Blog

Architecture19 August 20266 min read

BYOC is not self-hosting

Self-hosting means you take the software and you also take everything around it: the upgrades, the certificates, the backups, the 3am page when a node fills its disk. What you get in exchange is control, and what you pay is a permanent operational tax that scales with how seriously you take the thing.

Bring-your-own-cloud splits that bargain. The resources live in your account, in your VPC, on your bill — so the data residency question, the committed-spend question and the exit question all have the same answer they had before you adopted anything. But the operating is still ours: the control plane provisions, upgrades, patches and watches, the same way a managed platform would.

The distinction matters most at the exit. A self-hosted platform you leave by rebuilding somewhere else. A BYOC platform you leave by revoking a role: the cluster keeps serving traffic, because it was always your cluster. That is the whole difference, and it is worth being precise about which one is on offer.

Next

What a scoped role actually scopes

Every BYOC vendor says "least privilege". Here is the specific IAM shape Kapten asks for, why each permission is in it, and what it cannot reach.