Configuration

The CostGraph Operator is configured through Helm values.yaml. The defaults work for most clusters; this page covers the options you’re most likely to change.

Global settings

string

required

Name used to identify this cluster in the CostGraph platform.

string

API key for authenticating with CostGraph. Don’t commit a real key. Prefer existingSecret in production.

string

Name of a pre-existing Secret holding the API key. When set, apiKey is ignored.

string

default:"apiKey"

Key within existingSecret that holds the API key value.

string

default:"https://api.costgraph.ai"

Base URL of the CostGraph API.

string

Where cluster metrics are sent. A self-hosted install points this at its own ingestion endpoint; left unset, metrics go to hosted CostGraph.

array

Top level, not under global. It does not reach the component workloads. See the component pattern below.

string

Overrides the chart name used in the generated labels.

string

Affects the ClusterRole (<fullname>-view), the ClusterRoleBinding and the ServiceAccount only. Every component’s objects are named from its own applicationName.

The component pattern

All four CostGraph components in this chart (operatorKubernetes, operatorPrometheus, aiGatewayScraper and flowtrace) take the same shape:

<component>:
  enabled: true
  applicationName: costgraph-operator-...
  deployment:            # daemonSet: for flowtrace
    enabled: true
    replicas: 1
    image:
      repository: ...
      tag: ...
      pullPolicy: IfNotPresent
    imagePullSecrets: []
    resources: {}
    env: {}
    ports: [...]
    containerSecurityContext: {}
    nodeSelector: {}
    tolerations: []
    affinity: {}
  config:                # the only component-specific block
    remoteWriteURL: ""

The inner keys mean the same thing in each, and daemonSet: differs only where Kubernetes forces it to: replicas is ignored, and strategy becomes updateStrategy. Enabling, sizing or scheduling any component is therefore the same operation. enabled gates the whole component. <component>.deployment.enabled (or .daemonSet.enabled) is the narrower switch that keeps the configuration and drops the pods.

env is a map, not a list: env.LOG_LEVEL.value: info, or env.API_KEY.valueFrom.secretKeyRef. A map means --set can override one variable without clobbering its siblings.

Two keys stay at component level rather than moving into the workload block, because they are not pod settings: flowtrace.maxUnavailable (rollout speed) and operatorPrometheus.scrapeTargets.

Object names no longer carry the release name. operatorPrometheus is costgraph-operator-prometheus, flowtrace is costgraph-operator-flowtrace, aiGatewayScraper is costgraph-operator-ai-gateway, and the credentials Secret is costgraph-operator-credentials. See the migration tables.

The same contract covers the self-hosted chart. See the values reference for the full description, including the three value tiers and the Argo CD caveat.

Resource exporter

operatorKubernetes watches cluster resources and exports them to CostGraph. Its workload settings sit under operatorKubernetes.deployment.

boolean

default:"true"

Deploy the resource exporter. Wired as the condition on the dependency, so turning it off renders nothing at all.

string

default:"costgraph-operator-kubernetes"

Name its objects take.

boolean

default:"true"

Narrower switch: keeps the configuration, drops the pods.

number

default:"1"

Keep at 1. The exporter is not designed to run multiple replicas.

object

repository, tag and pullPolicy for the exporter image.

The published resource exporter image is linux/amd64 only. On an arm64 node the pod stays in ImagePullBackOff with no match for platform in manifest, which reads as a missing image rather than an unsupported architecture.Schedule it onto amd64 nodes until a multi-architecture release is published:

operatorKubernetes:
  deployment:
    nodeSelector:
      kubernetes.io/arch: amd64

The metrics scraper is already multi-architecture and needs no such pin.

array

The chart’s top-level imagePullSecrets does not reach this Deployment, so a private exporter image needs the secret repeated here.

object

Resource requests and limits.

object

Standard pod scheduling controls.

object

Additional environment variables, as a map of name to value or valueFrom, so a single variable can be overridden with --set without clobbering its siblings.

