Cloud bills for Kubernetes clusters have a way of creeping up quietly until someone in finance asks why compute spend jumped 40% in a quarter. Kubecost is the tool most platform teams reach for first, and it’s the one referenced across nearly every 2026 FinOps playbook for containerized infrastructure. This tutorial walks through installing Kubecost on a live cluster, reading its cost allocation data correctly, and using it to drive real reductions with rightsizing, autoscaling, and spot instances.
By the end you’ll have a working Kubecost deployment reporting namespace-level and workload-level costs, tied into your existing billing export, with a rightsizing and autoscaling plan you can hand to your engineering leads. Total setup time runs about 90 minutes, most of it waiting on data to populate rather than active configuration work.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
Why Kubernetes Costs Spiral Out of Control
Kubernetes makes it trivially easy to request more CPU and memory than a workload will ever use. Engineers set generous resource requests to avoid OOMKills during a rushed deploy, and those numbers never get revisited. Multiply that across hundreds of pods and dozens of namespaces, and a cluster can end up provisioned at two or three times its actual utilization. Idle nodes, orphaned persistent volumes, and forgotten dev namespaces that never scale to zero pile on top of that waste.
The core problem is visibility. A cloud bill shows total EC2 or Compute Engine spend, but it doesn’t tell you which team, namespace, or deployment is responsible for which slice of that number. Without that breakdown, cost optimization is guesswork. Kubecost and its open source counterpart OpenCost solve that by reading Kubernetes resource usage directly and mapping it to actual cloud billing data, down to the namespace and even the pod label.
Current 2026 FinOps guidance frames this as a four-stage cycle: get visibility first, then allocate costs to teams, then rightsize and autoscale, then govern with policy so waste doesn’t creep back in. Skipping straight to “just cut costs” without the visibility stage almost always backfires, because nobody can tell which cuts are safe.
Prerequisites: What You Need Before Starting
This tutorial assumes a working Kubernetes cluster already exists, whether that’s a self-managed cluster, Amazon EKS, Azure AKS, or Google Kubernetes Engine. You’ll need cluster-admin permissions to install a Helm chart and create a namespace.
| Requirement | Minimum Version | Notes |
|---|---|---|
| Kubernetes cluster | 1.27+ | EKS, AKS, GKE, or self-managed; 3+ nodes recommended |
| Helm | 3.12+ | Used to install Kubecost, VPA, and KEDA |
| kubectl | 1.27+ | Configured with cluster-admin context |
| Kubecost | latest stable Helm chart | Free tier covers up to 250 cores; paid tiers scale beyond that |
| Metrics server | latest stable | Required for HPA and VPA to read live usage |
| Cloud billing export | N/A | AWS Cost and Usage Report, Azure Cost Export, or GCP Billing Export |
| Available RAM for Kubecost | 2 GB+ | Prometheus storage grows with cluster size and retention window |
You don’t need a paid Kubecost license to follow this guide. The free tier includes Prometheus-backed cost monitoring, namespace and label-based allocation, and the efficiency dashboards this tutorial relies on. Multi-cluster federation, longer data retention, and SSO are the features gated behind paid plans, and most teams don’t need them on day one.
Step 1: Install Kubecost With Helm
Add the Kubecost Helm repository and install the chart into its own namespace. Kubecost bundles its own Prometheus instance by default, so on a fresh cluster you don’t need to install monitoring separately (if you already run Prometheus, you can point Kubecost at it instead, which saves resources).
helm repo add kubecost https://kubecost.github.io/cost-analyzer/
helm repo update
helm install kubecost kubecost/cost-analyzer \
--namespace kubecost --create-namespace \
--set kubecostToken="your-token-here" \
--set global.prometheus.enabled=true
kubectl get pods -n kubecost --watchYou can register for a free token on Kubecost’s site, or skip the token entirely for local evaluation. Wait until every pod in the kubecost namespace shows Running and 1/1 or 2/2 ready before moving on. On a mid-size cluster this takes 5-10 minutes, most of it Prometheus building its initial index.
Step 2: Access the Kubecost Dashboard
Port-forward the Kubecost frontend service to your local machine to open the dashboard without exposing it publicly yet.
kubectl port-forward -n kubecost deployment/kubecost-cost-analyzer 9090:9090
# Then open in your browser:
# http://localhost:9090On first load, the dashboard will show near-zero costs because it has no historical data yet. That’s expected. Kubecost needs at least a few hours of live metrics before its allocation numbers stabilize, and its trend charts need several days before they’re useful for spotting patterns. Don’t make any rightsizing decisions off the first hour of data.
