opencost

Helm chart

Last changed

Request a free trial

Contact our team to test out this Helm chart and related images for free. Please also indicate any other images you would like to evaluate.

Tag:

Compare:

# -- Overwrite the default name of the chart

nameOverride: ""

# -- Overwrite all resources name created by the chart

fullnameOverride: ""

# -- Override the deployment namespace

namespaceOverride: ""

# -- Override the default name of cluster - Can be found in /etc/kubernetes/admin.conf: clusters -> cluster -> name

clusterName: "cluster.local"

loglevel: info

plugins:

enabled: false

install:

enabled: true

fullImageName: curlimages/curl:latest

securityContext:

allowPrivilegeEscalation: false

seccompProfile:

type: RuntimeDefault

capabilities:

drop:

- ALL

readOnlyRootFilesystem: true

runAsNonRoot: true

runAsUser: 1000

# -- List of plugins to download, independent of `plugins.configs`.

# When specified, these plugins are downloaded regardless of what's in configs,

# which enables using `plugins.existingSecret` for credentials while still

# downloading plugin binaries. This list also drives which `<plugin>_config.json`

# subPaths the Deployment mounts, so each listed plugin MUST have a matching

# config source -- either a `plugins.configs.<plugin>` entry (when

# `plugins.existingSecret` is empty) or a `<plugin>_config.json` key in the

# Secret referenced by `plugins.existingSecret`. Missing entries cause Pod

# startup failures because the mounted subPath will not exist. When

# `plugins.existingSecret` is empty, the chart validates this at

# template-render time and fails with an actionable error; the check is

# skipped when `plugins.existingSecret` is set because the contents of an

# externally-managed Secret cannot be introspected from Helm.

# Example: ["datadog", "mongodb"].

# If empty, falls back to downloading plugins based on keys in configs (legacy behavior).

plugins: []

folder: /opt/opencost/plugin

# leave this commented to always download most recent version of plugins

# version: <INSERT_SPECIFIC_PLUGINS_VERSION>

# -- Use an existing Secret for plugin configuration instead of generating

# one from `plugins.configs`. The referenced Secret MUST contain a

# `<plugin>_config.json` key for every entry in `plugins.install.plugins`

# (and for every plugin whose configs key would otherwise drive the

# install/mount list) -- the Deployment mounts those files via subPath and

# missing keys cause Pod startup failures. This is useful when using

# ExternalSecrets, Vault, or other secret-management tools so that plugin

# credentials do not have to be committed via `plugins.configs`. Mutually

# exclusive with `plugins.configs`: when `existingSecret` is set, the chart

# does not render a generated Secret and any `plugins.configs` entries would

# be silently ignored, so the chart will `fail` template rendering in that

# case.

existingSecret: ""

configs:

# datadog: |

# {

# "datadog_site": "<INSERT_DATADOG_SITE>",

# "datadog_api_key": "<INSERT_DATADOG_API_KEY>",

# "datadog_app_key": "<INSERT_DATADOG_APP_KEY>"

# }

# -- List of secret names to use for pulling the images

imagePullSecrets: []

serviceAccount:

# -- Specifies whether a service account should be created

create: true

# -- Annotations to add to the service account

annotations: {}

# eks.amazonaws.com/role-arn: arn:aws:iam::123456789012:role/eksctl-opencost

# The name of the service account to use.

# If not set and create is true, a name is generated using the fullname template

name: ""

# -- Whether pods running as this service account should have an API token automatically mounted

automountServiceAccountToken: true

# NetworkPolicies for ingress

networkPolicies:

# -- Specifies whether networkpolicies should be created

enabled: false

# -- Internal Prometheus settings related to NetworkPolicies

prometheus:

# -- Namespace where internal Prometheus is installed

namespace: prometheus-system

# -- Pod port of in-cluster Prometheus

port: 9090

# -- Labels applied to the Prometheus server pod(s)

labels:

app.kubernetes.io/name: prometheus

# -- Extra egress rule

extraEgress: []

# -- Strategy to be used for the Deployment

updateStrategy:

rollingUpdate:

maxSurge: 1

maxUnavailable: 1

type: RollingUpdate

# -- Annotations to add to the all the resources

annotations: {}

100

# -- Annotations to add to the OpenCost Pod

101

podAnnotations: {}

102

# -- Annotations to add to the Secret

103

secretAnnotations: {}

104

# -- Labels to add to the OpenCost Pod

105

podLabels: {}

106

# -- Pod priority

107

priorityClassName: ~

108

# -- Enable automounting of service account token at the pod level

109

podAutomountServiceAccountToken: true

110

# -- Holds pod-level security attributes and common container settings

111

podSecurityContext: {}

112

# fsGroup: 2000

113

114

service:

