Kubecost integration¶
Connect DXDT to Kubecost for read-only Kubernetes cost and FinOps visibility: cost allocation by namespace and other dimensions, top spenders, CPU/RAM efficiency, infrastructure asset costs, and savings opportunities. This pairs with the Kubernetes plugin to attribute spend to workloads. DXDT only reads Kubecost's cost model.
| Setup time | ~6 minutes |
| Difficulty | Easy |
Access required: A network-reachable Kubecost service URL. An API token is required only for Kubecost Cloud/Enterprise deployments fronted by a gateway or SSO; self-hosted in-cluster Kubecost usually needs none.
Prerequisites¶
- A running Kubecost install and the URL of its service (ingress, LoadBalancer, or a stable port-forward endpoint).
- For Kubecost Cloud/Enterprise only: a read-only API token if the endpoint is gated by an auth proxy or SSO.
Setup¶
1. Determine the Kubecost URL¶
Find the URL where the Kubecost service is reachable from DXDT. This is often an ingress like http://kubecost.acme.internal or a service exposed on port 9090. The Kubecost /model API lives under this base URL — supply only the base. This becomes kubecost_url.
Note
If Kubecost is only reachable in-cluster, expose it via an ingress or gateway reachable by DXDT before installing.
2. Obtain a token only if your endpoint is gated¶
Most self-hosted, in-cluster Kubecost deployments require no authentication — leave api_token blank. If you run Kubecost Cloud/Enterprise or front Kubecost with an auth gateway, generate a read-only bearer token for that gateway and use it as api_token.
3. Enter the configuration in DXDT¶
In the DXDT marketplace, open the Kubecost plugin. Paste kubecost_url, add api_token only if your deployment is gated, and save to install.
Configuration fields¶
| Field | Where to find it |
|---|---|
Kubecost URL (kubecost_url) |
Base URL of the Kubecost service, e.g. http://kubecost.acme.internal (the /model API is appended automatically). Required. |
API Token (optional, Kubecost Cloud/Enterprise) (api_token) |
Optional — read-only bearer token, only for Kubecost Cloud/Enterprise or endpoints behind an auth gateway. Leave blank for unauthenticated in-cluster installs. |
Verify the connection¶
On save, DXDT calls ping, which returns cluster info and confirms connectivity. You can then ask DXDT for cost (e.g. window 7d, aggregated by namespace) to confirm allocation data is available.
Security
DXDT reads Kubecost cost and allocation data only — it performs no writes or configuration changes. Supply the least-privileged read-only token if your deployment is gated, and prefer exposing Kubecost over an internal, access-controlled ingress rather than the public internet.
Troubleshooting¶
Timeout or connection refused on save
kubecost_url is only reachable in-cluster or the port is blocked from DXDT. Expose Kubecost via an ingress/gateway reachable by DXDT, or allow-list DXDT egress to the service.
401/403 on ping
The endpoint is gated (Cloud/Enterprise or an auth proxy) but no api_token was supplied. Generate a read-only token for the gateway and set it as api_token.
Ping succeeds but cost/savings return empty
Kubecost has not yet accumulated enough data, or the /model API is disabled behind the URL supplied. Allow Kubecost to run long enough to build allocation history, and confirm kubecost_url points at the cost-model service, not a static dashboard.
Vendor documentation: https://docs.kubecost.com/apis/apis-overview