Step 3: Connect Your Cloud Billing Export
Kubecost’s default view estimates cost using published list prices for your instance types, which is a reasonable starting point but doesn’t account for reserved instance discounts, savings plans, or committed use contracts. Connecting a real billing export reconciles Kubecost’s numbers against what you actually pay.
- AWS: enable a Cost and Usage Report (CUR) exported to an S3 bucket, then point Kubecost at that bucket and its Athena table.
- Azure: set up a Cost Export in the Azure portal targeting a storage account, then configure Kubecost’s Azure billing integration with the export path.
- GCP: enable BigQuery Billing Export at the billing account level, then give Kubecost the dataset ID.
This step is the one teams skip most often, and it’s also the one that makes the numbers trustworthy enough to bring to a budget meeting. Without it, Kubecost is giving you a good relative comparison between namespaces, but the absolute dollar figures can drift 10-20% from your actual invoice depending on your discount structure.
Step 4: Map Namespaces to Cost Centers
Cost allocation only works if your cluster has a consistent labeling convention. Before you can show a team “here’s what you spend,” every namespace and, ideally, every deployment needs labels that map to a team, product, or cost center. If your cluster is a labeling free-for-all today, this is the point to fix it.
kubectl label namespace payments team=payments cost-center=eng-payments
kubectl label namespace checkout team=checkout cost-center=eng-checkout
kubectl label namespace ml-training team=data-science cost-center=eng-data
# Verify labels landed correctly
kubectl get namespaces --show-labelsKubecost’s Allocation view groups by any label you’ve applied, so once namespaces (and ideally pods) carry consistent team or cost-center labels, you can generate a per-team cost report without writing a single line of code. Enforce this going forward with an admission policy (OPA Gatekeeper or Kyverno) that rejects namespace creation without required labels, otherwise the convention decays within a quarter.
Step 5: Enforce Resource Requests on Every Pod
Kubecost’s cost allocation for a pod without CPU and memory requests defaults to an estimate based on actual usage, which is better than nothing but less accurate than requests-based allocation, and it also means the scheduler has no idea how much room that pod needs. Set a namespace-wide default so nothing runs unaccounted for.
apiVersion: v1
kind: LimitRange
metadata:
name: default-resource-limits
namespace: checkout
spec:
limits:
- default:
cpu: 500m
memory: 512Mi
defaultRequest:
cpu: 100m
memory: 128Mi
type: ContainerApply this with kubectl apply -f limitrange.yaml -n checkout to every namespace that’s missing consistent requests. Pair it with a ResourceQuota at the namespace level so a single runaway deployment can’t consume an entire node’s capacity and silently blow up your bill.
Step 6: Identify Your Biggest Waste Sources First
Once you have a week of data, open Kubecost’s Efficiency view. This is where the real savings opportunities show up: it compares what a workload requested against what it actually used, and surfaces the gap as wasted spend. Sort by dollar amount, not percentage, since a workload running at 5% efficiency but costing $3 a month matters far less than one running at 60% efficiency but costing $8,000 a month.
| Waste Source | Typical Share of Cluster Spend | Fix |
|---|---|---|
| Over-requested CPU/memory | 20-35% | Rightsize with VPA recommendations |
| Idle non-prod environments running 24/7 | 10-20% | Scheduled scale-to-zero after hours |
| Orphaned volumes and load balancers | 3-8% | Automated cleanup policy |
| On-demand pricing for stateless workloads | 15-25% | Spot/preemptible instances |
| Underutilized nodes from poor bin-packing | 10-15% | Node consolidation via Karpenter or cluster autoscaler |
Most clusters that haven’t been actively cost-managed will find their single biggest line item is over-requested CPU and memory, simply because it’s the easiest mistake to make and nobody circles back to fix it. That’s why the next two steps focus there before moving to infrastructure-level changes.