115

enabled: true

116

# -- Annotations to add to the service

117

annotations: {}

118

# -- Labels to add to the service account

119

labels: {}

120

# -- Kubernetes Service type

121

type: ClusterIP

122

# -- NodePort if service type is NodePort

123

nodePort: {}

124

# -- extra ports. Useful for sidecar pods such as oauth-proxy

125

extraPorts: []

126

# - name: oauth-proxy

127

# port: 8081

128

# targetPort: 8081

129

# - name: oauth-metrics

130

# port: 8082

131

# targetPort: 8082

132

# -- LoadBalancer Source IP CIDR if service type is LoadBalancer and cloud provider supports this

133

loadBalancerSourceRanges: []

134

# Create cluster role policies

135

rbac:

136

enabled: true

137

# PodDisruptionBudget for high availability

138

pdb:

139

enabled: false

140

# -- Minimum number of pods that must be available after the eviction

141

minAvailable: ~

142

# -- Maximum number of pods that can be unavailable after the eviction

143

maxUnavailable: ~

144

opencost:

145

# -- Existing Secret containing `cloud-integration.json` for Cloud Costs. See

146

# https://www.opencost.io/docs/configuration/#cloud-costs.

147

# Create with: `kubectl create secret generic <SECRET_NAME> --from-file=cloud-integration.json -n opencost`.

148

# Mutually exclusive with `opencost.cloudIntegrationJSON`.

149

cloudIntegrationSecret: ""

150

# -- Raw JSON for `cloud-integration.json`. Creates a Secret named

151

# `<fullname>-cloud-integration` in the release namespace.

152

# Mutually exclusive with `opencost.cloudIntegrationSecret`.

153

cloudIntegrationJSON: ""

154

# cloudIntegrationJSON: |-

155

# {

156

# "aws": [

157

# {

158

# "athenaBucketName": "s3://AWS_cloud_integration_athenaBucketName",

159

# "athenaRegion": "AWS_cloud_integration_athenaRegion",

160

# "athenaDatabase": "AWS_cloud_integration_athenaDatabase",

161

# "athenaTable": "AWS_cloud_integration_athenaTable",

162

# "projectID": "AWS_cloud_integration_athena_projectID",

163

# "serviceKeyName": "AWS_cloud_integration_athena_serviceKeyName",

164

# "serviceKeySecret": "AWS_cloud_integration_athena_serviceKeySecret"

165

# }

166

# ],

167

# "azure": [

168

# {

169

# "azureSubscriptionID": "my-subscription-id",

170

# "azureStorageAccount": "my-storage-account",

171

# "azureStorageAccessKey": "my-storage-access-key",

172

# "azureStorageContainer": "my-storage-container"

173

# }

174

# ],

175

# "gcp": [

176

# {

177

# "projectID": "my-project-id",

178

# "billingDataDataset": "detailedbilling.my-billing-dataset",

179

# "key": {

180

# "type": "service_account",

181

# "project_id": "my-project-id",

182

# "private_key_id": "my-private-key-id",

183

# "private_key": "my-pem-encoded-private-key",

184

# "client_email": "my-service-account-name@my-project-id.iam.gserviceaccount.com",

185

# "client_id": "my-client-id",

186

# "auth_uri": "auth-uri",

187

# "token_uri": "token-uri",

188

# "auth_provider_x509_cert_url": "my-x509-provider-cert",

189

# "client_x509_cert_url": "my-x509-cert-url"

190

# }

191

# }

192

# ],

193

# "oci": {

194

# "usageApi": [

195

# {

196

# "tenancyID": "ocid1.tenancy.oc1..my-tenancy-ocid",

197

# "region": "us-ashburn-1",

198

# "authorizer": {

199

# "authorizerType": "OCIRawConfigProvider",

200

# "tenancyID": "ocid1.tenancy.oc1..my-tenancy-ocid",

201

# "userID": "ocid1.user.oc1..my-user-ocid",

202

# "region": "us-ashburn-1",

203

# "fingerprint": "xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx",

204

# "privateKey": "REPLACE_WITH_YOUR_OCI_KEY_FILE_CONTENTS"

205

# }

206

# }

207

# ]

208

# }

209

# }

210

211

# -- MCP (Model Context Protocol) Server Configuration

212

# The MCP server provides AI agents with access to cost allocation and asset data

213

mcp:

214

# -- Enable MCP server for AI agent integration (default: true)

215

# Set to false to disable MCP server completely

216

enabled: true

217

# -- HTTP port for MCP server (default: 8081)

218

# Change this if port 8081 conflicts with other services

219

port: 8081

220

ingress:

221

# -- Ingress for MCP server

222

enabled: false

223

# -- Ingress controller which implements the resource

224

ingressClassName: ""

225

# -- Annotations for Ingress resource

226

annotations: {}

227

# kubernetes.io/tls-acme: "true"

228

# -- A list of host rules used to configure the Ingress

229

# @default -- See [values.yaml](values.yaml)

230

hosts:

