How UnitVane connects
Fully managed, read-only by default
UnitVane is a SaaS platform. We run all three products. You grant read access to billing, install a read-only agent in the clusters you want UnitVane to cover, and point apps at the managed gateway if you use UnitVane AI.
helm upgrade --install kubeon-agent oci://registry.kubeon.io/kubeon/charts/kubeon-agent \ --version 0.6.0 \ --namespace kubeon --create-namespace \ -f kubeon-agent.yamlUnitVane
One SaaS platform, three ways in
There is no self-hosted edition. Each product connects to UnitVane with the least access it needs.
UnitVane
Grant read access to your billing exports. Nothing to install.
- AWS Data Exports in S3, read through a role with an external ID
- Azure Cost Management exports, read from the storage account
- Google Cloud billing in BigQuery, read with a viewer service account
- Any other source uploaded or pushed as FOCUS files
KubeOn
One read-only agent per cluster, plus read access to billing. Write access is your choice.
- The agent runs hourly and sends snapshots outbound over HTTPS
- No Service, no Ingress, no inbound port
- Billing read through a role, managed identity or service account; on AWS its only write is Athena query results
- Cloud and on-premises clusters, priced from the bill or your rate card
- Optional write access: a separate controller, off by default, for automated savings
- Cloud bills connect without keys, on AWS, Azure and Google Cloud
UnitVane AI
Read provider billing and metrics, then point apps at the managed gateway when you are ready.
- Read-only access to Azure, AWS and Google Cloud model billing and metrics
- The gateway runs in the region you choose
- Provider credentials stored encrypted, never in application code
- Your providers keep billing you directly
| Who runs it | UnitVane: upgrades, backups, monitoring and on-call |
|---|---|
| Regions | The region you choose; European data stays in a European region |
| Isolation | Each organization's data kept apart, with its own database for FinOps cost data |
| Encryption | At rest with managed keys, TLS 1.2 or later in transit |
| Sign-in | SSO with SAML 2.0 or OIDC, or local accounts with lockout |
| Upgrades | Rolled out by KubeOn without downtime; only the agent's chart version is yours to pin |
The agent
A read-only CronJob, with write access kept separate
The agent reads the Kubernetes API, sends a snapshot to KubeOn and exits. It never reads Secrets or ConfigMaps and has no write verbs. Automated savings use a separate controller, off by default.
| Kind | CronJob, hourly (7 * * * *), concurrencyPolicy Forbid |
|---|---|
| Run time | Typically under a minute; hard timeout 10 minutes |
| Resources | Requests 100m CPU and 256Mi; memory limit 512Mi |
| Security context | Non-root (uid 1000), read-only root filesystem, all capabilities dropped |
| Network | Outbound HTTPS to UnitVane only. No Service, no Ingress, no inbound port |
| Storage | No PersistentVolume. One gzipped snapshot per run |
apiVersion: rbac.authorization.k8s.io/v1kind: ClusterRolemetadata: name: kubeon-agent-readerrules: - apiGroups: [""] resources: [nodes, pods, namespaces, persistentvolumes, persistentvolumeclaims, services] verbs: [get, list, watch] - apiGroups: [apps] resources: [deployments, statefulsets, daemonsets, replicasets] verbs: [get, list, watch] - apiGroups: [batch] resources: [jobs, cronjobs] verbs: [get, list, watch] - apiGroups: [storage.k8s.io] resources: [storageclasses] verbs: [get, list, watch] - apiGroups: [metrics.k8s.io] resources: [nodes, pods] verbs: [get, list] - apiGroups: [karpenter.sh] # NodePools, on Karpenter clusters resources: [nodepools, nodeclaims] verbs: [get, list, watch] - apiGroups: [autoscaling] resources: [horizontalpodautoscalers] verbs: [get, list, watch] - apiGroups: [argoproj.io] # where workloads are deployed from resources: [applications, rollouts] verbs: [get, list, watch] - apiGroups: [kustomize.toolkit.fluxcd.io, helm.toolkit.fluxcd.io, source.toolkit.fluxcd.io] resources: [kustomizations, helmreleases, gitrepositories] verbs: [get, list, watch]Install
Helm, Flux, Argo CD or Terraform
One chart, the same values everywhere. GitOps users commit a HelmRelease or an Application and let the controller roll it out to every cluster, with the cluster name substituted per cluster.
helm upgrade --install kubeon-agent oci://registry.kubeon.io/kubeon/charts/kubeon-agent \ --version 0.6.0 \ --namespace kubeon --create-namespace \ -f kubeon-agent.yamlKubernetes data flow
From a pod to a line on a team's bill
Times are UTC and configurable. Snapshots run every hour. The first connection reads and allocates billing as soon as the first snapshot and billing data are in; after that, billing and allocation run daily.
Your environment, outbound only
Clusters with the KubeOn agentEKS, AKS, GKE, OpenShift, on-prem
Cloud billing exportsCUR 2.0, Azure exports, BigQuery- FOCUS files and rate cardsAny provider or data center
Metricsmetrics-server and Prometheus- Object storage you ownS3, GCS or Azure Blob, KMS-encrypted
KubeOn hub
Fully managed by UnitVane
- 1Ingest snapshots
- 2Normalize labels
- 3Allocate
- 4Reconcile
- 5Recommend
What your teams get
- Allocation and chargebackBy team, namespace or label
- Change proposalsPull requests, or applied by KubeOn
- Budgets and alertsSlack, Teams, email, webhooks
- Reports and APIScheduled, CSV, REST
- Ask KubeOnAnswers with traced figures
The agent lists nodes, namespaces, workloads, pods, volumes, services and Karpenter NodePools through its read-only ClusterRole, 500 objects at a time.
It reads current usage from metrics-server and, if configured, the last full hour of history from Prometheus.
It sends one gzipped snapshot with a schema version and row counts per kind over HTTPS, on an upload link KubeOn issues for your organization.
KubeOn ingests it as soon as the upload completes, and rejects any snapshot whose row counts do not match.
Daily, the hub reads billing from your export. The last 3 days are re-read so late line items are not missed.
Costs are allocated for every cluster-day with both usage and billing, and each cluster is reconciled to its bill.
Change proposals are regenerated from the latest savings. Reviewed decisions are kept.
Budgets, alert rules and anomalies are evaluated and notifications delivered.
Verify
Check the first run
Trigger a run by hand, read its log, and open Diagnostics in KubeOn to see the cluster's heartbeat.
kubectl -n kubeon get cronjob,jobkubectl -n kubeon create job --from=cronjob/kubeon-agent kubeon-agent-first-runkubectl -n kubeon logs job/kubeon-agent-first-run# the last line reads: sent snapshot to https://app.kubeon.io (... bytes)Upgrades
Pin, upgrade, roll back
Chart versions are pinned. Upgrade on your schedule, and roll back with Helm or by reverting the version in Git.
helm upgrade kubeon-agent oci://registry.kubeon.io/kubeon/charts/kubeon-agent \ --namespace kubeon --version 0.6.0 --reuse-values# roll back to the previous releasehelm rollback kubeon-agent --namespace kubeonLet's get started
A 30-minute walkthrough on your own billing data, for your clouds, your clusters and your model providers.