Step 7: Right-Size Workloads With the Vertical Pod Autoscaler
The Vertical Pod Autoscaler (VPA) watches actual CPU and memory usage for a workload and recommends (or automatically applies) better resource requests. Install it in recommendation-only mode first. Never let it auto-apply changes to production workloads before you’ve validated its suggestions against real traffic.
helm repo add fairwinds-stable https://charts.fairwinds.com/stable
helm install vpa fairwinds-stable/vpa --namespace vpa --create-namespaceapiVersion: autoscaling.k8s.io/v1
kind: VerticalPodAutoscaler
metadata:
name: checkout-api-vpa
namespace: checkout
spec:
targetRef:
apiVersion: "apps/v1"
kind: Deployment
name: checkout-api
updatePolicy:
updateMode: "Off" # recommendation-only, never auto-appliesLet VPA observe a workload for at least 30 days, covering weekday and weekend traffic patterns, before acting on its recommendation. When you do apply a change, add a 15-20% safety margin above the raw suggested value, and validate the new limits against P99 latency and error rate for at least a week after rollout. Prioritize the top 20% of deployments by cost first; that’s typically where 80% of the recoverable waste lives.
Step 8: Scale to Zero With KEDA for Bursty Workloads
Standard Horizontal Pod Autoscaling can’t scale a deployment below one replica, which means queue workers, batch jobs, and low-traffic services still burn cost 24/7 even during idle windows. KEDA extends autoscaling down to zero replicas, triggered by queue depth, cron schedules, or custom metrics.
helm repo add kedacore https://kedacore.github.io/charts
helm install keda kedacore/keda --namespace keda --create-namespaceapiVersion: keda.sh/v1alpha1
kind: ScaledObject
metadata:
name: nightly-batch-scaler
namespace: ml-training
spec:
scaleTargetRef:
name: batch-worker
minReplicaCount: 0
maxReplicaCount: 10
triggers:
- type: cron
metadata:
timezone: America/New_York
start: 0 8 * * 1-5
end: 0 20 * * 1-5
desiredReplicas: "1"Dev and staging namespaces are the easiest win here: scaling non-production workloads to zero outside business hours alone typically recovers a meaningful chunk of the 10-20% share of spend that idle environments represent, according to current FinOps guidance for Kubernetes cost allocation.
Step 9: Move Stateless Workloads to Spot Instances
Spot instances (and their equivalents, Azure Spot VMs and GCP Preemptible/Spot VMs) run at a steep discount off on-demand pricing in exchange for the possibility of reclamation with short notice. For stateless, horizontally-scaled workloads, that trade-off is close to free money. Combining spot capacity with ARM-based nodes (AWS Graviton, Azure Cobalt, or GCP Axion) compounds the savings further, with recent FinOps guidance citing combined compute cost cuts of up to 40% for teams that adopt both.
Karpenter has become the standard provisioner for mixed on-demand/spot node pools in 2026, replacing the older Cluster Autoscaler in most new deployments because it provisions nodes faster and bin-packs workloads more efficiently.
apiVersion: karpenter.sh/v1
kind: NodePool
metadata:
name: spot-arm-workers
spec:
template:
spec:
requirements:
- key: karpenter.sh/capacity-type
operator: In
values: ["spot"]
- key: kubernetes.io/arch
operator: In
values: ["arm64"]
nodeClassRef:
name: default
limits:
cpu: "1000"
disruption:
consolidationPolicy: WhenEmptyOrUnderutilizedNever put stateful, single-replica workloads on spot capacity without a graceful shutdown handler for the two-minute reclamation warning. Databases, message brokers with in-memory state, and anything without built-in replication belong on on-demand or reserved nodes.
Step 10: Set Budgets, Alerts, and Showback Reports
With allocation, rightsizing, and autoscaling in place, the last step is making the numbers visible to the teams actually generating the spend. Kubecost supports namespace-level budgets with Slack or email alerts when a team crosses a threshold. Start with showback (teams see their number, nobody is billed for it) for two to three months before moving to chargeback (teams are actually billed), since jumping straight to chargeback without a warm-up period tends to trigger defensive pushback rather than cooperation.
# Kubecost alert config example (values.yaml)
kubecostModel:
alerts:
- type: budget
threshold: 5000
window: monthly
aggregation: namespace
filter: "namespace:checkout"
recipients: ["#finops-alerts"]Schedule a recurring 15-minute weekly review of the top five cost movers with engineering leads. That single meeting, run consistently, catches runaway spend within a week rather than a quarter, which is the difference between a $200 fix and a $20,000 surprise on the next invoice.
Step 11: Automate Cleanup of Orphaned Resources
Persistent volumes, load balancers, and IP addresses left behind by deleted deployments are pure waste, since nothing is using them but the cloud provider still bills for them. Kubecost’s Assets view flags these, but you should also run a scheduled cleanup job.