231

- host: example.local

232

paths:

233

- path: /

234

pathType: Prefix

235

# -- Ingress TLS configuration

236

tls: []

237

# - secretName: chart-example-tls

238

# hosts:

239

# - chart-example.local

240

# -- HTTPRoute for MCP server (Gateway API)

241

httpRoute:

242

# -- Enable HTTPRoute resource

243

enabled: false

244

# -- Gateway API parent references

245

# @default -- See [values.yaml](values.yaml)

246

parentRefs:

247

- name: ""

248

namespace: ""

249

sectionName: ""

250

# -- Hostnames for the HTTPRoute

251

hostnames: []

252

# - mcp.example.local

253

# -- Annotations for HTTPRoute resource

254

annotations: {}

255

# -- Labels for HTTPRoute resource

256

labels: {}

257

# -- HTTPRoute rules. Each rule supports an optional `filters` list at the rule level

258

# and per-backendRef `filters` for Gateway API filter configuration (e.g. basic auth

259

# via `ExtensionRef`, header modification via `RequestHeaderModifier`, etc.).

260

# @default -- See [values.yaml](values.yaml)

261

rules:

262

- matches:

263

- path:

264

type: PathPrefix

265

value: /

266

# filters:

267

# - type: ExtensionRef

268

# extensionRef:

269

# group: gateway.envoyproxy.io

270

# kind: SecurityPolicy

271

# name: basic-auth-policy

272

backendRefs:

273

- name: "" # Will default to service name

274

port: 8081

275

# filters:

276

# - type: RequestHeaderModifier

277

# requestHeaderModifier:

278

# add:

279

# - name: X-Custom-Header

280

# value: my-value

281

exporter:

282

# API_PORT for the cost-model to listen on

283

apiPort: 9003

284

# debugPort: 40000 # for development purposes (debugging with delve) and not for production.

285

# -- The GCP Pricing API requires a key. This is supplied just for evaluation.

286

cloudProviderApiKey: ""

287

# -- Default cluster ID to use if cluster_id is not set in Prometheus metrics.

288

defaultClusterId: 'default-cluster'

289

# -- If clusterIdConfigmap is defined, use user-generated ConfigMap with key CLUSTER_ID as default cluster ID.

290

# -- This overrides the above defaultClusterId. Ensure the ConfigMap exists and contains the required CLUSTER_ID key.

291

# clusterIdConfigmap: cluster-id-configmap

292

image:

293

# -- Exporter container image registry

294

registry: cgr.dev

295

# -- Exporter container image name

296

repository: scratch-images/test-tmp/opencost

297

# -- Exporter container image tag

298

tag: 1.121.1-r5@sha256:80d7980a74aa14fd1b77382bf3255e658bd944ceb14fbc3de03d7f01271d2a2e

299

# -- Exporter container image pull policy

300

pullPolicy: IfNotPresent

301

# -- Override the full image name for development purposes

302

fullImageName: null

303

# -- List of extra arguments for the command, e.g.: log-format=json

304

extraArgs: []

305

# -- Optional command to override the default container command

306

command: []

307

# -- Number of OpenCost replicas to run

308

replicas: 1

309

resources:

310

# -- CPU/Memory resource requests

311

requests:

312

cpu: '10m'

313

memory: '55Mi'

314

# -- CPU/Memory resource limits

315

limits:

316

memory: '1Gi'

317

# Startup probe configuration

318

startupProbe:

319

# -- Whether probe is enabled

320

enabled: true

321

# -- Probe path

322

path: /healthz

323

# -- Number of seconds before probe is initiated

324

initialDelaySeconds: 10

325

# -- Probe frequency in seconds

326

periodSeconds: 5

327

# -- Number of failures for probe to be considered failed

328

failureThreshold: 30

329

# -- Number of seconds after which the probe times out

330

timeoutSeconds: 1

331

# Liveness probe configuration

332

livenessProbe:

333

# -- Whether probe is enabled

334

enabled: true

335

# -- Probe path

336

path: /healthz

337

# -- Number of seconds before probe is initiated

338

initialDelaySeconds: 10

339

# -- Probe frequency in seconds

340

periodSeconds: 20

341

# -- Number of failures for probe to be considered failed

342

failureThreshold: 3

343

# -- Number of seconds after which the probe times out

344

timeoutSeconds: 1

345

# Readiness probe configuration

346

readinessProbe:

347

# -- Whether probe is enabled

348

enabled: true

349

# -- Probe path

350

path: /healthz

351

# -- Number of seconds before probe is initiated

352

initialDelaySeconds: 10

353

# -- Probe frequency in seconds

354

periodSeconds: 10

355

# -- Number of failures for probe to be considered failed

356

failureThreshold: 3

357

# -- Number of seconds after which the probe times out

358

timeoutSeconds: 1

359

# -- Minimum consecutive successes for the probe to be considered successful after having failed

360

successThreshold: 1

361

# -- The security options the container should be run with

362

securityContext: {}

363

# capabilities:

364

# drop:

365

# - ALL

366

# readOnlyRootFilesystem: true

367

# runAsNonRoot: true

368

# runAsUser: 1000

369

370

# Path of CSV file

371

csv_path: ""

372

prometheusDataSource:

373

# Set the resolution in second that prometheus queries will be performed at

374

queryResolutionSeconds: 300

375

# Collector DataSource collects cluster data without a dependency on Prometheus

376

# It is recommended that persistence is enabled alongside it to preserve the state

377

# between pod restarts

378

collectorDataSource:

379

enabled: false

380

# -- define the interval at which the collector scrapes for data points (10s, 15s, 1m)

381

scrapeInterval: 30s

382

# -- The port at which network pods are open to egress

383

networkPort: 3001

384

# -- The number of 10m intervals the Collector DataSource should maintain

385

retention10m: 36

386

# -- The number of 1h intervals the Collector DataSource should maintain

387

retention1h: 49

388

# -- The number of 1d intervals the Collector DataSource should maintain

389

retention1d: 15

390

# Persistent volume claim for storing the data. eg: csv file

391

persistence:

392

enabled: false

393

# -- The path that the PV will be mounted to the exporter at

394

mountPath: /mnt/export

395

# -- Annotations for persistent volume

396

annotations: {}

397

# -- Access mode for persistent volume

398

accessMode: ""

399

# -- Storage class for persistent volume

400

storageClass: ""

401

# -- Size for persistent volume

402

size: ""

403

# Inference cost tracking configuration for LLM workloads (e.g., vLLM via llm-d)

404

inferenceCostTracking:

405

# -- Enable inference cost tracking

406

enabled: false

407

# -- Pod label whose value is the vLLM model name. Must match the model_name label on vLLM Prometheus metrics

408

modelLabel: "llm-d.ai/model"

409

# -- Pod label key identifying shared infra pods (EPP, gateway)

410

sharedInfraLabel: "llm-d.ai/inference-shared"

411

# -- Label value that marks a pod as shared infra

412

sharedInfraLabelValue: "true"

413

# -- Background collection interval

414

collectionInterval: "2m"

415

aws:

416

# -- AWS secret access key

417

secret_access_key: ""

418

# -- AWS secret key id

419

access_key_id: ""

420

# -- A list of volume mounts to be added to the pod

421

extraVolumeMounts: []

422

# -- List of additional environment variables to set in the container

423

env: []

424

# -- Any extra environment variables you would like to pass on to the pod

425

extraEnv: {}

426

# FOO: BAR

427

# For example, if accessing mimir directly and getting 401 Unauthorized

428

# PROMETHEUS_HEADER_X_SCOPE_ORGID: anonymous

429

# -- Extra environment variables from secrets or configmaps

430

extraEnvFrom: []

431

# - configMapRef:

432

# name: opencost-env

433

# - secretRef:

434

# name: opencost-env-secret

435

# Admin token for write operations (e.g. POST /serviceKey, cloud config endpoints).

436

# Set ADMIN_TOKEN env from a chart-created secret or an existing secret.

437

adminToken:

438

# -- When true, the chart creates the admin-token Secret (if value is set) or mounts existingSecret as ADMIN_TOKEN. When false, ADMIN_TOKEN is not set and no secret is deployed.

439

enabled: false

440

# -- If set, the chart creates a Secret with this value and sets ADMIN_TOKEN from it (not recommended for production; use existingSecret instead).

441

value: ""

442

# -- Use an existing Secret for the admin token (recommended). Secret must contain the key below.

443

existingSecret: ""

444

# -- Key in the Secret that holds the admin token (used for both value-created and existing secrets).

445

secretKey: "ADMIN_TOKEN"

446

apiIngress:

447

# -- Ingress for OpenCost API

448

enabled: false

449

# -- Ingress controller which implements the resource

450

ingressClassName: ""

451

# -- Annotations for Ingress resource

452

annotations: {}

453

# kubernetes.io/tls-acme: "true"

454

# -- A list of host rules used to configure the Ingress

455

# @default -- See [values.yaml](values.yaml)

456

hosts:

457

- host: example.local

458

paths:

459

- path: /

460

pathType: Prefix

461

# -- Redirect ingress to an extraPort defined on the service such as oauth-proxy

462

servicePort: http

463

# servicePort: oauth-proxy

464

# -- Ingress TLS configuration

465

tls: []

466

# - secretName: chart-example-tls

467

# hosts:

468

# - chart-example.local

469

# -- HTTPRoute for OpenCost API (Gateway API)

470

apiHttpRoute:

