Network Intelligence: Early Access

Network Intelligence is in early access. It maps traffic between your workloads and prices cross-zone and internet transfer at your cloud provider's published rates. We're opening it to a small number of clusters at a time; request early access if you'd like to try it on yours.

About this post

An earlier version of this post, published on 13 July 2026, announced Network Intelligence as available to all customers. It wasn't, and it still isn't generally available. This version describes what the early-access release does today.

Why network cost is hard to see

Compute cost shows up on the bill as one obvious number: node spend. Network cost doesn't. Two services that landed in different availability zones pay for every byte they exchange. Internet egress to a third-party API isn't mapped to any team. A chatty internal call can cross a zone boundary millions of times a day without ever appearing as a line item you can trace back to a workload.

What it measures

Network Intelligence uses Kubeadapt's optional eBPF agent, a DaemonSet that runs on every node. For each flow it records the source and destination address and port, the protocol, and the bytes sent in each direction. It also reads DNS query names, the TLS server name (SNI), and the HTTP method, route and status code from request and response headers. It does not record request or response bodies.

Kubeadapt matches each flow against your cluster topology and puts it in a traffic class: same node, same zone, cross-zone, cross-region, internet egress, NAT gateway or VPC endpoint. Priced classes use your provider's published rate for each day. Traffic whose destination can't be resolved is shown as its own class and isn't priced, so you can see how much of the picture is still unknown.

What you can look at

• Overview: network cost, cross-zone cost and internet egress for the time window you pick, from the last hour to the last 30 days.
• Service map: workloads laid out as sources, internal services and external destinations. Select a connection to see the bytes in each direction, its traffic class and its cost for the window.
• Flow explorer: filter flows with CEL expressions. The editor completes field names and known values as you type and checks the query before it runs.
• Routes: HTTP method and path, with request counts, error rate and p50, p95 and p99 latency.
• Destinations and Cross-zone: where traffic leaves the cluster, and which traffic crosses availability zones.

Turning it on

The eBPF agent is off by default. Early-access clusters enable it through the Kubeadapt Helm chart:

helm install kubeadapt kubeadapt/kubeadapt \
  --namespace kubeadapt --create-namespace \
  --set agent.config.token="<your-token>" \
  --set kubeadapt-k8s-pulse.enabled=true

Check these before you enable it:

• Linux nodes with kernel 5.10 or later.
• The DaemonSet runs as a privileged pod (privileged: true) with hostNetwork and hostPID, as root with a read-only root filesystem. If your admission policies block privileged pods, add an exception for the kubeadapt namespace first.
• Chart defaults request 100m CPU and 256Mi memory per node, with a 500m / 384Mi limit. We measure about 130 to 155 MiB of memory per node.

The eBPF agent reference covers every setting.

What's next

We're widening access cluster by cluster. Request early access and tell us about your cluster: cloud provider, node count and CNI.