# Find PVCs with no pod referencing them
kubectl get pvc --all-namespaces -o json | \
jq -r '.items[] | select(.status.phase=="Bound") | "\(.metadata.namespace)/\(.metadata.name)"' \
> all-pvcs.txt
kubectl get pods --all-namespaces -o json | \
jq -r '.items[].spec.volumes[]?.persistentVolumeClaim.claimName' \
> used-pvcs.txt
comm -23 <(sort all-pvcs.txt) <(sort used-pvcs.txt)Run this weekly, review the output manually before deleting anything (some volumes are intentionally detached for backup purposes), and set an automated lifecycle policy to keep total waste under a 5% threshold of cluster spend, which current 2026 FinOps playbooks treat as the baseline acceptable level for a well-managed cluster.
Step 12: Set Up CI Cost Gates
The most durable way to prevent cost regressions is catching them before they merge, not after they've been running for a month. Tools like Infracost (for Terraform-provisioned infrastructure) can post an estimated cost delta directly on a pull request, and Kubecost's API can be queried from a CI pipeline to flag deployments that request unusually large resource increases.
# Example: query Kubecost API for a namespace's current allocation
curl -s "http://kubecost-cost-analyzer.kubecost:9090/model/allocation?window=7d&aggregate=namespace" \
| jq '.data[0].checkout.totalCost'Wire this into a GitHub Actions or GitLab CI step that fails a PR (or at minimum posts a warning comment) if a deployment's requested resources would increase projected namespace cost by more than a defined percentage. This turns cost review into a normal part of code review rather than a quarterly fire drill.
Common Pitfalls When Setting Up Kubecost
Even a straightforward Helm install has a handful of ways to go sideways. These are the mistakes that show up most often in production deployments.
- Judging costs from day-one data. Kubecost's numbers stabilize over days, not hours. Acting on the first hour of data leads to wrong conclusions about which workloads are actually expensive.
- Skipping the billing export integration. Without it, you're comparing estimated list prices to a real invoice with discounts applied, and the two numbers won't match, which erodes trust in the tool from finance stakeholders.
- Auto-applying VPA recommendations to production immediately. A VPA recommendation based on two days of low traffic can undersize a workload right before a traffic spike. Always run in recommendation mode first.
- Putting stateful workloads on spot capacity. A database or single-replica cache without graceful shutdown handling will lose data or cause an outage the first time the node gets reclaimed.
- Inconsistent or missing namespace labels. Cost allocation reports are only as good as your labeling discipline. A cluster with half-labeled namespaces produces a showback report nobody trusts.
- Forgetting Prometheus retention and storage sizing. Kubecost's bundled Prometheus needs adequate persistent storage; running out of disk silently truncates historical cost data.
- Jumping straight to chargeback. Billing a team for costs they've never seen before creates friction. Showback first builds the trust needed for chargeback to land well later.
Sample Output: Reading a Kubecost Allocation Report
After a week of data collection with billing export connected, a typical namespace-level allocation report from the Kubecost dashboard looks like this:
| Namespace | CPU Cost | Memory Cost | Total Weekly Cost | Efficiency |
|---|---|---|---|---|
| checkout | $412 | $198 | $610 | 58% |
| payments | $389 | $221 | $610 | 71% |
| ml-training | $1,240 | $890 | $2,130 | 34% |
| staging | $310 | $150 | $460 | 19% |
| monitoring | $95 | $60 | $155 | 82% |
Read this table by scanning the efficiency column first, not total cost. The ml-training namespace is the biggest spender by far at $2,130 a week but sits at only 34% efficiency, meaning roughly two-thirds of its requested resources go unused. That's the namespace to attack first with VPA rightsizing. The staging namespace at 19% efficiency is a smaller dollar amount but a clear candidate for KEDA scale-to-zero scheduling outside business hours.
Advanced Tip: Building a Cost Dashboard for Leadership
Engineering leads want namespace-level detail; a VP or CFO wants a single trend line and a dollar figure. Kubecost exposes a Prometheus-compatible metrics endpoint that you can feed into Grafana to build a leadership-facing dashboard separate from the engineering-facing Kubecost UI.
