Amazon EKS and AWS
EKS cost allocation from your CUR, line by line
KubeOn reads your CUR 2.0 export in place with Amazon Athena, uses AWS split cost allocation data where it exists, and reconciles every EKS cluster to its bill, net of Savings Plans, reservations and EDP discounts.
What KubeOn reads
What KubeOn needs on AWS
Your AWS account
CUR 2.0 exportWith split cost allocation data- KubeOn billing roleRead-only, in your account
EKS and other clustersThe agent sends a snapshot every hour
KubeOn hub
Fully managed by UnitVane
- 1Read the billing data
- 2Join it with each snapshot
- 3Allocate every node's cost
- 4Reconcile to the bill
What you get
- Cost per team and labelPods, namespaces and teams
- Each cluster reconciledTo its own bill
- Savings to act onAs pull requests, or applied by KubeOn
Billing
CUR 2.0 Data Export with resource IDs and split cost allocation data, cataloged in AWS Glue, queried with Amazon Athena.
Access
A role deployed with CloudFormation in your billing account, assumed with an ExternalId. It reads the export, and its only write is Athena query output.
Agent identity
A cluster token from KubeOn. No IAM role: the agent sends snapshots to your organization in KubeOn and nowhere else.
Setup
Three steps to the first allocation
Cluster inventory appears within the first hour. Allocated costs follow as soon as billing data is in.
01
Turn on the billing export
Create a CUR 2.0 Data Export with resource IDs and split cost allocation data, and catalog it in AWS Glue.Billing and Cost Management# In Billing and Cost Management:# 1. Cost Management preferences > enable "Split cost allocation data" for Amazon EKS# 2. Data Exports > Create > Standard data export > CUR 2.0# - Include resource IDs: on# - Split cost allocation data: on# - Format: Parquet, delivered daily to s3://acme-cur-exports/# 3. Catalog the export with an AWS Glue crawler (or reuse your existing CUR table)02
Grant billing access
Deploy the KubeOn billing role in the account that owns the export.CloudFormationaws cloudformation deploy \ --stack-name kubeon-billing-access \ --template-url https://downloads.kubeon.io/aws/kubeon-billing-access.yml \ --capabilities CAPABILITY_NAMED_IAM \ --parameter-overrides \ KubeOnAccountId=444455556666 \ KubeOnRoleName=kubeon-prod-hub-task \ ExternalId="$(openssl rand -hex 24)" \ CurBucketName=acme-cur-exports \ AthenaResultsBucketName=acme-athena-results \ GlueDatabaseName=cur_database \ AthenaWorkgroupName=primaryaws cloudformation describe-stacks --stack-name kubeon-billing-access \ --query "Stacks[0].Outputs[?OutputKey=='RoleArn'].OutputValue" --output text03
Install the agent on each cluster
One Helm release per cluster, with the cluster's token from KubeOn in a Secret.kubeon-agent.yaml# kubeon-agent.yamlclusterName: prod-use1-a # how the cluster appears in KubeOnkubeon: existingSecret: kubeon-agent-token # the Secret holding the cluster's tokenprometheusUrl: http://prometheus-server.monitoring.svc:9090 # optional
Connecting the bill in KubeOn: each step shows the console steps and the read-only access it needs.
Highlights
Built for how AWS bills
Split cost allocation data
Per-pod costs from AWS where available, with measured usage laid over them.
Savings Plans and reservations
Net amortized cost, including EDP and bundled discounts, credits and refunds.
Karpenter-aware proposals
Node sizing proposals as Karpenter NodePool snippets or managed node group steps.
Data transfer by namespace
NAT gateway, cross-AZ and Transit Gateway cost mapped to namespaces with VPC flow logs.
AWS Organizations
One payer export covers every linked account, scoped to the accounts that run Kubernetes.
Spot and Savings Plans
A Spot planner for your workloads, plus what you bought, when it ends and where coverage has gaps.
FAQ
AWS questions
Other platforms
Let's get started
A 30-minute walkthrough on your own billing data, for your clouds, your clusters and your model providers.