Every signal.Every dollar.One agent.

Allocation you can reconcile.

OpenCost-compatible allocation by any dimension — namespace, workload, team, label — with idle and shared cost handled explicitly, per-resource cost for CPU, RAM, GPU and network, and a FinOps FOCUS export for the finance side of the house.

• Drop-in /allocation/compute — OpenCost and Kubecost API consumers keep working
• Idle and shared cost kept separate, or shared back weighted or evenly
• FOCUS 1.2 CSV export, forecasts, chargeback and an efficiency score

curl -s "$KUBEHERO/allocation/compute?window=7d&aggregate=namespace&shareIdle=true" \
  | jq '.data[0].checkout | {totalCost, cpuEfficiency, networkCost}'
{
  "totalCost": 4213.62,
  "cpuEfficiency": 0.41,
  "networkCost": 318.4
}

Honest limit — Allocation is an estimate reconciled to node prices — not your cloud invoice.

Loki’s query language. Your cluster’s storage.

A DaemonSet tails every container’s logs into ClickHouse. Query with LogQL — filters, json and logfmt parsers, metric queries — live-tail it, collapse a million lines into a handful of patterns, and see what each team’s log volume costs per month.

• LogQL: selectors, line filters, json/logfmt parsers, label filters, metric queries
• Drain pattern mining and live tail; log volume priced per team
• Loki push + query API — Grafana’s Loki datasource just works

sum by (namespace) (
  count_over_time({cluster="eks-use1-prod", level="error"} |= "timeout" [5m])
)

Flamegraphs with a price tag.

eBPF samples every CPU on every node — no code changes, no restarts. Scrape pprof endpoints with the annotations Pyroscope and Alloy already use, or push to a Pyroscope-compatible /ingest. Every function gets a monthly cost.

• Whole-node eBPF CPU profiling — nothing to instrument
• pprof scraping via profiles.grafana.com/* annotations; Pyroscope-compatible /ingest
• Diff flamegraphs and $/mo per function, from the workload’s real CPU spend

metadata:
  annotations:
    profiles.grafana.com/cpu.scrape: "true"
    profiles.grafana.com/cpu.port: "6060"
    profiles.grafana.com/memory.scrape: "true"

Honest limit — User-space stacks rely on frame pointers: great for Go, Rust and the JVM with -XX:+PreserveFramePointer.

See the bill for every edge.

cgroup eBPF programs account every byte between pods, services, nodes and the internet. A live service map shows who talks to whom — and which edges cross zones or leave the cloud, priced per GB, with TCP retransmits on every hop.

• Byte-level flow accounting per workload pair — no sidecars, no mesh
• Cross-zone and internet egress priced per GB, defaults per cloud, overridable
• TCP retransmits per edge from a stable kernel tracepoint

WORKLOAD            EGRESS   CROSS-ZONE    $/MO   TOP DESTINATION
retrieval-indexer   412 GB   1.9 TB      $1,682   storage.googleapis.com
checkout-api         38 GB   884 GB        $368   payments-worker
model-server-a100     6 GB   310 GB        $109   retrieval-indexer

Honest limit — eBPF needs Linux ≥ 5.8 with cgroup v2 — the default on current AKS (Ubuntu 22.04+, Azure Linux), GKE (COS) and EKS (AL2023, Bottlerocket) node images.

Recommendations that actually apply.

Percentile recommendations from measured container usage — p95 CPU plus headroom, memory never below the observed max. The operator applies them only through a RightsizingPolicy a human arms: bounded steps, OOM-aware, rollout-aware, reversible.

• p50 / p95 / p99 / max per container, confidence from sample coverage
• recommend → shadow → apply — humans arm, the operator executes
• Bounded steps, OOM guard, skips mid-rollout; kubehero undo restores

apiVersion: kubehero.kubehero.io/v1
kind: RightsizingPolicy
metadata:
  name: payments-rightsize
spec:
  scope:
    namespaceSelector:
      matchLabels: { team: payments }
  mode: apply            # recommend | shadow | apply — inert until armed
  safety:
    p95HeadroomPct: 15
    observationWindow: 7d
    maxChangePerDay: 1

One rule engine for every signal.

Alert on LogQL metrics, spend rate, budget burn, anomalies, network cost and cluster events — OOM kills, crash loops, unschedulable pods — and route to the tools your on-call already lives in. Silences and re-notification included.

• Six rule kinds, one grammar: logs · cost · budget · anomaly · network · event
• pending → firing → resolved, templated annotations, silences
• Slack · PagerDuty · Opsgenie · Teams · Discord · webhooks · Alertmanager

name: checkout-error-spike
kind: logs
query: sum by (namespace) (count_over_time({namespace="checkout", level="error"}[5m]))
op: ">"
threshold: 100
pendingFor: 5m
severity: critical
channels: ["slack://payments-oncall", "pagerduty://checkout"]

Ask why. Get evidence.

kubehero ask runs a read-only investigation across cost, logs, profiles, the network map and cluster events, then answers with cited evidence and guarded proposals. The same tools are exposed over MCP, so Claude can query your clusters too.

• A read-only tool loop over every signal; every fact cites its query
• kubehero mcp — an MCP server for Claude and other agents
• Bring your own Anthropic key, or deterministic rules and nothing leaves

$ kubehero ask "why did checkout-api spend jump last night?"
  ↳ get_cost_allocation  checkout · 24h          +31%
  ↳ get_log_patterns     payments-client         retry storm ×14.2k
  ↳ get_top_functions    checkout-api            http.(*Client).Do  $1.9k/mo
answer   spend +31% ($4.2k/mo): a retry storm in payments-client
proposal RightsizingPolicy + alert rule — inert until you arm it