471

# -- Enable HTTPRoute resource

472

enabled: false

473

# -- Gateway API parent references

474

# @default -- See [values.yaml](values.yaml)

475

parentRefs:

476

- name: ""

477

namespace: ""

478

sectionName: ""

479

# -- Hostnames for the HTTPRoute

480

hostnames: []

481

# - api.example.local

482

# -- Annotations for HTTPRoute resource

483

annotations: {}

484

# -- Labels for HTTPRoute resource

485

labels: {}

486

# -- HTTPRoute rules. Each rule supports an optional `filters` list at the rule level

487

# and per-backendRef `filters` for Gateway API filter configuration (e.g. basic auth

488

# via `ExtensionRef`, header modification via `RequestHeaderModifier`, etc.).

489

# @default -- See [values.yaml](values.yaml)

490

rules:

491

- matches:

492

- path:

493

type: PathPrefix

494

value: /

495

# filters:

496

# - type: ExtensionRef

497

# extensionRef:

498

# group: gateway.envoyproxy.io

499

# kind: SecurityPolicy

500

# name: basic-auth-policy

501

backendRefs:

502

- name: "" # Will default to service name

503

port: 9003

504

# filters:

505

# - type: RequestHeaderModifier

506

# requestHeaderModifier:

507

# add:

508

# - name: X-Custom-Header

509

# value: my-value

510

customPricing:

511

# -- Enables custom pricing configuration

512

enabled: false

513

# -- Customize the configmap name used for custom pricing

514

configmapName: custom-pricing-model

515

# -- Path for the pricing configuration.

516

configPath: /tmp/custom-config

517

# -- Configures the pricing model provided in the values file.

518

createConfigmap: true

519

# -- Sets the provider type for the custom pricing file.

520

provider: custom

521

# -- More information about these values here: https://www.opencost.io/docs/configuration/on-prem#custom-pricing-using-the-opencost-helm-chart

522

costModel:

523

description: Modified pricing configuration.

524

CPU: 1.25

525

spotCPU: 0.006655

526

RAM: 0.50

527

spotRAM: 0.000892

528

GPU: 0.95

529

storage: 0.25

530

zoneNetworkEgress: 0.01

531

regionNetworkEgress: 0.01

532

internetNetworkEgress: 0.12

533

retention1d: 15

534

retention1h: 49

535

carbonCost:

536

# -- Enable carbon cost exposed in the API

537

enabled: false

538

cloudCost:

539

# -- Enable cloud cost ingestion and querying, dependant on valid integration credentials

540

enabled: false

541

# -- Number of hours between each run of the Cloud Cost pipeline

542

refreshRateHours: 6

543

# -- Number of days into the past that a Cloud Cost standard run will query for

544

runWindowDays: 3

545

# -- The number of standard runs before a Month-to-Date run occurs

546

monthToDateInterval: 6

547

# -- The max number of days that any single query will be made to construct Cloud Costs

548

queryWindowDays: 7

549

metrics:

550

kubeStateMetrics:

551

# -- (bool) Enable emission of pod annotations

552

emitPodAnnotations: ~

553

# -- (bool) Enable emission of namespace annotations

554

emitNamespaceAnnotations: ~

555

# -- (bool) Enable emission of KSM v1 metrics

556

emitKsmV1Metrics: ~

557

# -- (bool) Enable only emission of KSM v1 metrics that do not exist in KSM 2 by default

558

emitKsmV1MetricsOnly: ~

559

serviceMonitor:

560

# -- Create ServiceMonitor resource for scraping metrics using PrometheusOperator

561

enabled: false

562

# -- Additional labels to add to the ServiceMonitor

563

additionalLabels: {}

564

# -- Specify if the ServiceMonitor will be deployed into a different namespace (blank deploys into same namespace as chart)

565

namespace: ""

566

# -- Interval at which metrics should be scraped

567

scrapeInterval: 30s

568

# -- Timeout after which the scrape is ended

569

scrapeTimeout: 10s

570

# -- HonorLabels chooses the metric's labels on collisions with target labels

571

honorLabels: true

572

# -- RelabelConfigs to apply to samples before scraping. Prometheus Operator automatically adds relabelings for a few standard Kubernetes fields

573

relabelings: []

574

# -- MetricRelabelConfigs to apply to samples before ingestion

575

metricRelabelings: []

576

# -- extra Endpoints to add to the ServiceMonitor. Useful for scraping sidecars

577

extraEndpoints: []

578

# - port: oauth-metrics

579

# path: /metrics

580

# -- HTTP scheme used for scraping. Defaults to `http`

581

scheme: http

582

# -- TLS configuration for scraping metrics

583

tlsConfig: {}

584

# caFile: /etc/prom-certs/root-cert.pem

585

# certFile: /etc/prom-certs/cert-chain.pem

586

# insecureSkipVerify: true

587

# keyFile: /etc/prom-certs/key.pem

588

config:

