Release Notes

What's Changed

Cost Model

• Fixed an aggregator panic on invalid KubeModel data.
• Removed a false account-label ingestion error logged for AWS Athena integrations.
• Updated Go to 1.27.2 and Go dependencies to fix govulncheck findings.

Frontend

• Unreconciled cost highlighting can now be configured per environment.

Helm Chart

• clusterController.serviceAccount.name now sets the cluster controller's service account (#4842)
• network-costs no longer runs privileged; it needs only NET_ADMIN, including on OpenShift (#4825, #4871)
• Bump network-costs image version v0.19.2 -> v0.19.4 for CVE fixes (#4863, #4877)
• Bump finops-agent version v1.0.26 -> v1.0.28 (#4887)
• Bump modeling image version v0.2.2 -> v0.2.3 (#4884)

Upgrade notes

• networkCosts.additionalSecurityContext is replaced by networkCosts.securityContext, which overrides the defaults rather than merging. Keep runAsUser: 0 and NET_ADMIN (#4825)

Image List

A list of all images which the Helm chart installs by default:

• icr.io/kubecost/frontend:3.3.1
• icr.io/kubecost/cost-model:3.3.1
• icr.io/ibm-finops/agent:v1.0.28
• icr.io/kubecost/network-costs:v0.19.4
• icr.io/kubecost/modeling:v0.2.3
• icr.io/kubecost/cluster-controller:v0.16.40
• icr.io/kubecost/mcp-kubecost:v0.17.1
• docker.io/alpine/curl:latest

Helm chart CVE comparison

Trivy scan of every image rendered by the chart, comparing kubecost/kubecost@3.3.0 with kubecost/kubecost@3.3.1. The severity counts below are total findings across all images, so a CVE affecting three images counts three times; the tables that follow list each CVE ID once.

Counts by severity

Unchanged CVEs

High (13)

Medium (25)

Low (4)

Added CVEs

No new vulnerabilities found.

Removed CVEs

High (16)

Medium (23)

Low (8)

Known Issues

• Cloud costs can become duplicated due to changes in the export mid month. Primarily seen with Azure Cost Exports. Current workaround: If federated store is enabled, delete the PVC and fully reingest data from the federated store.

IBM Kubecost v3.3.0 Release Notes

Highlights

• Kubecost MCP Server, available in beta. A Model Context Protocol server exposes Kubecost's cost and usage history to your AI agents. Connect an MCP client, choose your LLM, and query your spend in natural language. Read-only in this release; write actions follow. The server is enabled by default on aggregator installs — see Upgrade notes.
• Namespace Turndown returns, rebuilt. Turndown actions are created and edited in the UI with a weekly time-grid scheduler and Daily, Weekdays, Weekly, and Custom cadences. They support maintenance (run_only) and exclusion (run_except) windows, a Dry Run switch, namespaceLabel filters, and a live preview of matching namespaces and their cost. Runs appear in the Actions audit log and Action Run Inspect, and realized savings are reported for non-dry-run executions. A filter is now required — see Upgrade notes.
• AWS NAT Gateway network costs. Network Costs now reads NAT Gateway flow logs and reports NAT, cross-region, and cross-zone traffic as separate categories, giving a near-complete view of networking spend. A traffic deferral queue holds conntrack samples until the matching flow log arrives, so a connection lands on one metric series instead of being split. See the documentation for more details and the setup process.
• Refreshed Monitor pages. Overview, Allocations, Assets, Cloud Costs, Efficiency, and Clusters now render on the view layer shared with Cloudability Advanced Containers: new chart visuals, a new report creation and viewing experience, per-page loading and error states, and shared-resource cost configuration shown with its defaults and editable from one menu.

