Skip to main content
emnode
Monitoring

Allocate and trim AKS spend with Cost Analysis

One capability for the most opaque line on the bill: turn an AKS cluster from a single undivided charge into cost broken down by namespace and workload, so idle capacity and runaway teams are visible instead of buried.

13 min·10 sections·AZURE

Last reviewed

AKS Cost Analysis: the basics

Why is a Kubernetes cluster the hardest line on the Azure bill to read?

An AKS cluster is one of the most cost-dense objects in a subscription, and it is also one of the least legible. The bill shows virtual machines, managed disks, load balancers and public IP addresses, but it cannot see inside the cluster: the VMs that back a node pool are charged as compute, with no hint of which namespace, team or workload actually consumed them. A cluster shared by a dozen teams arrives as a single undivided number every month, and nobody can say whose pods drove it up.

Azure Advisor flags exactly this gap with a cost recommendation, 'Use Azure Kubernetes Service cost analysis', against your managedClusters resources. The AKS Cost Analysis add-on closes it by reconciling in-cluster usage data, collected by the OpenCost project, with your real Azure invoice, then presenting the result in Microsoft Cost Management broken down by Kubernetes construct: cluster, namespace, and the underlying Compute, Network and Storage. The same view separates idle capacity, system reservations and service charges from the workloads you actually run.

Without this, AKS spend is governed by guesswork. Idle nodes that nobody scaled down, an oversized node pool, a forgotten test namespace that never stopped, a team whose footprint quietly doubled: all of it hides inside one compute charge until someone goes node by node. The work in this lesson is to switch the add-on on across every eligible cluster so the cost of a Kubernetes estate is allocated by who incurred it, trends are visible over time, and idle resource is something you can see rather than suspect.

In this lesson you will learn why AKS cost is invisible by default, what the Cost Analysis add-on reconciles and surfaces, how to enable it across every eligible cluster in a subscription, and how to read the namespace and idle breakdowns once data lands. The lesson is grounded in the Azure Advisor cost recommendation 'Use Azure Kubernetes Service cost analysis', which Advisor raises against managedClusters resources that do not yet have the add-on.

Fun fact

The cluster that ate the budget in plain sight

A recurring pattern in Kubernetes cost stories is the cluster that grew quietly for months because nobody could see inside it. A node pool sized for a launch that never scaled back down, a test namespace nobody decommissioned, a team that tripled its replica count: each is invisible while AKS bills as a single compute charge, and each is obvious the moment cost is split by namespace. The AKS Cost Analysis add-on is built on OpenCost, the Cloud Native Computing Foundation project for exactly this allocation, and reconciles its in-cluster usage data against your real Azure invoice so the breakdown is grounded in what you were actually charged, not an estimate.

Finding the clusters that bill blind across a subscription

Priya is the platform lead at a scale-up whose AKS bill has climbed three months running with no clear cause. Azure Advisor is showing the 'Use Azure Kubernetes Service cost analysis' recommendation against several of the team's clusters, and the monthly compute charge is a single number nobody can attribute.

Rather than guess at which node pool grew, Priya starts by listing which clusters are eligible for the add-on, on the Standard or Premium tier, and which already have it switched on, so the blind clusters can be separated from the ones already reporting.

List every cluster with its tier and whether Cost Analysis is enabled. The eligible-but-off clusters are the ones billing blind.

$ az aks list --query "[].{name:name, tier:sku.tier, costAnalysis:metricsProfile.costAnalysis.enabled}" -o table
Name Tier CostAnalysis
--------------- -------- ------------
platform-prod Standard False
data-prod Standard True
legacy-sandbox Free False
# platform-prod is Standard but reporting nothing. Enable it first.

A Standard-tier cluster with Cost Analysis off is billing blind and ready to enable now. A Free-tier cluster must move to Standard first before the add-on can be switched on.

How AKS Cost Analysis turns one compute charge into per-namespace costdeep dive

The add-on is built on OpenCost, a Cloud Native Computing Foundation incubating project. When you enable it, an agent runs in the cluster and collects usage data: which pods ran, in which namespace, consuming how much CPU, memory, disk and network. That in-cluster usage is then reconciled against your actual Azure invoice data, so the per-namespace figures are anchored to what you were genuinely charged rather than a list-price estimate. The result appears in the Microsoft Cost Management Kubernetes views in the portal, scoped to clusters and namespaces and to the underlying Azure Compute, Network and Storage.

