Kubernetes monitoring without ingestion fees

Volume-based observability pricing turns routine Kubernetes operations into billing events. When teams attach changing attributes as labels, deployment rollouts create new time series. Pod names and UIDs are common examples.

Depending on the vendor, those series can increase per-series charges, datapoint volume, or per-GB ingestion. Platform teams at scale respond by rationing telemetry. Teams sample traces and drop logs. Some also leave staging unmonitored to protect the budget.

First, examine ingestion-based pricing and its Kubernetes cost mechanics. Next, evaluate self-hosted, BYOC, and eBPF architectures. Then apply those models to cost visibility, allocation, and rightsizing before comparing published vendor rates and deployment choices for air-gapped clusters.

What is Kubernetes monitoring without ingestion fees

Kubernetes monitoring without ingestion fees is monitoring without vendor charges tied directly to telemetry ingestion. You either pay a flat rate per monitored node or run the stack yourself, so the subscription or license cost does not rise with telemetry volume or metric cardinality. Self-hosted and BYOC deployments still incur customer-owned compute, storage, retention, and engineering costs that can grow with the workload.

Kubernetes makes cost visibility harder than traditional infrastructure because the units of work keep changing identity. Every replaced pod gets a new .metadata.uid, and The New Stack documents that every deployment and its associated pod churn cause old time series to stop receiving samples while new time series start. That new series appears when teams attach changing pod identifiers or related dynamic attributes as labels. Dynamic labels and autoscaling multiply the effect. Separate staging and dev environments add more telemetry, so volume-priced monitoring can grow faster than the infrastructure it observes.

How ingestion-based pricing spirals (and why Kubernetes makes it worse)

Per-volume SaaS pricing meters exactly the dimensions Kubernetes inflates. First, the mechanics of the model itself.

The ingestion-fee model

Volume-based platforms bill each signal type on its own meter.

• Datadog: infrastructure per host, log ingestion per GB, log indexing at $1.06–$2.50 per million events per month, and custom metric overages at $5.00 per 100 indexed metrics per month beyond a per-host allotment of 100 metrics for Pro or 200 for Enterprise.
• Dynatrace’s DPS model: metrics ingest at $0.15 per 100,000 datapoints plus retention at $0.0007/GiB-day. Dynatrace separately charges $0.0035 per GiB scanned for trace queries.
• New Relic: all telemetry collapsed into a single per-GB rate, plus per-user pricing at $49 (Core) to $99 (Full Platform) per user per month.

Each meter runs independently. Forecasting the bill means predicting log volume, trace volume, metric cardinality, and seat count at the same time, and a miss on any one of them produces an overage. That forecasting problem is what turns into a spiral once Kubernetes cardinality enters the equation.

How costs spiral at scale

Cardinality multiplies rather than adds. A Prometheus time series is a metric name plus its full label set, and Robust Perception documents that “All of these cardinalities end up being multiplied together”: moving from 2×6×5×10 label values to 3×8×6×12 more than doubles the series count to 1,728. A PromCon EU 2019 talk showed a multiplicative label chain reaching 40 million series. At Flipkart, roughly 2,000 instances each emitting ~40,000 metrics produced 80 million simultaneous time-series data points.

Pod churn feeds that multiplication into billing when pod names, UIDs, or related changing attributes appear as tags. Datadog defines the billable unit as “a single, unique combination of a metric name, host ID, and any tags,” so every pod replacement carrying one of those identifiers creates new billable combinations.

A documented Datadog example shows one metric dropping from 7,139 indexed custom metrics to 3 after tag allowlisting; that 7,136-metric difference existed only because of label sprawl. Grafana Cloud bills from the 95th percentile of active series, so a sustained cardinality spike lasting long enough to enter that percentile can raise the monthly charge.

Observability spend averages 17% of total compute infrastructure spend, according to Grafana Labs’ 2025 observability survey of 1,255 respondents. Teams under volume pricing respond by sampling traces or collecting only logs. Others skip non-production environments entirely, since adding staging and dev multiplies spend. The spiral follows from the pricing architecture, so the fix is a different pricing model rather than better dashboards.