Features and improvements

Cost data and APIs

• AWS CUR 2.0 support, in addition to the legacy CUR format.
• Efficiency dashboard computed server-side. Idle by Type, Resource Idle by Workload, and Resource Idle by Cluster are driven by new GET /model/efficiency and GET /model/efficiency/timeseries endpoints with server-side sorting and pagination, so the page scales to large environments instead of computing in the browser. Efficiency continues to use CPU, RAM, and GPU cost.
• Aggregate and filter allocations by Kubernetes annotation, mirroring the existing label: pattern across multi-aggregation, drill-down, Inspect, saved reports, and CSV export. The aggregation popover has a new Custom keys section; annotation autocomplete is pending backend support, so free-form entry works in the meantime.
• Allocation autocomplete resolves label aliases (Department, Environment, Owner, Product, Team) to the underlying label key.
• Cloud cost budgets by cost metric. Budgets can be created and edited against Amortized Net Cost, List Cost, Net Cost, Invoiced Cost, or Amortized Cost, and the metric is shown in the budget detail drawer. Existing budgets default to Amortized Net Cost.
• Carbon cost on Allocation Details, with individual chart time series that can be toggled.
• Extra node labels from a ConfigMap. Supply additional node labels to the FinOps Agent via finopsagent.external.nodeLabels and Kubecost joins them to the node's own labels.

Performance

• Aggregator ingestion. 10-minute resolution ingestion is off by default, ingestion concurrency scales automatically to 2× available CPU cores instead of running single-threaded, agent data is ingested as a stream to lower memory use, and a configurable termination grace period (default 180 s) lets in-flight ingestion and derivation finish before the pod stops. Large deployments should see meaningfully lower ClickHouse memory pressure and aggregator CPU. Defaults changed — see Upgrade notes.
• Container Request Right-Sizing exports run one ClickHouse query instead of three, covering CSV/PDF exports, scheduled CRRS reports, and the hourly action generator, which resolves 504 timeouts on large windows.
• PDF reports render about twice as fast on a maintained PDF library.
• Fewer redundant requests on Assets and Allocations page loads: the dashboard picker no longer prefetches the saved report list before it is opened.

User interface

• Rows-per-page control on the Assets and Allocations tables and the Overview breakdown tables.
• Unified export downloads. Cloud Costs, Collections, Allocations, and CRRS CSV/PDF exports show a progress card that can be cancelled and report failure clearly, instead of hanging silently or opening a blank tab.
• Forecast model retraining notice. While the forecasting model retrains, the cost forecast chart shows a "Model is retraining" notice and polls with backoff instead of showing an error. Genuine errors still surface immediately. The chart also honors the selected cost metric rather than always showing cumulative cost.
• Diagnostics dashboard. A new /diagnostics/dashboard page shows cloud integrations and cluster diagnostics in one place.
• Perpetual licenses are recognized and exempt from expiration enforcement; Settings > License Info shows "Perpetual" in place of an end date.
• Trial limits warning. A Settings page banner warns when free-tier limits are exceeded during a trial.
• GCP integration form. The private key field is a JSON editor with the expected shape as a placeholder, project, dataset, and table IDs are entered as the single <project>.<dataset>.<table> string the GCP console provides, and saving stays disabled until validation passes, so editing an integration without changes no longer clears the stored key. Integration search and adding integrations are restored.
• Action runs can be marked skipped, so stale actions can be dismissed rather than left pending.
• MCP visibility. Kubecost MCP appears in the Settings page product features list, and bug reports include MCP pod logs.
• Cloudability link in the navigation in environments that expose a Cloudability URL.
• Documentation links point to v3 docs. In-product links throughout the UI reference the current v3.x documentation instead of legacy v2.x pages.
• Consistent toast notifications from a single component, with auto-dismiss and a hover-to-pause timer, plus a dismissible feedback request banner on Overview and a tooltip showing the raw date behind Clusters "Last Seen".

