Governance
Budgets that warn before the month closes
Set budgets on allocated Kubernetes cost or on the cloud bill, by team, namespace, cluster or account. KubeOn forecasts each one from its 7-day run rate and tells the owner as soon as it is heading over.
Budgets and forecasts
A forecast on every budget, updated every hour
Budgets are monthly, quarterly or yearly, scoped by cluster, namespace, environment, account, team, service or region. The forecast is spend so far plus the last 7 days' run rate for the days left. Thresholds at 50, 80 and 100% notify once per period, and so does a forecast overrun.
- Kubernetes allocation or the cloud bill as the source
- States: OK, Warning, Forecast over, Over budget
- Six periods of history on every budget
Alert rules
Rules on spend, growth, efficiency and agent health
Five rule types: spend above a limit, spend increase against the previous window, efficiency below a target, new anomalies above a severity, and an agent that stopped reporting. Rules notify when they fire, again when new items match, and when they resolve.
- Checked hourly
- Test a rule before saving it
- Recent activity shows every delivery
Anomaly detection
Spikes measured against the last two weeks, not a guess
Each day of spend per cluster, namespace, service and account is compared with the median of the prior 14 days. A spike needs to be at least $50 and 30% above that median, and at least 3 times the typical variation. Spikes erased by revised billing are withdrawn.
- Severity from the size of the jump
- Dismiss and reopen, with history
- Explain with AI from the anomaly itself
Notification channels
Slack, Microsoft Teams, email and webhooks
Teams messages use Adaptive Cards, Slack uses incoming webhooks, email goes over SMTP to up to 50 recipients, and webhooks receive a JSON body you can route to PagerDuty, Opsgenie or ServiceNow. Targets are encrypted at rest and only HTTPS endpoints on public addresses are accepted.
- Per-channel delivery status and last error
- Private, link-local and metadata addresses refused
- Redirects never followed
{ "source": "kubeon", "title": "Budget forecast over: Payments platform", "summary": "Forecast $52,202.50 against a $48,000.00 monthly budget (108.8%).", "severity": "warning", "facts": { "spent": "$15,142.40", "forecast": "$52,202.50", "days_with_data": "9/31" }, "link": "https://acme.kubeon.io/govern/budgets?budget=payments-platform", "sent_at": "2026-10-10T09:50:12Z"}Where the Kubernetes savings are
off the monthly bill: $21,842 a month found at our sample company
Sample company, not a customer result
The anomaly rule
How a spike is scored
| Step | Rule |
|---|---|
| Baseline | Median of the prior 14 days; at least 7 days of history required |
| Delta | The day's spend minus the baseline, at least $50 and at least 30% of the baseline |
| Score | Delta divided by the larger of 1.4826 x MAD, 5% of the median, or $1; must be 3 or more |
| Severity | High at +100% and 5x the minimum delta, medium at +50%, low otherwise |
| Revisions | The last 3 days are re-scored each run; a spike removed by revised billing is withdrawn |
The rule is statistical and explainable: every anomaly shows its spend, expected value, increase and score.
Governance that reaches the people who can act
Monthly, quarterly, yearly
Budgets on any period with threshold history.
Run-rate forecasts
Spend to date plus the 7-day run rate for the rest of the period.
Median-based anomaly scoring
Median and MAD, so one noisy day does not trigger an alert.
Hourly evaluation
Budgets, rules and anomalies are checked every hour.
Slack and Teams
Messages with the numbers and a link back to the view.
SMTP with STARTTLS to up to 50 recipients per channel.
Webhooks
JSON payloads for on-call and ticketing tools.
Agent health alerts
Know within 3 hours when a cluster stops reporting.
Governance: your questions answered
KubeOn
Keep exploring
Evaluate governance with your team
Bring your platform and FinOps priorities. We will walk through the data, controls and evidence for your evaluation.