Overview
A small agent runs inside your cluster, reads namespace, pod and node metrics every few minutes, and reports them to CostOptix. CostOptix turns them into cost per workload and per team, and at month end reconciles the total to your real cloud invoice. Kubernetes cost accrues live from metrics, so there is no billing lag.Works on any cluster: managed (EKS, AKS, GKE, DigitalOcean, Linode) or self-hosted (k3s, bare metal, on-prem). The agent reads the standard Kubernetes API and
metrics.k8s.io.Workload attribution
Cost follows the owning Deployment, StatefulSet, DaemonSet or Job, not short-lived pod names.
Invoice reconciliation
Monthly bills match what you actually paid, after discounts and commitments.
What to fix first
Reliability risks and the biggest savings, ranked for you.
Dependency map
Which workloads call which, and what breaks if one goes down.
How it works
1
The agent collects metrics
A single-replica Deployment in the
cost-optix namespace reads namespace, pod and node metrics and pushes a compact batch to CostOptix over TLS.2
Pods are resolved to workloads
Each pod is mapped to its owner through OwnerReferences (pod → ReplicaSet → Deployment, or straight to a StatefulSet, DaemonSet or Job), so cost survives pod churn.
3
Cost is worked out from requests and usage
Resource-hours are priced at node rates. Every workload’s cost adds up exactly to the cluster total, with nothing dropped or counted twice. Capacity nobody requested is shown as idle.
4
Days and months are sealed
Each completed day is sealed into an append-only ledger. At month end the month closes into a bill. Sealed days and bills never change.
Requirements
Connect a cluster
Open Kubernetes and follow the guided steps. The key and command are filled in for you.1
Name the cluster and pick where it runs
Enter a cluster ID you will recognise, such as
prod-eu. Then pick where it runs: azure, aws, gcp, digitalocean, linode, k3s, bare-metal or on-prem. Cloud nodes are priced automatically from the provider’s rates.For self-hosted clusters, tell CostOptix what the hardware costs: either the total monthly cost and capacity, or your own per-vCPU-hour and per-GiB-hour rates. You can skip this and set it later. Until then the cluster uses a rough estimate.2
Create an agent key
Click Create agent key. The key can only push cluster metrics. Copy it now, it is shown only once. If you cannot create keys, ask an admin.
3
Run the installer
Point
kubectl at the cluster and run the generated command. The cluster appears as soon as the agent’s first report arrives.--with-connections. See Dependency map.
The installer creates the cost-optix namespace, a least-privilege ServiceAccount and ClusterRole, a Secret holding the key, a ConfigMap and a single-replica Deployment, then waits for the rollout.
Prefer to apply a manifest?
The onboarding also offers a manifest option for GitOps or review. Set these values in the agent manifest andkubectl apply it:
Check the install
/healthz (process is up) and /readyz (at least one collection succeeded and recent pushes work) on port 8090. A failing readiness probe without restarts usually means a wrong key.
The Kubernetes page
Days are counted in UTC, so a new day starts at midnight UTC.
What to fix first
The Waste & fixes tab ranks findings for you. Reliability risks come first, because an outage costs more than waste. Then come the changes that save the most money.- Over-provisioned means a workload asks for more CPU or memory than it uses. A safe saving.
- Under-provisioned means it uses more than it asked for. A reliability risk, not a saving.
- Idle is node capacity no workload has claimed. Fewer or smaller nodes is the usual fix.
Invoice reconciliation
Live Kubernetes cost is an estimate built from metrics and list rates. Your cloud invoice is what you actually paid. Link the two and every monthly bill is scaled to the invoice, so reservations, savings plans, spot and negotiated discounts are all reflected. On the Cluster tab, open the billing link settings and choose:- Cloud account: the connected account that pays for the cluster’s nodes.
- How to find the nodes on the invoice:
At month close every attributed line is scaled by:
Nodes that also run the host agent
If some nodes also run the host agent, each linked machine’s Kubernetes share becomes its cost here, and the cluster page shows how many nodes are covered.Teams and chargeback
Teams claim namespaces or individual workloads on the Ownership page. Each workload can belong to only one team, so totals never double count.- Direct cost is the sum of a team’s claimed workloads.
- Idle cost is split across teams in proportion to their direct cost.
- Unclaimed workloads are shown as unclaimed, never dropped.
Dependency map
Connection mapping is optional. It adds one small pod per node (a DaemonSet) that reads the node’s connection table, so it runs as root on the node’s network. It records which workloads were connected, never what the connections carry. Turn it on during install with--with-connections, or later from Agent health on the Cluster tab. The Dependencies tab then shows which workloads call which and what each one brings down with it.
Clusters that enforce Pod Security admission need the
cost-optix namespace labelled pod-security.kubernetes.io/enforce=privileged for the connection pods. The installer sets this when you use --with-connections.Agent health and upgrades
Agent health on the Cluster tab checks that the agent is reporting, whether a newer version is out, when the agent key expires, and whether connection mapping is reporting from every node. To upgrade, run this withkubectl pointed at the cluster. It reuses the key, cluster ID and settings already in the cluster, so the cluster keeps its history:
--upgrade to pin one, and --with-connections to turn on mapping at the same time. The agent runs as a single replica by design. A second replica would push duplicate metrics.