Helm chart and operations

• Cluster controller custom service account names. clusterController.serviceAccount.name controls which service account the cluster controller binds to. Cloud-provider authentication annotations (AWS IRSA, GCP and Azure Workload Identity) are documented inline in values.yaml.
• Network Costs configuration. storageConfig and natGatewayConfig are stored in a Kubernetes Secret rather than a ConfigMap, so storage credentials such as AWS keys are no longer held in plain ConfigMap data. Network Costs falls back to global.federatedStorage when storageConfig is unset, routeRefreshInterval (default 600s) and conntrackRefreshInterval (default 5s) are configurable, the DaemonSet cluster role uses discovery.k8s.io/v1 EndpointSlices in place of deprecated v1/Endpoints, and a helper script is included for enabling NAT Gateway flow logs on AWS.
• Aggregator PVC retention policy. persistentVolumeClaimRetentionPolicy can be set on the aggregator StatefulSet to control PVC handling when the aggregator is deleted or scaled down.
• Gateway API HTTPRoute defaults rendered explicitly. HTTPRoutes include explicit group, kind, and weight on Service backend references, eliminating desired/live drift for Argo CD server-side apply.
• Telemetry auto-consent via Helm. A new value bypasses the telemetry consent prompt for automated deployments.
• OpenShift SCC templates carry Helm labels, so they are tracked and removed on uninstall.
• Install no longer fails when the v2.x-to-v3 upgrade acknowledgment is unset.
• values.yaml image examples use icr.io paths, since GCR is deprecated.

Upgrade notes

Review these before upgrading; several change existing behavior.

1. MCP server is enabled by default. The mcp-kubecost subchart follows aggregator.enabled unless mcp.enabled is set explicitly; set mcp.enabled=false to opt out. It is exposed through the frontend at /mcp, with OAuth endpoints under /oauth/mcp. Pre-GA OIDC values must be migrated: mcp.config.oidc.clientId becomes clientID, and baseUrl/redirectPath are replaced by mcp.config.externalUrl (bare HTTPS origin) with /oauth/mcp/callback registered at your identity provider. Set stable mcp.config.oidc.jwtSigningKey and storageEncryptionKey values in production; ephemeral keys break client sessions on restart.
2. 10-minute retention is disabled by default. aggregator.retention10m now defaults to 0. If you use the last-48-hours view for request right-sizing, set it back after upgrading.
3. Ingestion concurrency default changed. aggregator.dbConcurrentIngestionCount now defaults to auto (2× CPU cores); set an explicit integer to keep single-threaded ingestion.
4. Namespace turndown requires a filter. Filterless submissions via Helm or API return an error. Add a filter before upgrading if your automation omits one.
5. Cost corrections are forward-only. The billing source-file stamping, descriptor-drift, and unresolved-provider-ID fixes apply to data ingested after upgrade. To correct history: force a re-ingest (POST /debug/ingestionRecords, passing maxRetries if records exceed the default cap of 5), mark the affected windows (POST /debug/derivationRecords), then re-derive (GET /aggregator/derive?commit=true starts it without waiting for the next cycle). cloud_cost_1d_raw has a 91-day TTL, so re-deriving wi...

Release Notes

What's Changed

Cost Model

• Fixed a bug where cloud costs could be counted two or more times for a resource, inflating node, cluster, and AET costs, when the upstream billing feed republished a day with changed descriptive fields such as an account name or a resource tag.

Helm Chart

• Added support for discovery.k8s.io/v1/EndpointSlice over v1/Endpoint when Kubernetes version is >= 1.21. Fixes an issue where network-costs were unable to operate correctly in Kubecost 3.2.2 and 3.2.3 because the ClusterRoleBinding was not configured to work with EndpointSlices
• Bump cluster-controller image version v0.16.38 -> v0.16.39

Image List

A list of all images which the Helm chart installs by default:

• icr.io/kubecost/frontend:3.2.4
• icr.io/kubecost/cost-model:3.2.4
• icr.io/ibm-finops/agent:v1.0.25
• icr.io/kubecost/network-costs:v0.19.1
• icr.io/kubecost/modeling:v0.2.0
• icr.io/kubecost/cluster-controller:v0.16.39

Known Issues

• Cloud costs can become duplicated due to changes in the export mid month. Primarily seen with Azure Cost Exports. Current workaround: If federated store is enabled, delete the PVC and fully reingest data from the federated store.