Operational/Compute Metrics scraper

operatorPrometheus scrapes in-cluster metrics endpoints and remote-writes them to CostGraph.

boolean

default:"true"

Deploy the operational/compute metrics scraper.

object

Its workload: image, replicas (keep at 1), resources, env, ports and the scheduling keys.

string

default:"https://tsdb.costgraph.ai"

Remote-write endpoint for collected metrics.

string

default:"/api/v1/write"

Remote-write path appended to the URL.

string

default:"prometheus"

Metrics API flavor. prometheus or victoriametrics.

string

default:"30s"

Timeout for scrape and backend requests.

AI gateway scraper

aiGatewayScraper reads token usage from AI gateways running in the cluster and remote-writes it to the short-retention tier. It is a second instance of the same scraper image; the difference is remoteWritePath, because raw gateway series are high cardinality and are not intended to live as long as the operator’s scraped metrics.

boolean

default:"false"

Deploy the AI gateway scraper.

object

Its workload, same keys as operatorPrometheus.deployment.

string

default:"/api/v1/write/short"

Short-retention tier. Recording rules distil these series before anything reaches 90-day retention.

It takes no scrapeTargets. Targets are served by CostGraph from the connections you create in Settings > Integrations. They are fetched at start and refreshed while it runs, so connecting a gateway leaves these values untouched. See AI gateways. A target you define yourself in operatorPrometheus.scrapeTargets takes precedence over a served one. A served target is applied only when it carries a metric-name filter.

Network Metrics scraper

flowtrace scrapes per-container network metrics and, optionally, host-process network metrics, then remote-writes them to CostGraph.

The DaemonSet mounts the host filesystems at:

cgroupfs: /host/sys/fs/cgroup.
procfs: /host/proc.

boolean

default:"true"

Deploy the network metrics scraper.

object

Its workload. Same keys as a deployment: block, minus replicas. The defaults set containerSecurityContext.privileged and runAsUser: 0. Resolving container identity from other processes’ /proc entries requires both, and withhold the service account token because no Kubernetes API access is needed.

string

system-node-critical is appropriate here but is namespace-restricted on some clusters, so it is left unset rather than defaulted.

string

default:"1"

Rollout speed. Raise it on large fleets, for example "10%".

string

default:"https://tsdb.costgraph.ai"

Remote-write endpoint for collected metrics. The values file ships it empty: the chart falls back to global.remoteWriteURL, and to https://tsdb.costgraph.ai when that is empty too.

string

default:"/api/v1/write/short"

Remote-write path appended to the URL.

string

default:"30s"

Timeout for write and backend requests.

boolean

default:"false"

Container network flows are collected by default. Host-process network flows are collected only when this is enabled.

boolean

default:"false"

Collect per-request HTTP metrics tagged by X-CostGraph-* request headers. See Request header attribution.

Scrape targets

operatorPrometheus.scrapeTargets is a map of the in-cluster /metrics endpoints to scrape. The chart ships defaults for cAdvisor, kube-state-metrics, node-exporter, and the kubelet (DCGM is off). Add a source by appending an entry. No new operator image is required. Each entry accepts:

boolean

default:"true"

Include this target.

string

default:"pod"

pod discovers and scrapes matching pods; node scrapes each node’s kubelet through the API-server proxy.

string

Pod targets only. Namespace to discover pods in.

string

Label selector for pod (or node) discovery. Required for pod targets.

number

Pod targets only. Port the exporter listens on.

string

default:"/metrics"

Metrics path to scrape.

boolean

default:"false"

Stamp costgraph_instance_hostname and costgraph_instance_id on node-scoped sources like cAdvisor and node-exporter.

array

Keep only metric families whose names match one of these prefixes. Empty keeps everything.

OpenCost API

openCostApi serves the OpenCost allocation API from inside the cluster, for tools that resolve a Kubernetes Service rather than call a URL. kubectl cost is one. The component is an nginx that proxies to CostGraph and attaches the operator’s API key. It pins every request to global.clusterName, so a tool run here reports this cluster rather than every cluster on your account. Leave it off while OpenCost or Kubecost still runs in the cluster. They own these Service names until you remove them.

boolean

default:"false"

Deploy the proxy and a Service named for OpenCost.

string

default:"opencost"

Service name. kubectl cost --opencost looks for opencost.

integer

default:"9003"

Service and container port.

boolean

default:"false"

Add a second Service under the name Kubecost clients resolve. The /model path those clients request is served either way; this adds the name and port.

string

default:"kubecost-cost-analyzer"

Name of that second Service.

integer

default:"9090"

Its port.

string

default:"api.costgraph.ai"

Where the proxy sends requests. A self-hosted install points this at its own backend.

string

default:"/api/v1/tenant/opencost"

Path prefix on that host.

string

default:"kube-dns.kube-system.svc.cluster.local"

DNS server nginx resolves the upstream with.

object

Its workload, same keys as operatorPrometheus.deployment.