# Example PromQL query for a Grafana panel: monthly cluster cost trend
sum(avg_over_time(kubecost_cluster_management_cost[30d])) by (cluster)
+ sum(avg_over_time(node_total_hourly_cost[30d])) by (cluster) * 730Pair this trend chart with a simple annotation layer marking when major optimization changes (VPA rollout, spot migration, KEDA deployment) went live. That makes the ROI of the FinOps work visible without anyone having to dig through raw Kubecost data, and it's usually what secures budget for continuing the initiative into its second and third quarter.
Advanced Tip: Multi-Cluster Cost Aggregation
Most organizations running Kubernetes at any scale operate more than one cluster, whether split by environment, region, or business unit. Kubecost's free tier reports per-cluster only; aggregating across clusters into a single view requires either the paid federated ETL feature or a self-managed workaround using Thanos or Grafana Mimir to centralize the metrics from each cluster's local Prometheus/Kubecost instance.
If you're not ready to pay for federation, a practical interim step is exporting each cluster's daily allocation summary via the Kubecost API into a shared BigQuery or Athena table, then building your leadership dashboard on top of that instead of trying to unify live Prometheus data across clusters. It's more manual, but it gets 80% of the value at zero additional licensing cost.
Troubleshooting Kubecost Setup Issues
These are the most common problems teams hit during and after installation, along with the fixes that resolve them.
- Pods stuck in Pending after Helm install. Usually insufficient CPU/memory capacity on existing nodes for Prometheus. Check
kubectl describe podin the kubecost namespace for scheduling failures and add node capacity or reduce Prometheus resource requests in values.yaml. - Dashboard shows $0 for all namespaces. The bundled Prometheus hasn't scraped enough intervals yet. Wait at least 2-4 hours, and confirm the
kubecost-prometheus-serverpod is running and its targets are healthy at/targets. - Cost numbers don't match cloud invoice. Billing export integration is either missing or misconfigured. Re-check the CUR/Cost Export/Billing Export path and credentials, and confirm the export bucket actually contains recent data files.
- Helm install hangs on Prometheus PVC. The default StorageClass may not support dynamic provisioning in your cluster. Specify a valid StorageClass explicitly with
--set global.prometheus.server.persistentVolume.storageClass=. - VPA recommendations look absurdly low. This happens when the observation window is too short or coincides with an unusually quiet period. Extend the observation window to a full 30 days spanning at least one full business cycle before trusting the numbers.
- KEDA ScaledObject not scaling to zero. Check that
minReplicaCount: 0is set and that no PodDisruptionBudget on the target deployment is blocking the final replica from terminating. - Karpenter not provisioning spot nodes. Verify IAM permissions for the Karpenter controller include spot fleet request permissions, and check the NodePool's capacity-type requirement is correctly set to include "spot".
- Namespace labels not reflected in Kubecost allocation view. Kubecost caches label data; changes can take up to an hour to propagate into the UI. If it persists longer, restart the
kubecost-cost-analyzerdeployment to force a refresh. - Billing export shows a lag of several days. This is normal and provider-dependent; AWS CUR typically updates every 24 hours with a delay, so don't expect same-day reconciliation.
Governance: Keeping Waste From Creeping Back
Cost optimization done as a one-time project degrades within a quarter without ongoing governance. The 2026 approach that's held up best combines policy enforcement with continuous monitoring rather than relying on manual reviews alone.
Use OPA Gatekeeper or Kyverno admission policies to require resource requests and cost-center labels on every new deployment before it's admitted to the cluster. Set TTL policies on ephemeral resources like preview environments so they self-delete after a defined window instead of running indefinitely. Enforce the CI cost gate from Step 12 on every pull request that touches deployment manifests or Terraform infrastructure code, not just the ones engineers remember to flag manually.
The teams that sustain their savings past the first quarter are the ones that treat cost as a first-class metric alongside latency and error rate, reviewed in the same dashboards and the same standups, rather than as a separate finance-only concern that only gets attention when a bill spikes.
Complete Working Project: Putting It All Together
Here's the full sequence as a reference checklist you can run against any cluster, from initial install through governance.
