SaaS, Self-Hosted or Air-Gapped: Choosing a Deployment Model for Kubernetes Optimization

Key Takeaways

• SaaS delivers the most automation and continuous feature updates. Telemetry leaves your network boundary.
• Self-hosted keeps data inside your VPC or data center. It adds operational burden and typically still requires some outbound connectivity for license checks or update metadata.
• Air-gapped means zero external connectivity. You lose cross-cluster intelligence, automated updates, and some feature depth.
• Regulatory frameworks, specifically FedRAMP, GDPR Article 44, ITAR, and DoD IL5/IL6, often determine which model is permissible, not merely preferred.
• Vendor air-gapped feature parity claims lack independent verification. Confirm specifics before committing.
• Start with your compliance constraints, then evaluate capability gaps, then calculate total cost of ownership including your own operational overhead.

Kubernetes clusters waste resources at scale. According to the Cast AI 2026 State of Kubernetes Optimization Report, average CPU utilization across production clusters sits at just 8% (Cast AI fleet data, April 2026). That waste exists regardless of how your optimization platform is deployed. The deployment model determines who has visibility into your cluster, not whether the problem is worth solving.

This guide covers the three deployment models available for Kubernetes cost optimization platforms: SaaS, self-hosted, and air-gapped. For each model, we examine what data leaves your environment, what capability you retain, and which regulatory requirements push you toward a specific option.

The Three Models Defined

SaaS

In the SaaS model, the vendor runs the control plane in their cloud. A lightweight agent deploys into your cluster, typically via Helm. The agent collects telemetry and sends it to the vendor’s control plane for processing. In return, you receive recommendations or autonomous actions. The vendor handles upgrades, scaling, and infrastructure. Cross-customer intelligence (meaning the vendor’s ML models improve from seeing anonymized utilization patterns across many clusters, not just yours) is possible because the vendor sees patterns across their entire customer fleet simultaneously.

The trade is direct: data leaves your network. Specifically, node metadata, workload names, resource requests and limits, and cluster state information travel outbound. For most commercial environments, this is acceptable. For regulated environments, it requires careful scrutiny.

Self-Hosted

Self-hosted means the vendor’s control plane runs inside your own VPC, cloud account, or data center. Your data stays within your network boundary. Most self-hosted platforms still require some outbound connectivity, typically for license validation, update checks, or telemetry aggregation at a reduced scope. Request the vendor’s complete outbound network requirements (specific endpoints, ports, and protocols) before architecture review. That detail matters when you are writing a CISO approval request or configuring egress firewall rules.

Self-hosting trades vendor-managed infrastructure for operational ownership. You manage upgrades, certificate rotation, high availability, and scaling. Cast AI Anywhere upgrades via Helm chart version pin; the recommended practice is to pin to a specific chart version and test in a non-production cluster before rolling to production. The benefit is data residency: your cluster metadata never leaves your environment. For regulated industries, this is frequently the minimum acceptable architecture.

Air-Gapped

Air-gapped takes isolation to the logical extreme: the platform operates with zero external network connectivity. No data leaves your environment under any circumstances. Updates arrive via manual transfer, typically a secure USB, air-gapped file transfer, or internal artifact repository.

Air-gapped deployment applies to the most restricted environments: DoD Impact Level 5 and 6 networks, ITAR-controlled systems, classified government infrastructure, and certain financial-sector environments with zero-egress network policies. The operational cost is substantial: manual update management, no cross-cluster intelligence from other customers, and typically reduced feature sets.

What Data Leaves Your Environment in Each Model

SaaS Data Egress

Under a SaaS deployment, the following categories of data typically travel to the vendor’s control plane:

• Node metadata: instance type, CPU/memory capacity, availability zone, OS version, labels
• Workload names and identifiers (most vendors describe this as the most sensitive operational data they collect)
• Resource requests and limits per container
• Cluster state snapshots: node status, pod scheduling events
• Cost signals: instance pricing data, usage attribution

SaaS vendors vary in what they exclude. Cast AI’s agent does not collect Kubernetes Secrets, ConfigMaps, sensitive environment variables, PII, PCI card data, or HIPAA-regulated health data. Cast AI does not use customer data to train models shared across customers. Workload names and cluster topology do leave your network boundary and are retained for varying periods.