589

# -- Enables creating the metrics.json configuration as a ConfigMap

590

enabled: false

591

# -- Customize the configmap name used for metrics

592

configmapName: custom-metrics

593

# -- List of metrics to be disabled

594

disabledMetrics: []

595

# - <metric-to-be-disabled>

596

# - <metric-to-be-disabled>

597

prometheus:

598

# -- Secret name that contains credentials for Prometheus

599

secret_name: ~

600

# -- Existing secret name that contains credentials for Prometheus

601

existingSecretName: ~

602

# -- Prometheus Basic auth username

603

username: ""

604

# -- Key in the secret that references the username

605

username_key: DB_BASIC_AUTH_USERNAME

606

# -- Prometheus Basic auth password

607

password: ""

608

# -- Key in the secret that references the password

609

password_key: DB_BASIC_AUTH_PW

610

# -- Prometheus Bearer token

611

bearer_token: ""

612

bearer_token_key: DB_BEARER_TOKEN

613

# -- If true, opencost will use kube-rbac-proxy to authenticate with in cluster Prometheus for openshift

614

kubeRBACProxy: false

615

# -- Whether to disable SSL certificate verification

616

insecureSkipVerify: false

617

external:

618

# -- Use external Prometheus (eg. Grafana Cloud)

619

enabled: false

620

# -- External Prometheus url

621

url: "https://prometheus.example.com/prometheus"

622

internal:

623

# -- Use in-cluster Prometheus

624

enabled: true

625

# -- Service name of in-cluster Prometheus

626

serviceName: prometheus-server

627

# -- Namespace of in-cluster Prometheus

628

namespaceName: prometheus-system

629

# -- Service port of in-cluster Prometheus

630

port: 80

631

# -- Path to access the Prometheus API, this is neccesary if the Prometheus server is behind a reverse proxy(mimir) or has a different path.

632

path: ""

633

# -- Scheme to use for in-cluster Prometheus

634

scheme: http

635

amp:

636

# -- Use Amazon Managed Service for Prometheus (AMP)

637

enabled: false # If true, opencost will be configured to remote_write and query from Amazon Managed Service for Prometheus.

638

# -- Workspace ID for AMP

639

workspaceId: ""

640

thanos:

641

enabled: false

642

queryOffset: ''

643

maxSourceResolution: ''

644

internal:

645

enabled: true

646

serviceName: my-thanos-query

647

namespaceName: opencost

648

port: 10901

649

scheme: http

650

external:

651

enabled: false

652

url: 'https://thanos-query.example.com/thanos'

653

ui:

654

# -- Enable OpenCost UI

655

enabled: true

656

image:

657

# -- UI container image registry

658

registry: cgr.dev

659

# -- UI container image name

660

repository: scratch-images/test-tmp/opencost-ui

661

# -- UI container image tag

662

# @default -- `""` (use appVersion in Chart.yaml)

663

tag: 1.121.1-r2@sha256:72d81c4a4ded3b8a8b2dcfed88c1da8efef94fb815c890c7d0592264b6284d27

664

# -- UI container image pull policy

665

pullPolicy: IfNotPresent

666

# -- Override the full image name for development purposes

667

fullImageName: null

668

resources:

669

# -- CPU/Memory resource requests

670

requests:

671

cpu: '10m'

672

memory: '55Mi'

673

# -- CPU/Memory resource limits

674

limits:

675

memory: '1Gi'

676

# used in the default.nginx.conf if you want to switch for using with Docker

677

# apiServer: 0.0.0.0

678

uiPort: 9090

679

# Base path for serving the UI.

680

# Requires building a custom image using the build argument "ui_path".

681

uiPath: /

682

# Set to true to use IPv6

683

useIPv6: true

684

# Liveness probe configuration

685

livenessProbe:

686

# -- Whether probe is enabled

687

enabled: true

688

# -- Probe path

689

path: /healthz

690

# -- Number of seconds before probe is initiated

691

initialDelaySeconds: 30

692

# -- Probe frequency in seconds

693

periodSeconds: 10

694

# -- Number of failures for probe to be considered failed

695

failureThreshold: 3

696

# Readiness probe configuration

697

readinessProbe:

698

# -- Whether probe is enabled

699

enabled: true

700

# -- Probe path

701

path: /healthz

702

# -- Number of seconds before probe is initiated

703

initialDelaySeconds: 30

704

# -- Probe frequency in seconds

705

periodSeconds: 10

706

# -- Number of failures for probe to be considered failed

707

failureThreshold: 3

708

# -- The security options the container should be run with

709

securityContext: {}

710

# capabilities:

711

# drop:

712

# - ALL

713

# readOnlyRootFilesystem: true

714

# runAsNonRoot: true

715

# runAsUser: 1000

716

717

# -- A list of environment variables to be added to the pod

718

extraEnv: []

