“We were essentially able to reduce the cost of that cluster by about 75%. On AWS, DevZero demonstrated they could achieve significantly higher savings than we initially thought possible.”
Mihir Nair
Head of Architecture, Databahn
Cut OpenShift costs without
restarting your workloads
Automatically rightsize CPU and memory on OpenShift. No pod disruption, no SCC conflicts, no dropped connections.
Companies who slashed their Kubernetes
spend using DevZero
Your OpenShift cluster is running, your bill is too high
Most OpenShift clusters run at 15–30% utilization. Teams over-provision, SCC policies block VPA tooling, and there's no clear view of what's costing money.
Requests are set at deploy time and never updated
CPU and memory requests are defined in manifests and never revisited. Most OpenShift pods run at a fraction of what they request. You pay for the full allocation regardless of actual usage.
MachineSets do not adapt to real workload demand
MachineSets are sized for peak load and stay fixed. Underutilized nodes keep running with no visibility into wasted capacity and no automated path to consolidate or right-size them.
SCC policies block standard rightsizing tools
OpenShift Security Context Constraints prevent VPA from evicting pods to apply resource changes. Teams fall back to manual tuning or accept permanently inflated requests across namespaces.
One platform that actually reduces your OpenShift bill
Lightweight operators observe usage, generate recommendations, and apply changes on your schedule. No SCC conflicts. No refactoring.
Rightsize requests to real usage, live
The write operator (dakr-op) applies new CPU and memory limits in place using CRIU checkpoint-restore. Pods are never restarted, SCC policies are preserved, and you only approve changes you trust.
Provision the right instance, automatically
DevZero's node operator consolidates idle nodes and provisions cost-optimal instance types per workload class. Works alongside OpenShift MachineAPI with no cluster-wide changes required.
See egress and cross-zone cost per workload
An eBPF DaemonSet (compatible with CRI-O) traces pod-level flows and attributes every cross-zone and egress charge to the workload that generated it. Visibility your cloud console cannot give you.
Before and after with DevZero on OpenShift
See the difference DevZero makes across workload resources, node capacity, and egress costs, with the same cluster, the same workloads.
Before DevZero
Avg cluster CPU utilization18%
api-server CPU request2000m (set at deploy)
Node provisioningManual MachineSet config
SCC-blocked rightsizingVPA incompatible with SCC
Egress traffic visibilityNot attributed per workload
Monthly infra spend$52,400 / mo
After DevZero
Avg cluster CPU utilization67% (rightsized)
api-server CPU request320m (live migration)
Node provisioningAuto instance provisioning
SCC-blocked rightsizingCRIU applies in-place, SCC preserved
Egress traffic visibilityPer-pod breakdown via eBPF
Monthly infra spend$36,680 / mo (-30%)
Getting started in three steps
bash · prod-openshift
# Install Read Operator — read-only, open-source$ helm upgrade --install zxporter \oci://...devzeroinc/zxporter \--namespace devzero-zxporter \--set config.clusterToken=<token>✓ namespace devzero-zxporter created✓ 3/3 pods running✓ metrics streaming to DevZeroread-only · no SCC changes made
devzero.io / optimization / prod-openshift
21 workloads scanned−$12,600 potential
WorkloadNowRec.
openshift-apiserver2000m320m
etcd4Gi1.1Gi
router-default1000m240m
First scan complete · No changes applied yet
Read-only · Open-source at github.com/devzero-inc/zxporter · No cluster changes until you enable automation
Deploy the open-source, read-only zxporter via Helm. See cost recommendations in your DevZero dashboard with no cluster changes and no SCC modifications needed.
bash · prod-openshift
# Install node operator via Helm$ helm upgrade --install dz-node-op \oci://...devzeroinc/dz-node-operator \--namespace devzero-system \--create-namespace \--set config.clusterToken=<token>✓ devzero-system namespace ready✓ MachineAPI integration active✓ node operator running
oc get nodepools -n devzero-system
Objects created
NodePooldevzero-defaultReady
NodeClaimdevzero-node-0Ready
Nodes provisioned
c6i.4xlargecompute-optimized×2
r6i.2xlargememory-optimized×1
MachineAPI integration active · Spot interruptions handled automatically · No static MachineSet changes needed
Install the DevZero node operator via Helm. It integrates with OpenShift MachineAPI to provision cost-optimal instance types and handle Spot interruptions automatically.
Workload policy
Scope
namespace = production
Workload types
Deployment · StatefulSet · DaemonSet
Migration type
Live (CRIU)Rolling restart
Aggressiveness
devzero.io / optimization / applying
WorkloadBeforeAfterType
openshift-apiserver2000m320mlive
router-default1000m240mlive
worker-app4000m1180mrestart
Savings this month−$7,200
Automation enabled · SCC constraints respected · Savings begin immediately
Review recommendations, create workload and node policies in the DevZero dashboard, and scale down static MachineSets to hand off to the node operator.
Everything OpenShift teams need on one platform
Workload rightsizing without downtime
CRIU applies new CPU and memory limits without restarting the pod. Connections stay open, SCC policies are preserved, and each recommendation is labelled live or restart before you approve.
View write operator →Intelligent node autoscaling on OpenShift
DevZero's node operator provisions the right instance type per workload, consolidates idle nodes, and handles Spot interruptions automatically. Integrated with OpenShift MachineAPI, managed by policy.
Node operator docs →Egress and cross-zone network cost visibility
An eBPF DaemonSet (Netfilter or eBPF mode, compatible with CRI-O) tracks pod-level flows and attributes every cross-zone and egress charge to the workload that generated it.
Network operator docs →Security scanning and compliance
Scans container images for CVEs, checks clusters against CIS Kubernetes Benchmark and NSA hardening guidelines, and flags RBAC and SCC misconfigurations, all in one dashboard.
Security operator →Terraform and Pulumi providers
Manage clusters and policies as code using the official Terraform provider or Pulumi SDKs for TypeScript and Python. Fits existing GitOps and OpenShift GitOps (ArgoCD) workflows.
IaC providers →Cost-aware pod scheduling
dz-scheduler runs as a secondary scheduler alongside the default OpenShift scheduler. Pods opt in via schedulerName and are placed on the cheapest viable nodes based on real-time pricing and CRIU compatibility.
Scheduler docs →What our customers say
Frequently asked questions
Technical questions from platform engineers who've evaluated DevZero on OpenShift.
Most clusters are overprovisioned.Let's prove yours is.
Run a free assessment to identify overprovisioned workloads, idle capacity, and your potential savings, in minutes.
Optimize now