For Cast AI SaaS specifically: the in-cluster agent communicates via HTTPS/443 to two endpoints, console.cast.ai and api.cast.ai. At idle, the agent pod requests approximately 50m CPU and 128Mi memory. Those specifics let you write an egress NetworkPolicy and scope a CISO approval request accurately, rather than estimating from data category descriptions alone.

Self-Hosted Data Egress

In self-hosted mode, all operational data stays inside your environment. The control plane processes cluster telemetry locally. Outbound traffic, if present, is limited to license validation pings, update manifest checks (version numbers only), and optional aggregated anonymized telemetry if opted in.

Cast AI Anywhere in self-hosted mode still requires outbound connectivity for license validation and update checks. Request the specific endpoints and ports from Cast AI before finalizing egress firewall rules. For other vendors, confirm what their self-hosted product requires. Some require persistent outbound connections; others allow fully offline operation after initial activation.

Air-Gapped Data Egress

Zero. By definition, air-gapped environments permit no outbound network connections from the optimization platform. All data collection, processing, and storage occurs within the isolated environment.

Comparison: SaaS vs Self-Hosted vs Air-Gapped

When SaaS Is the Right Choice

Most Kubernetes environments are suitable for SaaS optimization tools. SaaS works well when:

• No regulatory framework prohibits outbound data egress from the cluster
• The vendor holds relevant certifications (ISO 27001, SOC 2 Type II) and offers a data processing agreement
• EU data residency is required but not data localization: vendors offering EU regions (for example, Frankfurt) can satisfy GDPR for operational metadata
• You want autonomous optimization with minimal operational overhead
• Cross-customer intelligence improves recommendation quality for your workload mix

For most commercial technology companies, SaaS is the fastest path to optimization results. SaaS platforms receive feature updates continuously, meaning you always run the latest optimization logic without managing deployments.

FedRAMP-Authorized SaaS tools satisfy the FedRAMP compliance path for federal agencies and contractors without requiring self-hosting. Cast AI is not yet FedRAMP-Authorized, so federal environments with a FedRAMP mandate must use a FedRAMP-Authorized alternative rather than Cast AI SaaS.

When Self-Hosted Is Required

Self-hosted becomes necessary when regulatory or organizational policy prohibits sending cluster telemetry to a third-party cloud. Consider self-hosted when:

• Your cluster runs workloads in PCI-DSS cardholder data environments (CDE), where strict egress controls are required by scope
• You operate under HIPAA and prefer to avoid a Business Associate Agreement with your optimization vendor
• Your organization requires all third-party tooling to run inside your own cloud account (BYOC policies)
• Data sovereignty requirements in your jurisdiction restrict operational data from leaving the country
• EU DORA (Digital Operational Resilience Act) or similar frameworks require you to demonstrate control over third-party ICT risk
• FedRAMP-required environments where no FedRAMP-Authorized SaaS option exists need a self-hosted or on-premises deployment

On DORA specifically: SaaS vendors with appropriate contractual resilience clauses, audit rights, and exit strategies can satisfy DORA for optimization tooling. Self-hosted is one path to compliance, not the only one.

For organizations requiring data residency within their own infrastructure, Cast AI Anywhere is Cast AI’s self-hosted option. It installs via Helm into customer-owned infrastructure, whether cloud or on-premises, and does not require Cast AI cloud node provisioning. The agent requires a ClusterRole with read access to nodes, pods, events, and replicationcontrollers. Request the vendor’s full ClusterRole manifest before submitting for security review so your team can audit permissions before deployment.

Self-hosted tools for Kubernetes cost optimization include ScaleOps and Kubecost (IBM) with its open-source upstream OpenCost (CNCF). Kubecost installs via Helm with no data egress in self-hosted mode. OpenCost runs entirely inside your cluster with no vendor dependency. For the Kubernetes on-premises challenge more broadly, see our guide to running Kubernetes on-premises.

