Overview
The Cost Operator (trezr) reads your cloud bill, commitments, and discounts so DevZero shows what your nodes actually cost, not a list-price estimate.
Cost Operator (trezr)
The Cost Operator, trezr, collects cost data from your cloud account and sends it to the DevZero platform. It reads three things:
- Commitments. Reserved Instances, Savings Plans, and committed use discounts (CUDs), with how well each one is used.
- Actual spend. Your cloud's own cost totals, by service and instance type.
- Per-node billed cost. Each node's line items from your billing export, after every discount is applied.
Without trezr, DevZero prices nodes from public on-demand and spot rates. With it, node costs on the dashboard match your bill.
trezr only reads from your cloud. It never buys, changes, or cancels a commitment, and it never touches your workloads or nodes. Inside the cluster it writes only its own state: ConfigMaps, a leader-election Lease, and Events. See RBAC.
What It Collects
| Data | AWS | GCP | Azure | Default interval |
|---|---|---|---|---|
| Commitments | Reserved Instances, Savings Plans | Resource-based and spend-based CUDs | Reserved VM Instances, Savings Plans | 6h |
| Commitment utilization | Cost Explorer | BigQuery billing export | Cost Management | 24h |
| Spend by service and instance type | Cost Explorer | BigQuery billing export | Cost Management | 24h |
| Per-node billed cost | CUR 2.0 Data Export (S3) | Detailed usage cost export (BigQuery) | FOCUS cost export (blob storage) | 24h |
| NAT gateway charges | CUR 2.0 Data Export + VPC snapshot | -- | -- | 24h |
trezr supports EKS, GKE, and AKS. It does not run on OCI or on clusters outside these three clouds.
How It Works
Installation
trezr needs a cloud identity before it can read anything. Follow the guide for your cloud:
- AWS (EKS) setup -- IRSA role, plus an optional CUR 2.0 export
- GCP (GKE) setup -- Workload Identity, plus the BigQuery billing export
- Azure (AKS) setup -- Workload Identity, plus the FOCUS cost export
On AWS, the CLI can create the IAM role for you:
dz install costThe DevZero dashboard also shows the full install command, with your cluster's values filled in, when you add the Cost Operator to a cluster.
The Read Operator must be installed first. trezr uses its cluster token.
Check that it is running:
kubectl get pods -n devzero-system -l app.kubernetes.io/name=trezr
kubectl logs -n devzero-system deploy/trezr | grep "permission probe complete"The second command prints the access tier trezr found.
RBAC
trezr needs very little access inside the cluster. Its cost data comes from cloud APIs, not from Kubernetes.
| Resource | Verbs | Why |
|---|---|---|
| ConfigMaps | get, list, watch, create, update, patch, delete | Operator state and the token fallback |
Leases (coordination.k8s.io) | get, list, watch, create, update, patch, delete | Leader election, so only one replica collects |
| Events | create, patch | Status events |
Secret devzero-zxporter-token | get | Reads the cluster token. Scoped to this one Secret by a Role in trezr's namespace. |
Cloud API Cost
Most reads are free. On AWS, Cost Explorer charges per request. At the default 24-hour interval, trezr's three Cost Explorer calls cost about $0.90 per cluster per month. Reading a CUR export costs only S3 request and transfer fees. On GCP, each BigQuery query is billed by the bytes it scans. trezr reads the current month and the 3 before it by default, set by trezr.gcp.billingLookbackMonths.
Next Steps
- Billing Exports -- how per-node billed cost works on each cloud
- Configuration -- Helm values, intervals, and access tiers
- Troubleshooting -- missing data, minimal access tier, empty export list
- Read Operator -- required before installing the Cost Operator