The Service is created in the namespace you install the release into, while the plugin looks in opencost or kubecost. See OpenCost API for the flags that cover the difference.

Bundled exporters

The chart pulls in the metrics sources as subcharts. Disable any you already run in the cluster. Disable flowtrace if you do not need network tracing.

boolean

default:"true"

Kubernetes object-level metrics (pods, deployments, nodes).

boolean

default:"true"

Per-container resource usage. Uses the baselinehq/cadvisor image.

boolean

default:"true"

Host-level metrics (CPU, memory, disk, network). The port defaults to 9101 rather than the upstream 9100. The subchart binds a hostPort, and 9100 collides with a node exporter the cluster already runs. The operator’s scrape target follows prometheus-node-exporter.service.port, so change it there only.

boolean

default:"false"

NVIDIA GPU metrics. Enable only on clusters with GPU nodes; restrict it to GPU nodes with dcgm-exporter.nodeSelector and dcgm-exporter.tolerations. What CostGraph does with these measurements is covered in Accelerators.

boolean

default:"false"

A second, isolated DCGM exporter carrying only the profiling counters (SM active, SM occupancy, PCIe byte rates). It is separate because a card whose driver refuses profiling makes the exporter exit. Keeping those counters out of the shared exporter means such a node fails alone. Otherwise it takes utilisation, memory and power down with it, and stalls the rollout for every other GPU. See Accelerators.

number

default:"9401"

Port the profiling exporter listens on. It shares a node with the preceding exporter, which binds 9400, so the two cannot share a port.

object

default:"{}"

Narrow the profiling DaemonSet. By default it schedules wherever the shared exporter does, and tolerates the nvidia.com/gpu taint the same way.

boolean

default:"true"

Per-container and, optionally, host per-process network metrics (bytes sent/received, packets sent/received, connection count).

Full values reference

Complete values.yaml

global:
  clusterName: ""
  apiKey: ""
  existingSecret: ""
  existingSecretKey: ""
  backendURL: "https://api.costgraph.ai"
  remoteWriteURL: ""

imagePullSecrets: []
nameOverride: ""
fullnameOverride: ""

serviceAccount:
  create: true
  automount: true
  name: costgraph-operator

kube-state-metrics:
  enabled: true

cadvisor:
  enabled: true
  image:
    registry: ghcr.io
    repository: baselinehq/cadvisor
    tag: "0.56.3-baseline"

prometheus-node-exporter:
  enabled: true
  service:
    port: 9101
    targetPort: 9101

dcgm-exporter:
  enabled: false
  nodeSelector:
    accelerator: nvidia
  tolerations: []

dcgmProfiling:
  enabled: false
  applicationName: costgraph-operator-dcgm-profiling
  image:
    repository: nvcr.io/nvidia/k8s/dcgm-exporter
    tag: 3.3.9-3.6.1-ubuntu22.04
    pullPolicy: IfNotPresent
  port: 9401
  nodeSelector: {}

operatorKubernetes:
  enabled: true
  applicationName: costgraph-operator-kubernetes
  deployment:
    enabled: true
    replicas: 1
    image:
      repository: ghcr.io/baselinehq/costgraph-operator-kubernetes
      tag: "v0.1.0"
      pullPolicy: IfNotPresent
    imagePullSecrets: []
    resources:
      requests:
        cpu: 10m
        memory: 64Mi
    nodeSelector: {}
    tolerations: []
    affinity: {}
    env: {}