When Air-Gapped Is the Only Option

Air-gapped deployment is typically mandatory, not optional. It applies when:

• You operate under DoD IL5 or IL6 (classified networks with CMMC Level 3+ requirements where CUI cannot transit commercial networks)
• Your environment is subject to ITAR or EAR: defense contractors with controlled technical data cannot allow vendor engineers potential access to optimization telemetry
• Your network policy enforces zero external egress as an architectural control, not just a preference
• You operate in a classified government network with no approved external connectivity

In these environments, optimization tools must be fully self-sufficient. Updates arrive via air-gap transfer (CD/USB/internal artifact server), and all ML model updates are bundled with software releases. These deployments typically lag SaaS equivalents by one or more release cycles on feature availability.

No major Kubernetes optimization vendor has independently verified a fully air-gapped deployment with complete feature parity. ScaleOps claims full parity in self-hosted mode; confirm specifics with the vendor before committing. Open-source tools such as OpenCost (CNCF) and Goldilocks (Fairwinds) can operate in air-gapped environments because they have no vendor dependency by design, but they provide cost visibility and recommendations only, without autonomous enforcement.

What You Give Up Going Inward

Each step toward greater isolation carries a cost.

Moving from SaaS to self-hosted, you lose:

• Vendor-managed infrastructure, upgrades, and certificates
• Cross-customer intelligence (recommendations informed by anonymized patterns across many clusters)
• Instant feature access (self-hosted releases lag SaaS releases by weeks to months)
• Automatic scale management of the optimization control plane itself

Moving from self-hosted to air-gapped, you additionally lose:

• Any ML model updates that require internet connectivity to fetch
• Vendor support tooling that requires telemetry visibility
• License simplicity (air-gapped licensing typically requires explicit offline activation keys)
• Access to real-time cloud pricing APIs (must be bundled or manually updated)

The operational overhead is real. Self-hosting or air-gapping should be driven by a documented compliance requirement, not by a general preference for data control. If your compliance posture permits SaaS with appropriate vendor certifications and data processing agreements, that is almost always the lower-TCO path.

Questions to Ask a Vendor

Before selecting a deployment model, ask these questions:

1. What specific data does your agent send outbound? Request a full data dictionary, not a summary.
2. Is your self-hosted product a true self-contained control plane, or does it require persistent connectivity to your SaaS infrastructure?
3. What is the release cadence delta between SaaS and self-hosted? How many release cycles do self-hosted customers lag?
4. What outbound network connections does your self-hosted product require? Can it operate with a firewall allowlist?

For Cast AI SaaS: agent egress targets are console.cast.ai and api.cast.ai on HTTPS/443. A sample Kubernetes NetworkPolicy egress selector can restrict the agent to these endpoints by domain.

5. Do you offer an air-gapped deployment mode? If so, which features are unavailable?
6. What are your data retention policies? How long is cluster metadata stored, and who can access it?
7. Do you offer contract guarantees about data use (no cross-customer training, no data brokering)?

Review vendor lock-in implications before committing to any optimization platform. For more on that dimension, see our analysis of Kubernetes optimization vendor lock-in.

Conclusion

The deployment model question is a qualification question. It comes before the feature comparison. Before you evaluate which tool optimizes your cluster best, determine which deployment model your compliance posture permits.

SaaS is the right default for most commercial environments. Cast AI operates SaaS-first but addresses regulated-environment requirements directly: Cast AI Anywhere supports on-premises and hybrid deployments without requiring cloud node provisioning; the Frankfurt region (GCP europe-west3) provides EU data residency for GDPR purposes within the SaaS model; and Cast AI holds ISO 27001 and SOC 2 Type II certifications. For environments where Cast AI’s SaaS model still does not meet requirements, ScaleOps and Kubecost offer self-hosted alternatives. Air-gapped optimization remains a largely unsolved problem for platforms that require cross-cluster intelligence.

Start with your constraints. Then select the highest-capability tool that fits within them. For a full view of optimization approaches and Cast AI’s place in the landscape, see our complete guide to Kubernetes cost optimization. When you are ready to explore Cast AI’s deployment options and pricing, visit our pricing page.

Frequently Asked Questions