aether
Managed Kubernetes · EU sovereign

The best infrastructure is the one you can't see.

Aether runs your Kubernetes control plane as hidden, hardened pods and your nodes on immutable Talos Linux. A production cluster — with registry, sign-on, DNS, TLS and observability already wired in — is typically live in about three minutes.

Launch your first cluster Read the docs
  • €0 control plane
  • 0 SSH ports on any node
  • ~50% below hyperscaler pricing
cluster provision — replay eu-fi

$ aether cluster create prod --region eu-fi --pool workers:3

  1. 0:00 request accepted — quota ok, spec written
  2. 0:02 VLAN 112 + subnet 10.64.12.0/24 allocated
  3. 0:04 tenant datastore ready — isolated + replicated
  4. 0:09 PKI issued — 7/7 certificates signed
  5. 0:14 kube-apiserver · controller-manager · scheduler starting
  6. 0:31 control plane Ready — runs as pods, no VM to attack
  7. 0:52 dedicated load-balancer proxy online, DNS record published
  8. 1:05 Talos workers booting — immutable, no SSH, no shell
  9. 2:47 3/3 nodes Ready — kubeconfig available
Why Aether

Security you don't configure. Costs you don't audit.

Most managed Kubernetes hands you a bare cluster and a list of extras. Aether ships the whole platform — and removes the attack surface instead of asking you to police it.

Hidden control plane

Your kube-apiserver, controller-manager and scheduler run as hardened pods inside our management cluster. There is no control-plane VM to see, reach, or break — and it boots in seconds, not tens of minutes.

Immutable Talos nodes

Every worker runs Talos Linux: no SSH, no shell, no package manager, read-only root filesystem. The class of attack that starts with a stolen node key simply has nowhere to land.

A dedicated load balancer per Service

Each Service of type LoadBalancer gets its own load-balancer VM with its own IP — no shared proxy fleet, no noisy neighbours on your ingress path.

Data sovereignty by architecture

Each region is a complete, independent copy of the platform. Workloads, backups, images, metrics and billing records stay in the region you select — by design, not by policy. Regions are planned across the EU, US, Africa and Asia.

A free control plane — with everything on it

The control plane costs €0, and it ships with OIDC sign-on, a container registry with vulnerability scanning, DNS, TLS, datastore backups, autoscaling and a full observability stack. You pay only for worker resources.

Self-service, API-first

Every operation is available from the web portal and a Terraform-compatible REST API — create clusters, scale node pools, download kubeconfigs, invite your team, read your bill.

All-inclusive

The control plane is free. So is everything around it.

Hyperscalers charge ~$70/month per control plane before you run a single pod. On Aether it's €0 — including the services other providers sell as add-ons or leave you to run yourself. Setting up a registry, SSO and monitoring is usually a months-long project; here it's already done when the kubeconfig arrives.

See full pricing
  • Aether Identity — single sign-on with MFA
  • Aether Container Registry with image scanning
  • DNS records + automatic TLS certificates
  • Aether Observability — dashboards, metrics, logs, traces
  • Cluster autoscaler + node health checks
  • Control-plane datastore backups
  • VolumeSnapshots + metrics-server
  • Pre-built dashboards and alert rules
Compared

Hyperscaler features. Not hyperscaler bills.

A medium production profile — 12 vCPU, 48 GB RAM, 300 GB storage, 3 load balancers — costs €324/month on Aether, everything included.

Monthly price comparison for a medium Kubernetes cluster profile
Provider HQ Base cluster At feature parity* vs Aether
AWS EKS US €577 €717 Aether 55% cheaper
Google GKE US €604 €744 Aether 56% cheaper
Azure AKS US €524 €664 Aether 51% cheaper
DigitalOcean DOKS US €330 €410 Aether 21% cheaper
Scaleway Kapsule EU €254 €334 Aether 3% cheaper — far more included
OVHcloud MKS EU €187 €267 Aether 21% more — far more included
Aether EU €324 €324 Everything included — €0 control plane

* "Feature parity" adds the estimated cost of self-hosting a container registry, OIDC provider and observability stack on each platform. Estimates as of May 2026; competitor prices change — check current rates before deciding on price alone.

Security by architecture

Seven isolation layers. Zero security YAML to write.

Every cluster is born inside a stack of isolation layers that are configured by the platform, not by you — from host firewalls and per-cluster VLANs down to an OS with no shell to log in to.

Explore the security model
  1. Hypervisor + SDN firewall
  2. Isolated per-cluster VLAN
  3. Cilium network policy (eBPF)
  4. Talos immutable node OS
  5. Hidden control plane + per-tenant datastore
  6. Aether Identity access (OIDC)
  7. Dedicated load balancer
Open standards

Standard Kubernetes. Leave whenever you like.

Aether is assembled from boring, proven open-source infrastructure — Talos Linux on the nodes, Cilium in the network, Ceph under your volumes — and you interact with it purely through the standards: plain kubectl, the standard Kubernetes API, OCI container images and OIDC sign-on. Your manifests, images and pipelines work anywhere. No proprietary controllers in your cluster, no black box you can't walk away from.

  • Standard Kubernetes API
  • Plain kubectl
  • Talos Linux
  • Cilium
  • Ceph storage
  • OCI container images
  • OIDC sign-on

Your first cluster is about three minutes away.

Sign up, name a cluster, pick a node size — Aether does the rest.

Get started Estimate your bill