Release Notes

What's Changed

Cherry-picked a change that was missed in the 3.2.2 release. Without this change, the helm chart values .Values.frontend.bufferConfig and .Values.frontend.extraServerConfig are not deduplicated, meaning that if these configuration blocks apply any overlapping directives, the frontend pod will fail to start. For example:

frontend:
  bufferConfig:
    proxy_busy_buffers_size: "512k"
  extraServerConfig:
    proxy_busy_buffers_size: "1024k"

Will cause nginx to crash. After the changes applied to 3.2.3, the keys are deduped and priority is given to values in extraServerConfig.

Image List

• icr.io/kubecost/frontend:3.2.3
• icr.io/kubecost/cost-model:3.2.3
• icr.io/ibm-finops/agent:v1.0.25
• icr.io/kubecost/network-costs:v0.19.1
• icr.io/kubecost/modeling:v0.2.0
• icr.io/kubecost/cluster-controller:v0.16.38
• docker.io/alpine/curl:8.17.0

Known Issues

• Cloud costs can become duplicated due to changes in the export mid month. Primarily seen with Azure Cost Exports. Current workaround: If federated store is enabled, delete the PVC and fully reingest data from the federated store.

Release Notes

Frontend

• Improved the speed at which totals rows load for very large numbers of items
• Added a missing parameter (includeCount) to cloud cost API calls
• Fix issues in rendering hardware capacity in the Capacity Planning graph

Aggregator

• Added missing database connection closures, which may fix an issue with APIs not returning due to connection starvation
• Fixed an issue where the Assets API would fail to return data if the recorded active minutes of the asset were 0
• Fixed an issue where the API powering the Assets page graphs were missing item names when aggregated by label
• Added the first stage of support for the new Kubemodel pipeline (see the Opencost section for details on Kubemodel)
• Update "totals" endpoints to use a memory-cheap approximate count when there are more than 4,096 items (see second item in Frontend)
• Enhanced enterprise custom pricing so that the "version" field of a pricing spec is no longer case-sensitive
• Fix an issue where RBAC users that had both Admin and Editor roles applied would be treated as Editors
• Updated the /model/savings/requestSizingV2 API endpoint to correctly return a 400 Bad Request when given invalid parameters
  • Previously returned 500 Internal Server Error

Opencost

• Added first stage of support for the new Kubemodel pipeline: opencost/opencost#3875

Kubecost (Helm chart)

• Added new default nginx buffer sizes to allow larger request/response bodies: #4712
• Added common Kubecost labels to two templates so that Operators can manage manifests more effectively: #4729

Helm Chart Comparison Report

Before Chart: kubecost/kubecost@v3.2.1

After Chart: kubecost/kubecost@v3.2.2

CVE by Severity

Unchanged CVEs

High

Medium

Low

What's Changed

• Enhance v2.9 error messages by @thomasvn in #4561
• Default all Kubecost images to ICR by @thomasvn in #4613
• Bump in-code version for 2.9.7 by @cliffcolvin in #4721
• Bump images and chart version for 2.9.7 by @ErikTorres1998 in #4724

Full Changelog: v2.9.6...v2.9.7

What's Changed

• Default all Kubecost images to ICR (v2.8) by @thomasvn in #4615
• Bump in-code version for 2.8.7 by @cliffcolvin in #4716

Full Changelog: v2.8.6...v2.8.7

Security patch release

Removal of deprecated execution path

The legacyMode option for cluster-controller has been removed from the Helm chart, along with the execution mode that it enabled. This mode has been deprecated since the release of Kubecost 3.0.0, and depended on very old versions of libraries in which CVEs had begun to appear.

Dependency upgrades

Base images, system libraries, and code libraries received version bumps across the board to resolve vulnerabilities.

