Cutting the Cloud Bill 58% Without Cutting Reliability
Right-sizing and consolidating GCP workloads — moving low-traffic services off managed Kubernetes onto VMs behind Caddy/Traefik and Cloudflare — for a 58% infrastructure cost reduction.
Problem
A set of internal and low-traffic services ran on managed Kubernetes (GKE). The cluster gave us rolling deploys and self-healing, but the traffic profile never justified the bill: a control-plane fee, always-on nodes, load balancers, and egress added up to a recurring cost that was mostly idle capacity.
Baseline GCP infrastructure cost was about $750/month, and a large share of it was paying for headroom we never used.
Constraint
- The services are not latency-critical and have predictable, low concurrency.
- A small team — no appetite to operate a full cluster for this tier of workload.
- TLS had to stay enforced end to end; no secrets or internal hostnames could leak.
- Migration had to be reversible with minimal downtime.
Architecture
I consolidated low-traffic workloads onto right-sized VMs and kept GKE only where elasticity earned its keep. A reverse proxy (Caddy, with Traefik evaluated as the alternative) terminates TLS using a Cloudflare Origin Certificate, so traffic stays encrypted end to end while Cloudflare fronts the public edge.
Decision / Trade-off
| Aspect | GKE (before) | VM consolidation (after) | | --- | --- | --- | | Cost | High fixed baseline | Much lower, pay for what's used | | Elasticity | Autoscaling | Manual vertical resize | | HA / self-healing | Built-in | Process manager + restart policy | | Operational surface | Cluster + nodes | A host to patch |
The explicit trade-off: I gave up horizontal autoscaling and node-level HA for these services in exchange for a much smaller bill and a smaller operational surface. For this traffic profile that's the right call — the services tolerate brief restarts, and Cloudflare absorbs spikes and caching at the edge. Anything that outgrows a VM can move back to GKE independently.
Result
- Infrastructure cost reduced ~58% — $750 → $315/month.
- Operational surface shrank from a multi-node cluster to a small set of patchable hosts.
- TLS stayed enforced end to end via Cloudflare Origin Certificates.
- Rollback path back to GKE was preserved throughout.
What I'd watch next: a health-check + auto-restart alert per service, and a documented vertical-scaling runbook so resizing a VM stays a known, low-risk operation.