Kubernetes load balancer cost arises outside the cluster: every Service of type LoadBalancer makes the cloud controller create a provider load balancer, billed per hour and by traffic processed, and every public address on it costs its own hour. On top comes the traffic the cluster generates: between zones inside the cluster, through NAT gateways to the internet, and as egress to users and other regions. This page describes why the number of load balancers follows the number of Services, how an ingress controller or the Gateway API consolidates them, what cross-zone traffic costs and how topology aware routing lowers it, and where NAT egress sits on the bill. The three providers' prices for load balancers, NAT and addresses are under load balancers, NAT and public IPs, those for traffic under data transfer and egress.

How it works

A Service of type LoadBalancer is an instruction to the cloud controller to create a provider load balancer and point it at the Service's nodes or pods. The load balancer is a provider resource with an hourly price, processed bytes or capacity units and a public address; it exists until the Service is deleted and sits in billing data under the provider's network service. Twenty Services of that type are twenty load balancers. An ingress controller or a Gateway API implementation consolidates them: one load balancer accepts all HTTP traffic and distributes it by host and path to Services that can then be of type ClusterIP. With the Gateway API several teams share one Gateway to which they attach their HTTPRoute objects; the load balancer is one, the routes are many.

Traffic inside the cluster is not free once it leaves a zone. A cluster across three zones sends part of every request from a pod to a pod in another zone, and at AWS each direction of that traffic costs per gigabyte; the same traffic between zones is charged at Google Cloud. Kubernetes offers topology aware routing against it: with the annotation service.kubernetes.io/topology-mode: Auto the EndpointSlice controller distributes hints by which kube-proxy routes requests to endpoints in the same zone, as long as every zone has enough endpoints. internalTrafficPolicy: Local keeps traffic on the same node, externalTrafficPolicy: Local saves the second hop from the load balancer over a foreign node. Each setting trades distribution for traffic cost.

Egress to the internet leaves the cluster through a NAT gateway or the provider's load balancer, depending on the network model, and costs there per hour and per gigabyte processed, plus the data transfer out. A cluster that pulls images from a public registry, sends metrics to an external service and reads objects from a storage service in its own region generates NAT traffic no pod sees as cost.

one Service of typeLoadBalancer eachthrough an ingresscontroller or Gatewaypod to pod acrossa zoneout of the clusterHow are Services exposed?A provider load balancer perService: hours, processed bytesor capacity units, a publicaddress, until it is deletedOne load balancer for all HTTPtraffic, distributed by host andpath; the Services ClusterIPWhere does thetraffic go?Per gigabyte, each directionat AWS; topology aware routingkeeps it in the zoneThe NAT gateway: hours,gigabytes processed andthe transfer out
Every Service of type LoadBalancer is a provider load balancer, an ingress makes it one, and traffic pays again when it crosses a zone or leaves through NAT

AWS

With the AWS Load Balancer Controller, a Service of type LoadBalancer creates a Network Load Balancer and an Ingress object an Application Load Balancer; several Ingress objects share one ALB through the annotation alb.ingress.kubernetes.io/group.name. EKS Auto Mode ships this integration. Per load balancer, hours and capacity units accrue, per public IPv4 address USD 0.005 per hour, per NAT gateway hours and gigabytes processed, and traffic between Availability Zones USD 0.01 per gigabyte in each direction; the lines and usage types are explained under load balancing and public IPv4 pricing and data transfer pricing.

Azure

AKS runs one Standard Load Balancer per cluster, which also translates the nodes' outbound traffic; every Service of type LoadBalancer gets its own frontend IP on that load balancer, and each of these public addresses is billed individually. Egress can run through a NAT gateway or a route of your own instead.

Google Cloud

A Service of type LoadBalancer creates a passthrough Network Load Balancer, an Ingress object an Application Load Balancer, the Gateway API one per Gateway; egress from private nodes runs through Cloud NAT, billed per gateway hour and per gigabyte.