Other bug fixes

• Fixed an issue where updating the Budgets configmap would erroneously fail with a "duplicate name" error.
• Removed an overly-noisy ECP log
• Fixed an issue with ECP retroactive pricing in RBAC Teams

Image list

icr.io/ibm-finops/agent:v1.0.20
icr.io/kubecost/cluster-controller:v0.16.37
icr.io/kubecost/cost-model:3.2.1
icr.io/kubecost/frontend:3.2.1
icr.io/kubecost/modeling:v0.1.36
icr.io/kubecost/network-costs:v0.19.0

Major

• (Enterprise) Resource Quota rightsizing has been integrated with the container rightsizing Action. Customers can now orchestrate the resizing process of both containers and Kubernetes Resource Quotas from a single job using custom profiles and dedicated lookback windows.
• The return of free Actions! Kubecost 3.2 brings back container resizing actions for users of the free edition. Actions are limited to a single cluster and do not include the Resource Quota rightsizing integration. Some manual setup steps are required so be sure to read the documentation.
• An all-new Audit Log is available for Actions with separate tables for the Kubernetes resource types, a comprehensive click-in experience, column manager, the ability to download log entries as JSON, and more.
• (Enterprise) Enterprise Custom Pricing (ECP) has a new UI under the Settings page which allows customers to manage the entire lifecycle of CSV-based custom pricing from the UI including adding, updating, and removing custom pricing specifications. A new (optional) v2 spec provides the ability to supply up to three (3) total labels for greater flexibility in node matching. The UI provides helpful guidance on which row(s) may result in retroactive pricing adjustments along with timelines. And validation has been greatly expanded and improved to ensure the pricing specs provided are accurate.

Minor

• Resource Quota custom profiles can now be named and saved similar to container resizing profiles. Profiles are accessible to both the Resource Quota Rightsizing card on the Savings Insights page as well as the container resizing Action on the Savings Actions page.
• (Enterprise) Kubecost Teams RBAC now supports the Resource Quota Rightsizing page in Savings Insights allowing you to construct roles for your users with the same filters found on that page.
• The Kubecost Health Alert has been enhanced to now include health status changes of your cloud integrations.
• A couple of new banners are present, one reminding you how and where to set up cloud integrations, and a second allowing you to tell us about your experiences in exchange for a gift card.
• The Container Request Rightsizing page now supports downloading a PDF in addition to CSV.
• The Diagnostics page now includes the configured cloud integrations making easier to see health status of your Kubecost estate in one page.
• Carbon emissions equivalents can now be seen in the Allocation Details view.
• Added new diagnostic visualizations for secondary agent heartbeats overtime, and agent CPU and RAM usage on secondary clusters.
• Added a new API to return a summary of the actions dispatched as part of a scheduled run.
• Added account filter support to Allocations.
• (Cluster Controller) A new environment variable MIN_NAMESPACE_AGE can be used to configure the minimum age that a namespace must have before it can be deleted by namespace turndown. Default 4h.
• (Cluster Controller) A new environment variable ACTION_TTL can be used to tell Actions executors to ignore Actions messages older than the TTL. Defaults to 1h.
• (UI) Added the ability to Edit an existing Cloud Integration via the UI.
• (UI) Added orchestrator diagnostics and ECP diagnostics to the Bug Report export.
• (UI) Added Cloud Provider integrations as a sub-navigation item of the Settings nav item.
• (UI) Added a dismissible banner to the Overview page prompting setup of a Cloud Integration when none are present.
• (UI) Removed broken "Cluster Turndown" option from the Actions menu.
• (UI) Added new visualizations for Cluster Diagnostics.
• (UI) Added carbon costs to the Allocation Details page.
• (UI) Added a date tooltip to the Cluster List "Last Seen" field. I.e., mousing over "1 month ago" will show the precise date of last data reported.
• (UI) Added a link to a form for user feedback - link lives in the Settings page.
• FinOps agent is updated to 1.0.19.
• Cluster Controller is updated to v0.16.35.
• Network Costs is updated to v0.18.3.
• Forecasting is updated to v0.1.35.
• (Helm) Added persistent storage to cloud costs.
• (Helm) Added a flag to disable showing of cloud costs in the UI.
• (Helm) Added annotations to PVCs.
• (Helm) Added a rate limiter value for use in cluster controller.
• (Helm) Added a log level env var to cloud costs and set imagePullPolicy.
• (Helm) Added the release namespace to all remaining Helm templates.
• (Helm) Added a method to run aggregator without a persistent volume (not recommended!).
• (Helm) Added a storage lookback value for diagnostics and heartbeat.
• Standardized base image on ubi9-minimal:latest.