operatorPrometheus:
  enabled: true
  applicationName: costgraph-operator-prometheus
  deployment:
    enabled: true
    replicas: 1
    image:
      repository: ghcr.io/baselinehq/costgraph-operator-prometheus
      tag: "v0.4.0"
      pullPolicy: IfNotPresent
    resources:
      requests:
        cpu: 100m
        memory: 64Mi
  config:
    remoteWriteURL: "https://tsdb.costgraph.ai"
    remoteWritePath: "/api/v1/write"
    prometheusAPIProvider: "prometheus"
    httpTimeout: "30s"
  scrapeTargets:
    cadvisor:
      enabled: true
      labelSelector: "app.kubernetes.io/name=cadvisor"
      port: 8080
      nodeMetrics: true
    kube-state-metrics:
      enabled: true
      labelSelector: "app.kubernetes.io/name=kube-state-metrics"
      port: 8080
    node-exporter:
      enabled: true
      labelSelector: "app.kubernetes.io/name=prometheus-node-exporter"
      port: 9101
      nodeMetrics: true
    kubelet:
      enabled: true
      kind: node
      nodeMetrics: true
      metricNamePrefixes:
        - kubelet_
    dcgm-exporter:
      enabled: false
      labelSelector: "app.kubernetes.io/name=dcgm-exporter"
      port: 9400
      nodeMetrics: true
    dcgm-profiling:
      enabled: false
      labelSelector: "app.kubernetes.io/name=costgraph-operator-dcgm-profiling"
      port: 9401
      nodeMetrics: true

aiGatewayScraper:
  enabled: false
  applicationName: costgraph-operator-ai-gateway
  deployment:
    enabled: true
    replicas: 1
    image:
      repository: ghcr.io/baselinehq/costgraph-operator-prometheus
      tag: "v0.4.0"
      pullPolicy: IfNotPresent
    resources:
      requests:
        cpu: 100m
        memory: 64Mi
  config:
    remoteWriteURL: ""
    remoteWritePath: "/api/v1/write/short"
    httpTimeout: "30s"

# flowtrace runs on every node and tolerates all taints by default, 
# requires BTF and cgroup v2, and enters CrashLoopBackOff on incompatible nodes. 
# Use nodeSelector to target compatible nodes in mixed clusters and
# set flowtrace.enabled to false when no compatible nodes exist.

flowtrace:
  enabled: true
  applicationName: costgraph-operator-flowtrace
  daemonSet:
    enabled: true
    image:
      repository: ghcr.io/baselinehq/costgraph-operator-prometheus
      tag: "v0.4.0"
      pullPolicy: IfNotPresent
    containerSecurityContext:
      privileged: true
      runAsUser: 0
    automountServiceAccountToken: false
    priorityClassName: ""
    resources:
      requests:
        cpu: 50m
        memory: 64Mi
      limits:
        memory: 256Mi
    tolerations:
      - operator: Exists
    nodeSelector: {}
    affinity: {}
  config:
    remoteWriteURL: ""
    remoteWritePath: "/api/v1/write/short"
    pushInterval: "4m"
    includeHostFlows: false
    httpTimeout: "30s"
  maxUnavailable: 1

Node and volume pricing

Nodes and volumes outside a supported cloud are priced with costgraph.ai/pricing-id.compute and costgraph.ai/pricing-id.storage labels. See On-prem pricing.

Get Started

CostGraph Operator

CostGraph Agent

GPUs

Insights

Alerts

Budgets & Forecast

Allocation

Virtual Tags

Network

Workflows

MCP

Slack

Security

Developers

Self-Hosted

Integrations

Changelog

Global settings

The component pattern

Resource exporter

Operational/Compute Metrics scraper

AI gateway scraper

Network Metrics scraper

Scrape targets

OpenCost API

Bundled exporters

Full values reference

Node and volume pricing

​Global settings

​The component pattern

​Resource exporter

​Operational/Compute Metrics scraper

​AI gateway scraper

​Network Metrics scraper

​Scrape targets

​OpenCost API

​Bundled exporters

​Full values reference

​Node and volume pricing

Global settings

The component pattern

Resource exporter

Operational/Compute Metrics scraper

AI gateway scraper

Network Metrics scraper

Scrape targets

OpenCost API

Bundled exporters

Full values reference

Node and volume pricing