Approaches that eliminate ingestion fees

Two architectures eliminate vendor ingestion fees: run the stack yourself, or pay per node while a vendor manages a split-plane deployment. Customer-owned infrastructure costs still scale with the resources needed to process and retain telemetry. eBPF collection changes what either approach can see.

Open-source self-hosted (Prometheus, OpenCost, Kubecost)

The self-hosted path removes license fees entirely. Prometheus is Apache 2.0 and a CNCF-graduated project, but it covers metrics only. Logs and traces require separate systems, as does APM. OpenCost, a CNCF incubating project under Apache 2.0, adds real-time cost allocation by cluster, node, namespace, controller, service, or pod across AWS, Azure, and GCP. Kubecost productizes OpenCost with a free Foundations tier up to 250 cores; IBM acquired Kubecost in September 2024.

The fee you remove from the invoice reappears as engineering time. Salesforce Commerce Cloud spent at least one engineer-day per month per team maintaining Thanos before moving to a managed service, and Pipedrive needed two engineers for roughly two to three months to implement and tune Mimir. The New Stack characterizes self-hosting as “trading CapEx for OpEx,” citing a company that dedicated roughly 8% of developer headcount to its in-house stack.

If your team can staff HA and upgrades while managing cardinality as a permanent function, self-hosting is the zero-license and zero-vendor-ingestion-fee path. If not, the second approach keeps subscription costs flat while a vendor manages the customer-hosted data plane and hosted control plane.

Node-based flat pricing

groundcover charges a flat rate per monitored Kubernetes node or Linux host, roughly $35/node/month on the current Enterprise profile. groundcover calculates monthly charges from the average number of monitored nodes, so short-lived scaling spikes don’t inflate the bill. Data volume, user count, custom metric cardinality, and trace sampling rates do not change the per-node price. There are no per-GB ingestion charges, custom-metric surcharges, or per-user fees.

The model works because of BYOC (Bring Your Own Cloud), where your data plane runs in your own cloud account. ClickHouse stores logs and traces as well as Kubernetes events, while VictoriaMetrics stores metrics inside your VPC. groundcover manages the control plane for the UI and APIs, plus orchestration. The BYOC documentation states that telemetry “remains within the ‘four walls’ of your infrastructure, at all times,” so there is no vendor-side storage to meter. Customer-owned compute and storage for the BYOC data plane remain additive and vary with workload volume and retention.

The outcome is broader coverage. groundcover reports that BigBasket cut observability spend 50% while expanding coverage across development and testing environments, and flat per-node pricing is the mechanism: adding environments and telemetry did not change the unit economics.

eBPF and zero-instrumentation collection

groundcover’s eBPF sensor deploys as a Kubernetes DaemonSet, one pod per node, and captures logs, metrics, traces, Kubernetes events, network calls, and HTTP requests directly from the Linux kernel. eBPF requires no SDKs or language-specific agents. It also requires no application restarts. Requirements are Kubernetes 1.21 or later and Linux kernel 4.16 or later; AWS Fargate and Docker Desktop are not supported.

eBPF complements OpenTelemetry rather than replacing it. groundcover accepts OTel as a first-class data source alongside kernel-level signals, and groundcover’s stated framing assigns eBPF the coverage problem and SDKs the depth problem. The wider ecosystem is converging on the same split: Grafana Labs donated Beyla to OpenTelemetry, where it became OpenTelemetry OBI, instrumenting at the protocol level with no restarts or code changes and targeting a stable 1.0 in 2026.

Kernel-level collection matters for the fee question because it makes full coverage the default rather than a per-service project.

