Kubernetes cost, closed loop
kcost joins your AWS bill with per-minute cluster usage — every dollar attributed to a team, workload, or network path — then proposes the safe fixes and executes the ones you approve.
Read-only by default — One agent per cluster — No sidecars
the problem
Every line on your cloud invoice is an abstraction of something running in Kubernetes. The distance between the two is where budgets get argued and savings get missed.
So teams stitch CUR exports and RI schedules, dashboards that disagree, Karpenter config, and ticket threads into a number that is an estimate. Then the fix — a rightsize, a spot adoption, a nodepool change — happens in another tool, by hand, without anyone checking the blast radius.
kcost closes the loop between the cost signal and the safe action.
the platform
Attribution, budgets, optimization, and the enterprise controls — four systems that used to be four tools, on one data model.
kcost joins actual AWS billing with per-minute node and pod metrics and eBPF network flows, so compute, memory, and data transfer land on the workloads that caused them. Allocation groups — match rules on namespaces and labels — roll cost up per team. When the bill corrects itself, the cost engine recomputes.
Per-cluster, namespace, and team budgets with a live status ladder. Three independent detectors catch what thresholds miss.
Rightsizing, Spot adoption, commitment coverage, and Karpenter nodepool changes — each with a dry-run diff before anything touches a cluster.
SAML and OIDC SSO, service accounts, personal access tokens shown once at creation, entitlements enforced at every write API — and an audit trail that records who approved what, when.
the action loop
Any dashboard can list ways to cut a bill. The hard part is acting on them without taking down what the bill pays for. kcost’s loop makes every step provable — and every write reversible.
An observed cost or usage event: an anomaly, an idle resource, a workload running on-demand where Spot fits.
A typed action with a dry-run diff and the evidence behind it. You see the exact patch before anyone else does.
A human signs off, or a policy you wrote does. Approval is one click or one line of config — never a ticket.
PDBs, quorum, nodepool dedup — the cluster-safety checks run before any write lands.
The result is checked against the prediction, and a signed webhook goes out with the outcome.
Available for every action, even after an account downgrade. Rolling back is never a feature you pay for.
7/7 gates pass live-e2e against a real cluster. After execution, verification results and the audit entry go out over a signed webhook.
how it works
Cost work runs on billing cycles, not sprints. The timeline is honest about that.
One agent per cluster. Read-only by default, no sidecars, no changes to your infrastructure. It is running in minutes.
Your bill is joined to per-minute usage and eBPF network flows, then rolled up per team with allocation groups.
Recommendations arrive with dry-run diffs. Approve them one at a time, or automate by policy — start on a non-prod cluster.
Safety gates before every write, verification after, alerts and the audit trail throughout. Rollback is one call away.
api-first
The console, your scripts, and your CI pipeline share one versioned REST API. If the UI can do it, you can script it — including approving recommendations and rolling back actions.
{
"provisioned": 48200.00,
"allocated": 36912.50,
"idle": 6124.75,
"spot_share": 0.31,
"monthly_run_rate_estimate": 144600.00,
"currency": "USD",
"as_of": "2026-09-17T00:00:00Z",
"calculation_version": "2026.09"
}clouds
v1 is AWS, done properly: billing, per-minute usage, and network flows on one model. The other clouds are on the roadmap, not in beta.
Turning a cloud on means its billing and attribution are correct, not just present. That’s why the rest are on the roadmap, not in beta.
pricing
The plans differ by what the platform is allowed to write — not by what it can see. Every plan starts with visibility.
See every dollar, attributed.
See it, then fix it safely.
Scale it across the company.
One agent per cluster. Read-only by default. 14 days free — no card, no sales call required to see your costs.