719

# -- A list of volume mounts to be added to the pod

720

extraVolumeMounts: []

721

# set to true to set upstream to use <service>.<namespace>.svc.cluster.local instead of just <service>.<namespace>

722

useDefaultFqdn: false

723

# -- Nginx proxy timeout settings (in seconds)

724

nginx:

725

# -- Timeout for establishing a connection with the proxied server

726

proxyConnectTimeout: 180

727

# -- Timeout for transmitting a request to the proxied server

728

proxySendTimeout: 180

729

# -- Timeout for reading a response from the proxied server

730

proxyReadTimeout: 180

731

# Set the model fqdn to use for the upstream

732

# modelFqdn: opencost.opencost.svc.cluster.local:9003

733

ingress:

734

# -- Ingress for OpenCost UI

735

enabled: false

736

# -- Ingress controller which implements the resource

737

ingressClassName: ""

738

# -- Annotations for Ingress resource

739

annotations: {}

740

# kubernetes.io/tls-acme: "true"

741

# -- A list of host rules used to configure the Ingress

742

# @default -- See [values.yaml](values.yaml)

743

hosts:

744

- host: example.local

745

paths:

746

- /

747

# -- Redirect ingress to an extraPort defined on the service such as oauth-proxy

748

servicePort: http-ui

749

# servicePort: oauth-proxy

750

# -- Ingress TLS configuration

751

tls: []

752

# - secretName: chart-example-tls

753

# hosts:

754

# - chart-example.local

755

route:

756

# -- OpenShift route for OpenCost UI

757

enabled: false

758

# -- Annotations for Ingress resource

759

annotations: {}

760

# haproxy.router.openshift.io/timeout: 1m

761

# @default -- See [values.yaml](values.yaml)

762

host: example.local

763

path:

764

# -- Redirect ingress to an extraPort defined on the service such as oauth-proxy

765

targetPort: http-ui

766

# targetPort: oauth-proxy

767

# -- Route TLS configuration as a map (e.g. with `termination` and `insecureEdgeTerminationPolicy` fields)

768

tls: {}

769

# insecureEdgeTerminationPolicy: Redirect

770

# termination: edge

771

# -- HTTPRoute for OpenCost UI (Gateway API)

772

httpRoute:

773

# -- Enable HTTPRoute resource

774

enabled: false

775

# -- Gateway API parent references

776

# @default -- See [values.yaml](values.yaml)

777

parentRefs:

778

- name: ""

779

namespace: ""

780

sectionName: ""

781

# -- Hostnames for the HTTPRoute

782

hostnames: []

783

# - example.local

784

# -- Annotations for HTTPRoute resource

785

annotations: {}

786

# -- Labels for HTTPRoute resource

787

labels: {}

788

# -- HTTPRoute rules. Each rule supports an optional `filters` list at the rule level

789

# and per-backendRef `filters` for Gateway API filter configuration (e.g. basic auth

790

# via `ExtensionRef`, header modification via `RequestHeaderModifier`, etc.).

791

# @default -- See [values.yaml](values.yaml)

792

rules:

793

- matches:

794

- path:

795

type: PathPrefix

796

value: /

797

# filters:

798

# - type: ExtensionRef

799

# extensionRef:

800

# group: gateway.envoyproxy.io

801

# kind: SecurityPolicy

802

# name: basic-auth-policy

803

backendRefs:

804

- name: "" # Will default to service name

805

port: 9090

806

# filters:

807

# - type: RequestHeaderModifier

808

# requestHeaderModifier:

809

# add:

810

# - name: X-Custom-Header

811

# value: my-value

812

sigV4Proxy:

813

image: public.ecr.aws/aws-observability/aws-sigv4-proxy:latest

814

imagePullPolicy: IfNotPresent

815

name: aps

816

port: 8005

817

region: us-west-2 # The AWS region

818

host: aps-workspaces.us-west-2.amazonaws.com # The hostname for AMP service.

819

# role_arn: arn:aws:iam::<account>:role/role-name # The AWS IAM role to assume.

820

extraEnv: # Pass extra env variables to sigV4Proxy

821

# - name: AWS_ACCESS_KEY_ID

822

# value: <access_key>

823

# - name: AWS_SECRET_ACCESS_KEY

824

# value: <secret_key>

825

resources: {}

826

# limits:

827

# cpu: 200m

828

# memory: 500Mi

829

# requests:

830

# cpu: 20m

831

# memory: 32Mi

832

securityContext: {}

833

# capabilities:

834

# drop:

835

# - ALL

836

# readOnlyRootFilesystem: true

837

# runAsNonRoot: true

838

# runAsUser: 65534

839

# -- Toleration labels for pod assignment

840

tolerations: []