# 1. Install Kubecost
helm repo add kubecost https://kubecost.github.io/cost-analyzer/
helm repo update
helm install kubecost kubecost/cost-analyzer -n kubecost --create-namespace
# 2. Connect billing export (cloud-specific, see Step 3)
# 3. Label every namespace
kubectl label namespace team= cost-center=
# 4. Enforce resource requests
kubectl apply -f limitrange.yaml -n
# 5. Install VPA (recommendation mode)
helm install vpa fairwinds-stable/vpa -n vpa --create-namespace
# 6. Install KEDA for scale-to-zero
helm install keda kedacore/keda -n keda --create-namespace
# 7. Install Karpenter for spot/ARM node provisioning
# (cloud-specific IAM setup required first)
# 8. Set budgets and alerts in Kubecost values.yaml
# 9. Schedule weekly PVC/orphan cleanup job (CronJob)
# 10. Wire Kubecost API into CI as a cost gate Run this checklist against a staging cluster first if you have one available. It gives you a safe environment to validate that VPA recommendations, KEDA scaling triggers, and Karpenter node pools behave as expected before touching anything that serves production traffic.
Setting Up Cost Anomaly Alerts
A weekly review catches gradual drift, but it won't catch a misconfigured deployment that suddenly spins up 200 replicas at 2 a.m. and burns through a day's budget before anyone notices. Kubecost's anomaly detection watches for sudden spend spikes relative to a namespace's rolling baseline and fires an alert the moment a deviation crosses a set threshold, rather than waiting for the next scheduled report.
# values.yaml snippet for anomaly alerting
kubecostModel:
alerts:
- type: spendChange
threshold: 0.30 # alert on a 30% jump vs. 7-day baseline
window: daily
aggregation: namespace
recipients: ["#finops-alerts", "[email protected]"]Tune the threshold based on how noisy your baseline traffic already is. A 30% daily deviation is a reasonable starting point for most production namespaces, but a batch-processing namespace with naturally bursty workloads will need a wider band or it'll page someone every night. Route these alerts to the same on-call channel your team already monitors for latency and error-rate incidents, not a separate finance-only Slack channel that engineers don't watch. Cost anomalies are almost always the downstream symptom of an operational bug (a crash-loop triggering endless restarts, a misconfigured HPA max, a stuck job retrying forever), so the team best positioned to fix it fast is whoever's already on call for the service.
Real-World Example: A 34% Reduction Walkthrough
To make the abstract savings percentages concrete, here's how a typical mid-size cluster's optimization plays out across a full quarter, following the exact sequence in this tutorial.
| Month | Action Taken | Monthly Cluster Spend | Change |
|---|---|---|---|
| Month 0 (baseline) | Kubecost installed, billing export connected | $18,400 | â |
| Month 1 | Namespace labeling, resource requests enforced, VPA in recommendation mode | $17,900 | -2.7% |
| Month 2 | VPA rightsizing applied to top 20% of deployments, KEDA scale-to-zero on staging/dev | $14,600 | -18.4% |
| Month 3 | Karpenter spot + Graviton migration for stateless services, orphan cleanup automated | $12,150 | -16.8% |
The cumulative reduction across the quarter lands at roughly 34%, consistent with the combined savings range current FinOps guidance cites for teams that layer rightsizing, scale-to-zero, and spot adoption together rather than doing just one. Note that Month 1's improvement looks small; that's expected, since labeling and enforcing requests are prerequisite groundwork rather than direct cost cuts. The real movement happens once VPA and KEDA start acting on real usage data in Month 2, and it compounds further once workloads shift onto cheaper compute in Month 3. Teams that try to skip straight to spot instances without the visibility and rightsizing groundwork first tend to see a smaller, less durable improvement, because they're optimizing infrastructure cost without first eliminating the over-provisioning that inflated it.
Kubecost vs OpenCost: Which One to Choose
OpenCost is the CNCF-hosted open source project that Kubecost's core cost allocation engine is built on, so the two share the same underlying model. The practical difference is in packaging and extras. The broader discipline both tools serve, cloud financial management applied to engineering decisions, is formalized by the FinOps Foundation, which publishes the maturity framework (Crawl, Walk, Run) that most of the staged rollout in this tutorial is loosely modeled on.
| Feature | OpenCost | Kubecost Free | Kubecost Paid Tiers |
|---|---|---|---|
| Core cost allocation | Yes | Yes | Yes |
| Prebuilt UI dashboard | Minimal | Full dashboard | Full dashboard |
| Cloud billing reconciliation | Manual setup | Built-in | Built-in |
| Multi-cluster federation | Self-managed | Not included | Included |
| SSO / RBAC for dashboard | No | No | Included |
| Node limit | Unlimited | Up to 15 nodes | Unlimited |
| Cost | Free (CNCF project) | Free | Paid, scales with nodes |
For a single small-to-mid cluster, Kubecost's free tier is the pragmatic default since it ships the dashboard and billing reconciliation out of the box. Teams running more than 15 nodes or multiple clusters that want a unified view should evaluate whether the paid tier's federation feature is worth the license cost compared to self-hosting OpenCost with a custom aggregation layer.
