Skip to content
Start free

Reference

Frequently Asked Questions

Common questions about Kubeadapt: pricing, data handling, security, supported clusters, the eBPF agent, SSO and uninstalling.

Last updated

General

What is Kubeadapt?

Kubeadapt is a Kubernetes cost monitoring and optimization platform. It shows you where your cluster spend goes, identifies savings opportunities, and helps prevent unexpected cost increases.

For a full overview, see the Introduction.

Does Kubeadapt change anything in my cluster?

It does not change your workloads. The core agent reads cluster state and usage metrics and sends them to Kubeadapt. Its permissions are:

  • Cluster-wide: list and watch on the resources it reads, plus get on the kubelet stats endpoints.
  • In its own namespace: get, list, create and delete on Jobs; get, list, create, update and delete on ConfigMaps; get and list on Secrets.

Two optional components, both off by default, can do more. Auto-upgrade runs a Helm upgrade Job that manages the Helm release Secrets and Kubeadapt's own resources in its namespace. The eBPF agent runs as a privileged pod (privileged: true) with hostNetwork and hostPID, and attaches traffic-counting programs to each node's network interfaces.

Recommendations are never applied for you. You review them in Kubeadapt, copy the YAML and apply it through your own deployment process. See the Right-sizing Guide.

What Kubernetes distributions are supported?

EKS, GKE, AKS, self-hosted (kubeadm, kops, Rancher), and OpenShift.

Requires Kubernetes 1.24 through 1.35 and outbound HTTPS access from the agent to Kubeadapt.

Data & Security

What data leaves my cluster?

Per-container resource samples (CPU, memory, GPU, network counters), node metadata (machine type, region, capacity type), and pod and workload identifiers (name, namespace, labels). The agent sends a compressed snapshot to Kubeadapt every 60 seconds over HTTPS — see How Kubeadapt works for the full data path.

What does not leave your cluster: Secret values, ConfigMap contents, request and response bodies, environment variables, container images, and anything else outside the metrics and metadata above. The agent can read Secrets only in its own namespace, and never reads pod filesystems. If you enable the optional eBPF agent, it also sends connection metadata, DNS query names, TLS server names and HTTP method, route and status.

Where is my data stored?

In the EU. Kubeadapt runs on Hetzner in the EU, and there is no other region to choose. Each organization's data is isolated from every other organization's, on every read and write.

Cluster data leaves your cluster and is stored by Kubeadapt. There is no single-tenant or self-hosted option.

How is data encrypted?

In transit: HTTPS (TLS 1.2 or higher) between the agent and Kubeadapt, and between the dashboard and the Kubeadapt API. Agent traffic is authenticated with a per-cluster bearer token. Inside the cluster, the optional eBPF agent talks to the Kubeadapt agent over mutual TLS.

At rest: storage and backups are both encrypted in Kubeadapt's cloud provider.

Features

Can I track costs by team or project?

Yes. Map workloads to Teams and Departments with a label or manual assignment, then see each team's cost under Cost Attribution → Teams. See Trace cost to a team.

Does Kubeadapt support multi-cluster?

Yes. Install the agent on each cluster and monitor them all from a single dashboard.

Does Kubeadapt have an API?

Yes. Kubeadapt has a REST API for programmatic access to cluster data, costs, and recommendations. Create API keys in the dashboard under Settings → API Keys. There is also a command-line tool.

See API Documentation for details.

Getting Started

Can I try before purchasing?

Yes. The first 100 vCPU are free, so you can run Kubeadapt on a small cluster at no cost. See the Quick Start to install the agent.

How is Kubeadapt priced?

Per vCPU per month, from $1.99 down to $0.60 as volume grows, with the first 100 vCPU free. Startups pay a flat $0.60. See Billing for the full table.

Do I need the eBPF agent?

No. Cost monitoring, attribution and rightsizing work with the core agent alone. The optional eBPF agent adds network traffic data for cross-zone and egress cost, which is in early access.

Does Kubeadapt support SSO?

Yes, SAML SSO with Okta, Entra ID, Google Workspace or a custom SAML provider. See Configure SAML SSO.

How do I uninstall Kubeadapt?

Remove the chart from each cluster:

bash
helm uninstall kubeadapt -n kubeadapt

This removes every Kubeadapt resource from the cluster. To ask for your organization's data to be deleted, email support@kubeadapt.io.

Still Have Questions?