The breakdown separates four kinds of charge that a single compute line hides. Idle charges are the cost of provisioned capacity that no workload used, the clearest signal of an oversized node pool. System charges are the capacity AKS reserves on each node for the kubelet and container runtime. Service charges cover cluster-level costs such as the uptime SLA or Defender for Containers. Unallocated charges are costs that could not be attributed to a namespace. Seeing idle and unallocated as their own numbers is what makes waste actionable rather than theoretical.

There are real boundaries to know before you rely on it. The add-on requires the Standard or Premium cluster tier, not Free, and a managed identity on the cluster. The Kubernetes cost views are available only for Enterprise Agreement and Microsoft Customer Agreement offer types. Data is not instant: after enabling, it can take up to a day for figures to finalise, and any fluctuation in the previous day's cost stabilises after twenty-four hours. Plan to enable ahead of the period you want to analyse, not on the morning you need the answer.

What is the impact of leaving AKS billing blind?

The direct impact is undetected waste. When a cluster bills as one compute charge, idle capacity, oversized node pools and forgotten namespaces all run unquestioned, because nothing distinguishes used resource from reserved-but-empty resource. The cost of flying blind is measured in time: every day that drift goes unseen is a day it keeps billing, and at a billing-cycle mean-time-to-detect that is potentially a full month of waste per incident before anyone can even ask the question.

The second-order impact is the absence of accountability. A shared cluster with no per-namespace cost cannot support showback or chargeback, so no team feels the weight of its own footprint and there is no early-warning signal when one runs away. Forecasting suffers for the same reason: an undivided line that nobody can decompose is an undivided line nobody can defend in a budget. The platform team ends up policing cost by hand, going node by node, which does not scale with the estate.

On the operational side, visibility is the precondition for every other AKS cost lever. Rightsizing requests, tuning the autoscaler for aggressive scale-down, reclaiming idle nodes: each of these is a guess until you can see where the cost actually sits. Cost Analysis is the instrument that tells you where to point them, which is why Advisor surfaces it as a foundational cost recommendation rather than an optional extra.

How do you make AKS spend visible across the estate?

Work this as one rollout rather than a per-cluster afterthought. The order matters: confirm tier eligibility before you try to enable, and enable ahead of the period you want to analyse, because data takes up to a day to land.

1. Inventory clusters by tier and add-on state

List every cluster with its sku.tier and whether Cost Analysis is already enabled. Standard or Premium clusters with the add-on off are billing blind and can be switched on immediately. Free-tier clusters are not eligible until they move up a tier, so flag those as a separate decision.

2. Confirm the prerequisites once

Cost Analysis needs the Standard or Premium tier, a managed identity on the cluster, and Azure CLI 2.61.0 or later. The Kubernetes cost views require an Enterprise Agreement or Microsoft Customer Agreement offer type, so confirm the subscription qualifies before promising the breakdown to anyone.

3. Enable the add-on on every eligible cluster

Switch Cost Analysis on with a single update per cluster. The control-plane change is immediate, but data takes up to twenty-four hours to finalise, so enable ahead of the billing period you want to read rather than on the day you need the answer.

4. Read the breakdown and act on it

Once data lands, open the Cost Management Kubernetes views and split by namespace. Treat idle and unallocated charges as the first targets: idle points at oversized node pools to scale down, unallocated at workloads to label. Make the per-namespace number the one you review with each team, so cost has an owner.

# Enable AKS Cost Analysis on every eligible Standard or Premium cluster
# that does not yet have it. Requires az 2.61.0+ and a managed identity.
az aks list \
  --query "[?(sku.tier=='Standard' || sku.tier=='Premium') && metricsProfile.costAnalysis.enabled!=\`true\`].{rg:resourceGroup, name:name}" \
  -o tsv | while read -r rg name; do
  az aks update --resource-group "$rg" --name "$name" --enable-cost-analysis
  echo "$name: cost analysis enabled (data finalises within ~24h)"
done

# To enable a brand-new cluster on the Standard tier from the start:
#   az aks create --resource-group <rg> --name <cluster> \
#     --enable-managed-identity --generate-ssh-keys \
#     --tier standard --enable-cost-analysis

Quick quiz

Question 1 of 5

Azure Advisor raises 'Use Azure Kubernetes Service cost analysis' against a cluster. What does enabling the add-on actually give you?

You can now treat AKS cost as something to be allocated rather than a single number to be paid: inventory clusters by tier and add-on state, confirm the Standard-tier and managed-identity prerequisites, enable Cost Analysis on every eligible cluster ahead of the period you want to read, and act on the idle and per-namespace breakdown once data lands. The Advisor recommendation 'Use Azure Kubernetes Service cost analysis' is the nudge; the visibility is the capability.

Back to the library