Securing Access to Cost Data
Cost data is more sensitive than most teams initially treat it. A namespace-level breakdown reveals which product lines are getting the most engineering investment, which teams are over- or under-resourced, and, indirectly, hiring and headcount patterns tied to specific projects. Treat access to the Kubecost dashboard with the same care you'd give an internal analytics tool, not as a purely technical monitoring dashboard open to the whole engineering org by default.
On the free tier, Kubecost has no built-in SSO or RBAC, so access control has to happen at the network layer. The safest default is keeping the dashboard reachable only via kubectl port-forward for ad hoc use, or behind an internal Ingress that sits behind your existing identity provider (Okta, Azure AD, or similar) via an authenticating reverse proxy like oauth2-proxy. Don't expose the Kubecost service with a public LoadBalancer or a NodePort reachable from the internet; there's no reason cost data needs to be internet-facing, and the dashboard has no rate limiting or brute-force protection of its own.
The Kubecost API credentials used for the billing export integration deserve the same scrutiny as any other cloud credential. Scope the IAM role or service principal Kubecost uses to read-only access on the specific S3 bucket, storage account, or BigQuery dataset holding the billing export, never broader account-wide permissions. If you're running Kubecost across multiple clusters with different security boundaries (say, a shared production cluster and a more locked-down PCI-scoped cluster), keep their Kubecost instances and credentials fully separate rather than centralizing into one dashboard that would need broad cross-boundary access to function.
Frequently Asked Questions
Does Kubecost work with EKS, AKS, and GKE equally well?
Yes. Kubecost supports all three major managed Kubernetes services and reads pricing data appropriate to each provider. The billing export integration step differs by provider (CUR for AWS, Cost Export for Azure, BigQuery Billing Export for GCP), but the core Helm install and dashboard experience is identical.
How long until Kubecost's cost data is accurate?
Basic namespace-level numbers stabilize within a few hours. Trend analysis and VPA-style rightsizing recommendations need at least a full week, and ideally 30 days, to account for weekly and business-cycle traffic patterns.
Is Kubecost's free tier enough for a production cluster?
For a single cluster under 15 nodes, yes. It includes the full dashboard, cost allocation, and billing reconciliation. Multi-cluster federation, SSO, and extended data retention are gated behind paid tiers.
Can I use Kubecost without exposing it to the internet?
Yes, and you should by default. Keep the dashboard behind kubectl port-forward or an internal-only Ingress protected by your existing SSO or VPN, since cost data can reveal sensitive information about your infrastructure and headcount allocation.
What's the difference between Kubecost and a cloud provider's native cost tool?
AWS Cost Explorer, Azure Cost Management, and GCP's Cost Table all report at the resource level (which EC2 instance, which node), not the Kubernetes level (which namespace, which pod). Kubecost bridges that gap by mapping Kubernetes-native resource usage down to the pod and namespace onto the underlying cloud bill.
Should I use VPA or HPA, or both?
They solve different problems and often run together. HPA scales the number of replicas based on load; VPA adjusts the resource requests of each replica based on actual usage. A common pattern is VPA in recommendation mode informing manual request tuning, combined with HPA for automatic replica scaling under load.
Will moving to spot instances risk downtime?
Only if stateful or single-replica workloads are placed on spot capacity without graceful shutdown handling. For horizontally-scaled stateless services with proper pod disruption budgets, spot reclamation is typically absorbed without user-visible impact.
How much can a typical team actually save with this setup?
Savings vary by how wasteful the starting state was, but current FinOps guidance for Kubernetes points to combined savings in the 30-40% range on compute spend for teams that implement rightsizing, spot adoption, and scale-to-zero scheduling together, with the biggest single lever typically being elimination of over-requested CPU and memory.
Does Kubecost slow down my cluster or add meaningful overhead?
The bundled Prometheus instance and the cost-analyzer pod consume resources like any other workload, typically a few hundred millicores of CPU and a gigabyte or two of memory depending on cluster size and metrics retention window. On a cluster of any real production size, that overhead is negligible against total cluster spend, and it's the cost of the visibility that unlocks the far larger savings described throughout this tutorial.
