Azure AKS
AKS costs allocated from your Azure exports
KubeOn reads amortized cost from your Cost Management exports, splits each AKS node pool across the pods that ran on it, and shows the rest of your Azure bill next to it.
What KubeOn reads
What KubeOn needs on Azure
Your Azure account
Cost Management exportIn your storage account- KubeOn managed identityRead-only
AKS and other clustersThe agent sends a snapshot every hour
KubeOn hub
Fully managed by UnitVane
- 1Read the billing data
- 2Join it with each snapshot
- 3Allocate every node's cost
- 4Reconcile to the bill
What you get
- Cost per team and labelPods, namespaces and teams
- Each cluster reconciledTo its own bill
- Savings to act onAs pull requests, or applied by KubeOn
Billing
A daily Cost Management export of amortized cost or FOCUS data to a storage account you own.
Access
A managed identity with Storage Blob Data Reader on the export and Cost Management Reader on the scope.
Agent identity
A cluster token from KubeOn. No workload identity or storage account: snapshots go to your organization in KubeOn and nowhere else.
Setup
Three steps to the first allocation
Cluster inventory appears within the first hour. Allocated costs follow as soon as billing data is in.
01
Export cost data
Create a daily amortized cost export and give KubeOn's identity read access.Azure CLI# 1. Export amortized cost (FOCUS) daily to a storage accountaz costmanagement export create \ --name kubeon-daily \ --scope "/subscriptions/00000000-0000-0000-0000-000000000000" \ --storage-account-id "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/finops/providers/Microsoft.Storage/storageAccounts/acmecostexports" \ --storage-container cost-exports \ --storage-directory kubeon \ --timeframe MonthToDate \ --type AmortizedCost \ --recurrence Daily \ --recurrence-period from="2026-10-01T00:00:00" to="2027-10-01T00:00:00"# 2. Let the KubeOn identity read the export and cost dataaz role assignment create \ --assignee "<kubeon-managed-identity-client-id>" \ --role "Storage Blob Data Reader" \ --scope "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/finops/providers/Microsoft.Storage/storageAccounts/acmecostexports"az role assignment create \ --assignee "<kubeon-managed-identity-client-id>" \ --role "Cost Management Reader" \ --scope "/subscriptions/00000000-0000-0000-0000-000000000000"02
Install the agent
Install one release per AKS cluster from KubeOn's OCI registry.Helmhelm upgrade --install kubeon-agent oci://registry.kubeon.io/kubeon/charts/kubeon-agent \ --version 0.6.0 \ --namespace kubeon --create-namespace \ -f kubeon-agent.yaml03
Name the cluster
Set the cluster's name and its token Secret. There is no storage to configure.kubeon-agent.yaml# kubeon-agent.yaml (AKS)clusterName: aks-prod-weukubeon: existingSecret: kubeon-agent-tokenprometheusUrl: http://prometheus-server.monitoring.svc:9090 # optional
Connecting the bill in KubeOn: each step shows the console steps and the read-only access it needs.
Highlights
Built for how Azure bills
Reservations and savings plans
Amortized cost, so commitments are spread over the hours they cover.
Node pool sizing
Smaller VM sizes or a different series, priced against your billed rates.
Azure tags and Kubernetes labels
Resource tags and pod labels resolve to the same owner keys.
One token per cluster
Revocable in KubeOn; no Azure credentials in the cluster.
Subscriptions and management groups
Exports at any scope, combined in one view.
Spot and reservations
A Spot planner for your workloads, plus what you bought, when it ends and where coverage has gaps.
FAQ
Azure questions
Other platforms
Let's get started
A 30-minute walkthrough on your own billing data, for your clouds, your clusters and your model providers.