841

# -- Node labels for pod assignment

842

nodeSelector: {}

843

# -- Affinity settings for pod assignment

844

affinity: {}

845

# -- Assign custom TopologySpreadConstraints rules

846

topologySpreadConstraints: []

847

# -- extra sidecars to add to the pod. Useful for things like oauth-proxy for the UI

848

extraContainers: []

849

# - name: oauth-proxy

850

# image: quay.io/oauth2-proxy/oauth2-proxy:v7.5.1

851

# args:

852

# - --upstream=http://127.0.0.1:9090

853

# - --http-address=0.0.0.0:8081

854

# - --metrics-address=0.0.0.0:8082

855

# - ...

856

# ports:

857

# - name: oauth-proxy

858

# containerPort: 8081

859

# protocol: TCP

860

# - name: oauth-metrics

861

# containerPort: 8082

862

# protocol: TCP

863

# resources: {}

864

865

updateCaTrust:

866

enabled: false

867

## Security context settings for the init container.

868

securityContext:

869

runAsUser: 0

870

runAsGroup: 0

871

runAsNonRoot: false

872

allowPrivilegeEscalation: false

873

readOnlyRootFilesystem: true

874

seccompProfile:

875

type: RuntimeDefault

876

caCertsSecret: ca-certs-secret # The name of the Secret containing custom CA certificates to mount to the opencost container.

877

# caCertsConfig: ca-certs-config # The name of the ConfigMap containing the CA trust configuration.

878

resources: {}

879

platforms:

880

openshift:

881

# -- Enable OpenShift specific configurations

882

enabled: false

883

# OPTIONAL. The following configs only to be enabled when using a Prometheus instance already installed in the cluster.

884

# -- If true, the helm chart will create a ClusterRoleBinding to grant the OpenCost ServiceAccount access to query Prometheus.

885

createMonitoringClusterRoleBinding: false

886

# -- If true, create a Role and RoleBinding to allow Prometheus to list and watch OpenCost resources.

887

createMonitoringResourceReaderRoleBinding: false

888

# -- Name of the Prometheus serviceaccount to bind to the Resource Reader Role Binding.

889

monitoringServiceAccountName: prometheus-k8s

890

# -- Namespace of the Prometheus serviceaccount to bind to the Resource Reader Role Binding.

891

monitoringServiceAccountNamespace: openshift-monitoring

892

# -- If true, set Security Context Constraints on serviceaccount for read/write premissions

893

enableSCC: false

894

# -- If true, enable internal prom access

895

enablePromAccess: false

896

# -- A list of volumes to be added to the pod

897

extraVolumes: []

898

# -- Array of extra K8s manifests rendered through `tpl` and owned by the release.

899

extraObjects: []

900

# - apiVersion: external-secrets.io/v1beta1

901

# kind: ExternalSecret

902

# metadata:

903

# name: '{{ include "opencost.fullname" . }}-cloud-integration'

904

905

# External labels allow users to apply custom labels to node assets and

906

# allocations.

907

908

# The OpenCost deployment can read external labels from an existing ConfigMap.

909

910

# Supported ConfigMap formats:

911

912

# 1. Traditional ConfigMap

913

914

# data:

915

# cluster: prod

916

# env: dev

917

# region: nam

918

919

# In this case, labels are read directly from ConfigMap.data. The

920

# key and route fields are optional and may be omitted.

921

922

# 2. Block-scalar ConfigMap

923

924

# data:

925

# config.yaml: |

926

# metadata:

927

# externalLabels:

928

# cluster: prod

929

# env: dev

930

# region: nam

931

932

# In this case, specify the key that contains the YAML document and

933

# a dot-separated route to the labels map within it.

934

935

# Fields:

936

# configMapName - name of the ConfigMap to read.

937

# namespace - namespace of the ConfigMap. Defaults to the agent's

938

# own namespace if left empty.

939

# key - Optional. The ConfigMap data key containing the YAML

940

# document. Required only for block-scalar ConfigMaps.

941

# route - Optional. Dot-separated path to the labels map within

942

# the key's YAML content, e.g. "metadata.externalLabels".

943

# When omitted or empty, labels are read directly from

944

# ConfigMap.data (traditional ConfigMap).

945

946

# Traditional ConfigMap example:

947

948

# external:

949

# nodeLabels:

950

# configMapName: external-label-configmap

951

# namespace: ""

952

953

# Block-scalar ConfigMap example:

954

955

# external:

956

# nodeLabels:

957

# configMapName: external-label-configmap

958

# namespace: ""

959

# key: config.yaml

960

# route: metadata.externalLabels

961

external:

962

nodeLabels:

963

configMapName: ""

964

namespace: ""

965

key: ""

966

route: ""

967

The trusted source for open source

Talk to an expert

Privacy

Terms

© 2026 Chainguard, Inc. All Rights Reserved.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.

opencost

The trusted source for open source

Product

Solutions

Customers

Resources

Company