Helm values, collection intervals, access tiers, and org-wide commitment collection for the Cost Operator (trezr).

Configuration

trezr is configured through its Helm chart, oci://registry-1.docker.io/devzeroinc/trezr. It has no CRDs. Change a value with --set on helm upgrade, or with dz install cost --upgrade --set <key>=<value>.

Core Values

Value	Default	Description
`trezr.clusterName`	--	Cluster name reported to DevZero. Required.
`trezr.region`	--	Cloud region of the cluster. Required.
`trezr.cloudProvider`	`aws`	`aws`, `gcp`, or `azure`.
`trezr.dakrUrl`	`https://dakr.devzero.io`	DevZero API endpoint.
`namespace`	`devzero-system`	Namespace for every object the chart creates.
`serviceAccount.annotations`	`{}`	The cloud identity: an IRSA role ARN, a GCP service account, or an Azure client id.
`podLabels`	`{}`	Extra pod labels. Azure Workload Identity needs `azure.workload.identity/use: "true"`.
`replicaCount`	`1`	Replicas. With leader election on, only one collects at a time.
`trezr.leaderElect`	`true`	Run with leader election.

Cluster Token

trezr uses the Read Operator's cluster token. You do not need to set it.

Value	Default	Description
`trezr.tokenFromSecret`	`{name: devzero-zxporter-token, key: CLUSTER_TOKEN}`	Read the token from this Secret first. Only read from trezr's own namespace. trezr reads it again when DevZero rejects the token, so a rotated token is picked up without a restart. Set to `null` to turn it off.
`trezr.tokenFromConfigMap`	`{name: devzero-zxporter-env-config, namespace: "", key: CLUSTER_TOKEN}`	Fallback when the Secret has no token. Can read another namespace. An empty `namespace` means trezr's own.
`trezr.clusterToken`	`""`	Set the token directly. Stored in a Secret, never in the ConfigMap.

Collection Intervals

Value	Default	What it controls
`trezr.intervals.reservations`	`6h`	How often commitments are listed
`trezr.intervals.costExplorer`	`24h`	How often utilization and spend are read
`trezr.intervals.cur`	`24h`	How often the selected billing export is read, on every cloud
`trezr.intervals.curConfigPoll`	`10m`	How often trezr asks DevZero which export you picked

Billing exports refresh about once a day, so reading them more often than every 24 hours rarely finds new rows. On AWS, each Cost Explorer call is billed, so a shorter costExplorer interval costs more.

Cloud Values

Value	Default	Description
`trezr.aws.orgMode.managementAccountRoleARN`	`""`	A role in the management account to assume, to collect Reserved Instances and Savings Plans across the whole AWS Organization.
`curScratch.mountPath`	`/var/tmp/trezr-cur`	Where CUR files are downloaded before they are read.
`curScratch.sizeLimit`	`2Gi`	Size limit of that scratch volume.

Org mode needs permissions on both sides:

The management account role must trust this cluster's IRSA role. It must allow ec2:DescribeReservedInstances, savingsplans:DescribeSavingsPlans, savingsplans:DescribeSavingsPlanRates, and organizations:ListAccounts.
trezr's IRSA role must allow sts:AssumeRole on the management account role. The default policy in AWS Setup does not include it. Add this statement:

{
  "Effect": "Allow",
  "Action": "sts:AssumeRole",
  "Resource": "arn:aws:iam::<management-account-id>:role/<role-name>"
}

Value	Default	Description
`trezr.gcp.project`	`""`	Cluster project. Required on GCP.
`trezr.gcp.billingAccountId`	`""`	Billing account id. Needed for spend-based CUDs and org mode.
`trezr.gcp.bigqueryProject`	`trezr.gcp.project`	Project that holds the billing export dataset.
`trezr.gcp.bigqueryDataset`	`""`	Datasets to look in, comma-separated. Empty scans every dataset in the project, up to 50.
`trezr.gcp.bigqueryJobProject`	`trezr.gcp.bigqueryProject`	Project that BigQuery queries run and are billed in. trezr needs `roles/bigquery.jobUser` here.
`trezr.gcp.billingLookbackMonths`	`3`	Months before the current one that each read covers. Bounds BigQuery query cost.
`trezr.gcp.orgMode.enabled`	`false`	Collect resource-based CUDs from every project on the billing account. Needs `billingAccountId`, `roles/billing.viewer` on the billing account to list the projects, and `roles/compute.viewer` on each project, or once on their folder or organization. A project without it is skipped.

Value	Default	Description
`trezr.azure.subscriptionId`	`""`	Cluster subscription. Required on Azure.
`trezr.azure.clientId`	`""`	Managed identity or app client id.
`trezr.azure.tenantId`	`""`	Tenant id, for service principal sign-in.
`trezr.azure.clientSecret`	`""`	Service principal secret. Stored in a Secret, never in the ConfigMap.
`trezr.azure.billingAccountId`	`""`	Also list cost exports on this billing account.
`trezr.azure.managementGroupId`	`""`	Collect commitments across the subscriptions in this management group.
`trezr.azure.billingLookbackMonths`	`0`	Months before the current one each read may cover. `0` reads every month the export holds. Months already read are skipped either way.

Resources

Value	Default
`resources.requests.cpu`	`100m`
`resources.requests.memory`	`256Mi`
`resources.limits.cpu`	`200m`
`resources.limits.memory`	`512Mi`

Reading CUR parquet files needs more memory than the API calls. Raise the memory limit if trezr is OOM-killed during a billing export read.

Access Tiers

At startup, trezr checks which commitment APIs its identity can call. The result is its access tier. DevZero shows it next to your commitments, so you can see what is missing.

The tier is only a label. trezr still makes every call on schedule, and a call it has no permission for fails on its own. Billing export reads are not part of the check.

trezr checks its access only at startup. After you change its roles, restart it: kubectl rollout restart -n devzero-system deploy/trezr.

Tier	When	What you get
Full	Reserved Instance and Savings Plan calls (including rates) succeed	Reserved Instances and Savings Plans
Standard	Reserved Instances succeed, Savings Plans fail	Reserved Instances only
Minimal	`ec2:DescribeReservedInstances` fails	No commitments

Cost Explorer is not part of the check. Without the ce:* actions, utilization and spend are missing at any tier.

Tier	When	What you get
Full	Standard, plus a BigQuery billing export is readable	Resource and spend-based CUDs, CUD utilization, spend by service
Standard	`billingAccountId` is set and the Commerce API is readable	Resource-based CUDs, spend-based CUD orders. No utilization.
Minimal	Neither	Resource-based CUDs only, if `roles/compute.viewer` is granted

Tier	When	What you get
Full	`Reservations Reader`, `Savings plan Reader`, and `Cost Management Reader` all work	Reserved VMs, Savings Plans, spend by service
Standard	`Reservations Reader` works, one of the other two fails	Reserved VMs, plus whichever of the other two works
Minimal	`Reservations Reader` fails	No commitments. The FOCUS export still works.

Reader on the subscription does not cover reservations or savings plans. See Azure Setup.

Health Endpoints

trezr serves health checks on port 8081:

Path	Used for
`/healthz`	Liveness
`/readyz`	Readiness

Admission Policies

If an admission controller requires labels on every object, the trezr chart supports two values:

global.commonLabels adds labels to every object the chart creates.
podLabels adds labels to the trezr pod only.

The chart has no commonAnnotations or podAnnotations. See Admission Policy Labels.

Configuration

On this page