Fixes

• (Important) The same fix we put in place in Kubecost 3.1.8 which improves cost accuracy in some cases has been incorporated into Kubecost 3.2.0 as well. Whether you upgrade from 3.1.8 or an earlier version, rest assured you’ll get the fix.
• Fix an issue where Efficiency views would send the wrong ?idle= parameter in some cases.
• Fix an issue where navigating to request sizing from the Allocations page would pass parameter “filters” instead of “filter”
• (Helm) Fix a typing issue in the value aggregator.dbConcurrentIngestionCount.
• (Helm) Fix an issue with disabling of diagnostics and heartbeats.
• Fixed/improved response of budgets API.
• Fixed an issue with a panic when global config was enabled but health alert was not.
• Fixed adding Resource Quota savings amounts to savings cache.
• Fixed handling of null values in webhooks in budget actions.
• Fixed an issue where unauthed monitoring endpoints would fail to work when RBAC teams was enabled.
• Fixed cluster status API showing cluster name with resource group.
• Fixed an issue where users with Editor permissions in RBAC/Teams setups could not create/edit Budgets.
• Fixed an issue which could cause excessive file build-up from heartbeats and diagnostics.
• Fixed an issue where shared costs will now behave correctly when filtering by a namespace and sharing another namespace, with idle enabled/separate.
• Fixed an issue which would allow duplicate role names upon editing.
• Fixed an issue where downloading a CSV/PDF from Collections didn't use the display currency but always USD.
• Fixed an issue in the actions scheduler where if the logic was "Run everywhere EXCEPT at this time" with nothing selected the action would not run.
• Fixed an issue in the container request rightsizing API where when quantileOfMaxes algorithm had qCPU and qRAM set to 1.0 it would not equal max but instead 99%.
• Fixed an issue where core counts would divide by zero which resulted in a query failure.
• Fixed an issue where the "Test Cloud Integration" functionality would erroneously show a failure on success.
• Defunct Settings fields have been removed from the Settings page.
• Fixed issues with Settings page failing to save.
• Fixed an error in fetching / deleting RBAC teams when the team name contained special characters.
• Fixed an issue in allocation PDF downloads where filters were not applied correctly.
• Fixed an issue where the browser's Back button did not work on Teams and Diagnostics pages.
• Fixed an issue where CSV report downloads would repeat the report title twice in the file name.
• Fixed an issue where "Upgrade" prompts could show up in installs that already used a v2 enterprise license.
• Fixed a bug where tooltip content could not be clicked because mousing onto the tooltip caused it to close.
• Fixed a bug where global behavior for idle could default to Share By Cluster instead of Separate.
• Fixed a bug where a new Action with the same name would overwrite the existing same-named Action (due to using names as IDs).

Helm Chart Comparison Report

After Chart: kubecost/kubecost@3.2.0

Before Chart: kubecost/kubecost@3.1.8

CVE by Severity

Unchanged CVEs

High

Medium

Important Notice

Kubecost 3.1.8 includes a significant patch for the agent that will need to be upgraded on all clusters.
This patch should improve cost accuracy in large clusters and in clusters under significant load.

What's Changed

• Fix: Enterprise Custom Pricing bug that would cause incorrect/$0 costs by @nik-kc
• Fix: service monitor indentations in 3.1 by @jessegoodier in #4658
• Fix agent: Improve metric quality that could cause negative usage/costs by @mbolt35 in opencost/opencost#3787
• Fix agent: increase default scrape interval to 60s (up from 30s) to improve cost accuracy caused by incomplete metrics when using intervals that are too short by @jessegoodier in #4660
• Fix: reduce CVE with dependency bumps. Details below. Shout out to @thomasvn!

Helm Chart Comparison Report

Before Chart: kubecost/kubecost@3.1.7

After Chart: kubecost/kubecost@3.1.8

CVE by Severity

Unchanged CVEs

High

Medium

Low