Start with the problem you have

UnitVane covers every bill: AWS, Azure, Google Cloud, Oracle Cloud, Kubernetes, AI and SaaS spend in FOCUS, allocated to your business units and teams, with budgets, anomalies, verified savings and a built-in BI studio. KubeOn goes inside clusters with a read-only agent, pod-level allocation, change proposals, optional write access and the GPU optimizer. UnitVane AI covers model spend with cost per 1M tokens and a managed LLM gateway. Start with one and add the others; they can be quoted on one agreement.

UnitVane is SaaS only. We run all three products, including upgrades, backups and monitoring. You grant read access to billing exports, install the read-only agent in clusters you want UnitVane to cover, and point apps at the managed gateway if you use UnitVane AI. There is no self-hosted edition.

The agent's ClusterRole grants get, list and watch on nodes, pods, namespaces, workloads, volumes, services, quotas and storage classes, plus read access to metrics.k8s.io. It never reads Secrets or ConfigMaps and has no write verbs. It runs as an hourly CronJob with no Service, no Ingress and no inbound port.

Only if you turn it on. By default KubeOn reads, and each saving is a change proposal your pipeline ships. You can also grant a separate controller write access, cluster by cluster and feature by feature, for rightsizing, node pools and Spot fallback, node autoscaling and live migration. Billing exports are never changed. UnitVane AI buys or renews reservations only on pools whose policy you set to do so, and every purchase waits for a named approver.