What it means for your cost

Three decisions set a cluster's network share. First, the number of load balancers: one ingress or gateway per cluster and environment instead of one load balancer per Service; the Services themselves become ClusterIP. Second, the topology: spreading pods across three zones pays cross-zone traffic, and topology aware routing lowers it only when every zone has enough replicas; a cluster in one zone saves that traffic and loses zone resilience. Third, egress: private endpoints to the storage and registry services of the same region take traffic off the NAT gateway, and a registry in the same region saves the image pull over the internet (data transfer optimisation).

yesnoThe number of load balancers: oneingress or gateway per cluster andenvironment, Services as ClusterIPPods spread acrossthree zones?Cross-zone traffic paid; topologyaware routing lowers it only withenough replicas in every zoneOne zone: the traffic saved,the zone resilience lostEgress: private endpoints to thestorage and registry services ofthe region take traffic offthe NAT gateway
One ingress instead of a balancer per Service, the zone spread weighed against cross-zone traffic, and private endpoints taking the egress off the NAT gateway

In billing data these lines belong to the provider's network service and reach the cluster only through tags the controller sets, and the namespace only through a rule: a load balancer per Service can be assigned to the team, the ingress and the NAT gateway are shared cluster costs with a key by requests or bytes. Which zones and nodes a pod gets is decided by the node pool and its spread across zones.

Where it goes wrong

  • One load balancer per Service. Symptom: the provider's network service shows dozens of load balancers for one cluster. Cause: Services of type LoadBalancer instead of one ingress; each pays its hours and its address.
  • Load balancer outlives the Service. Symptom: a load balancer without targets keeps running. Cause: the Service was deleted while the controller was down, or a finalizer remained; the provider does not clean up.
  • Cross-zone traffic unexpectedly high. Symptom: a region's data transfer line grows with the cluster. Cause: pods and their dependencies spread across zones without topology aware routing; every request crosses a zone boundary with two-thirds probability.
  • Topology aware routing without effect. Symptom: the annotation is set, the traffic unchanged. Cause: one zone has too few endpoints and the controller distributes no hints; distribution falls back to the default.
  • NAT gateway as the largest item. Symptom: the NAT gateway costs more than the load balancers. Cause: image pulls, storage access and telemetry run through the gateway instead of private endpoints.
  • Public IP per Fargate pod or per Service. Symptom: the public address line grows with the number of services. Cause: every frontend IP and every public address is billed per hour, traffic or not.

Example

List prices read on 2026-10-21 from the AWS price lists for Frankfurt (eu-central-1): Network Load Balancer USD 0.027 per hour plus USD 0.006 per capacity unit and hour, Application Load Balancer USD 0.027 per hour plus USD 0.008 per capacity unit and hour, NAT gateway USD 0.052 per hour plus USD 0.052 per gigabyte processed, data transfer between Availability Zones USD 0.01 per gigabyte in each direction.

Twelve Services of type LoadBalancer cost in hours alone 12 × 0.027 × 730 = USD 236.52 a month, plus each one's capacity units; one ALB as ingress for the same twelve services costs 0.027 × 730 = USD 19.71 plus its capacity units. A NAT gateway with 1,000 gigabytes a month costs 0.052 × 730 + 1,000 × 0.052 = 37.96 + 52.00 = USD 89.96. If a cluster's pods send 500 gigabytes per direction across zone boundaries, that costs 1,000 × 0.01 = USD 10.00 a month; with topology aware routing and three replicas per zone, most of it stays in the zone.

Sources

Read on 2026-10-21. Kubernetes Service, topology aware routing and Gateway API, AWS Load Balancer Controller, AWS Price List bulk API, offers AWSELB, AmazonEC2 and AWSDataTransfer, eu-central-1, Microsoft public Standard Load Balancer in AKS, Google Cloud LoadBalancer Services in GKE and Cloud NAT.