Automation
Savings applied for you, within the limits you set
Start read-only. When you trust the numbers, let KubeOn ship the changes: as pull requests through your own repository, or applied directly by a separate controller, cluster by cluster and feature by feature.
Savings that nobody ships are not savings
Recommendations pile up:
A list of rightsizing findings competes with feature work, and most of it never reaches production.All or nothing:
Tools tend to ask for broad access to a cluster, which a platform team cannot grant on day one.No proof afterwards:
A change goes out, and nobody measures whether the bill went down.
Your choice, per cluster
Pull requests, or changes applied directly
Connect your repository and KubeOn opens pull requests on the files that deploy each workload. Dev and staging can merge by themselves when checks pass; production always waits for a person. Or grant write access, and KubeOn applies the change in the cluster.
- Argo CD and Flux workloads always go through their repository
- Team approval or Automatic, per cluster
- Production pull requests wait for a person to merge
Write access
Granted feature by feature, and never by KubeOn
A separate controller, with its own service account and token, holds only the permissions you chose. Every poll it asks the API server what it may do, tells KubeOn, and refuses anything else, whatever KubeOn asks. Features change only when the cluster's owner re-runs the CLI or Helm.
- Off by default, opt-in per cluster
- The read-only agent is unchanged
- Pause any cluster in KubeOn at any time
Safeguards
Every change passes the same checks first
Pull requests and direct changes pass the same safeguards, including change freezes and limits per cluster. Every check is recorded, so you can see why a change went out, or why it did not.
- Change freezes and change windows
- Staged cuts, with limits per cluster
- One switch pauses everything
Where the Kubernetes savings are
off the monthly bill: $21,842 a month found at our sample company
Sample company, not a customer result
Write access features
What each feature can do
You choose the features when you connect a cluster, with the kubeon CLI or Helm. Each one is its own ClusterRole, bound only to the controller.
| Feature | What KubeOn does | Permission granted |
|---|---|---|
| Workload rightsizing | Applies new container requests | Patch Deployments, StatefulSets and DaemonSets |
| Node pools and Spot fallback | Changes instance families, Spot with on-demand fallback, and managed node pool sizes | Patch Karpenter NodePools, plus a separate cloud automation role |
| Node autoscaler | Adds nodes for pending pods; drains and removes underused ones. Not with Karpenter or cluster-autoscaler | Read pods and nodes, cordon and evict, plus the cloud automation role |
| Container live migration | Checkpoints containers and restores them on another node. CRI-O or containerd 2 | Checkpoint through the kubelet; create and remove pods in the namespaces you list |
The cloud automation role is separate from the billing role. PodDisruptionBudgets are respected when draining nodes.
Automation you stay in charge of
Pull requests
On the files that deploy each workload, found through GitOps.
Write access by feature
One ClusterRole per feature, bound only to the controller.
Node autoscaler
Adds nodes for pending pods and removes underused ones.
Spot with fallback
Spot first, on-demand when capacity runs out.
Live migration
Move containers to another node by checkpoint and restore.
Measured results
Savings measured from real cost, not copied from the estimate.
Automation: your questions answered
KubeOn
Keep exploring
Evaluate automation with your team
Bring your platform and FinOps priorities. We will walk through the data, controls and evidence for your evaluation.