Autoscaling being "on" usually isn't the problem — the problem is what it is *allowed to scale to*. Three things to check, in order of how often they're the culprit: **1. Node group instance sizing** If your node group is `m5.4xlarge` and your pods request 500m CPU, you are paying for a lot of empty node. ```bash kubectl get nodes -o custom-columns=\ NAME:.metadata.name,\ CPU:.status.allocatable.cpu,\ MEM:.status.allocatable.memory ``` **2. Requests vs. actual usage** ```bash kubectl top pods --all-namespaces --sort-by=cpu ``` Compare that against `resources.requests`. A 4x gap is common and i

`terraform plan -detailed-exitcode` is the piece you're missing: - `0` — no changes - `1` — error - `2` — changes present ```bash terraform plan -detailed-exitcode -out=tfplan ``` Exit 2 in a scheduled run means drift, because nothing in the repo changed. The subtlety is that you'll get false positives from anything mutated outside Terraform by design — autoscaling group sizes, tags applied by AWS Config, `aws:` prefixed tags. Parse the JSON plan and filter those out rather than failing the build on them.

Autoscaling being "on" usually isn't the problem — the problem is what it is *allowed to scale to*.