling itself is a cron you write once in plain terms, stop at 7 PM, start at 8 AM on weekdays, pinned to your timezone so the jobs fire at local business hours rather than UTC. A weekly 24-hour grid shows the schedule visually so you catch gaps and overlaps before you save, and an estimate of active versus inactive hours appears before you commit. Resources attach individually or bundle into groups like "dev-cluster" or "staging-db" so a whole environment follows one cadence. Actions run in dependency order, so a database comes up before the app server that depends on it. When something needs to stay up, an override forces a non-production resources ON or OFF for a defined window, carries a reason so teammates understand why it exists, and expires automatically so nothing is left running by accident. If a start or stop fails, ZopNight retries up to three times and falls back to a dead-letter queue rather than silently dropping the action, and every state change lands in an audit trail that records whether a schedule, an override, or a specific user triggered it. ## Getting started Getting started is intentionally low-stakes: - Connect your cloud provider with a read-only role. Nothing is scheduled or changed at this stage. - Let ZopNight discover your non-production resources and review exactly what it found, filtered by account, region, and status. - Create a schedule in your timezone and attach the non-production resources or groups you want it to cover. - Watch the first cycle run, with Slack, Teams, or Google Chat notifications on every start, stop, and failure, then layer in idle cleanup and guided rightsizing. Production stays excluded by default throughout, and because discovery and recommendations are read-only, you can prove the value before you enable a single action. ## Frequently asked questions ### Does ZopNight need cluster admin? Read access is enough for detection. Cluster admin is required only if auto-remediation applies manifest changes back to the cluster. ### How are kube-system findings handled? kube-system and provider-managed namespaces are excluded by default. Custom exemptions cover other infrastructure namespaces.