Key metrics to track for Kubernetes cost visibility

Cluster cost hides in a handful of gaps between what you provision and what you use. Track these:

• CPU requests vs actual usage: Kubernetes schedules on requests, not consumption, so the gap between the two is capacity you pay the cloud provider for and never use. The OpenCost specification prices workload CPU at the greater of request and usage for exactly this reason.
• Memory requests vs working set: The same request-versus-usage gap applies, measured against container working-set bytes from cAdvisor.
• Persistent volume provisioned vs used: OpenCost prices PV storage on provisioned capacity over time, not bytes written, so an oversized volume costs the same full or empty. Compare kube_persistentvolume_capacity_bytes against kube_persistentvolume_used_bytes.
• Network egress: The network egress guidance warns that cross-zone and internet-bound traffic “can surpass compute costs in multi-region workloads.”
• Custom metric cardinality: Track unique series count per metric; it amplifies the pod-churn mechanics above and drives any volume-priced bill.
• Log volume per namespace: The sizing input for your own ClickHouse or Loki storage under a self-hosted or BYOC model, and the metered line item under SaaS.

Platform and finance teams can use these metrics to calculate cluster cost. Allocation identifies who is spending it.

Cost allocation by namespace, label, pod, and cluster

Shared clusters make attribution the hard part of Kubernetes cost work: many teams’ services share the same nodes, so node-level cost has to be split by workload before anyone can act on it. OpenCost allocates cost in real time by cluster, node, namespace, controller, service, or pod, covering CPU, GPU, memory, and PV allocation with showback and chargeback support. Kubecost’s Allocation API extends this to network attribution with networkCrossZoneCost, networkCrossRegionCost, and networkInternetCost fields.

groundcover provides the same style of breakdown across namespace, label, pod, service, and cluster, with the underlying telemetry already in your VPC. For costs no single team owns, the FinOps Foundation documents proportional or fixed allocation. An even split is another option.

One documented limitation deserves attention when building on open source: in exporter-only mode, OpenCost’s allocation metrics contain only requests, not usage, so efficiency metrics are unavailable there. You need that efficiency data to rightsize workloads.

Identifying and eliminating idle and overprovisioned resources

The gap between requested and used resources is where most Kubernetes spend hides. Cast AI’s 2026 optimization report, a vendor-published study of its own customers’ clusters before optimization, found average CPU utilization of 8% and memory utilization of 20%. Datadog’s 2025 container report found most workloads use less than 25% of their requested CPU and less than half of their requested memory; that headline is cross-platform rather than Kubernetes-only.

Teams know this and still can’t act on it. The CNCF 2023 FinOps microsurvey (more than 100 responses) found over-provisioning was the leading reported factor in cloud overspend at 70%, yet only 19% of respondents had access to accurate Kubernetes cost information. Rightsizing requires continuous per-workload requests-versus-usage data, and under volume-based pricing that data is itself a billable custom-metric surface, so the monitoring needed to cut cloud spend inflates the observability bill.

Storage waste compounds the compute waste. Deleting a StatefulSet does not delete its PVCs by default, and Salesforce identified millions in annual savings from unused storage within its Hyperforce infrastructure.

Node-based vs volume-based pricing: a side-by-side cost comparison

Published list rates from each vendor’s pricing page line up as follows:

The most detailed public comparison is vendor-stated. An October 23, 2025 LinkedIn post by groundcover CEO Shahar Azulay describes a customer moving roughly 700 GKE nodes, 5 TB/day of logs, 8 TB/day of traces, and 500K custom metrics off Datadog: a modeled $2,536,000/year Datadog bill at list price against $297,000/year on groundcover, an 87% reduction. Two caveats apply. The Datadog side assumes list price with no enterprise discount, and the groundcover total includes $45,000/year of BYOC hosting after a 35% cloud savings-plan discount; no independent third party has audited the figure.

Customer-authored evidence points the same direction. TRM Labs’ engineering blog reported cutting observability costs over 80% after replacing Datadog and Splunk with groundcover. The caveats do not change the pricing distinction: under flat per-node pricing, 5 TB of daily logs is a storage-sizing decision inside your own VPC rather than a metered vendor line item.

Monitoring on-premises and air-gapped clusters

Air-gapped clusters rule out SaaS observability entirely, because telemetry cannot leave the enclave. Self-hosted stacks are the baseline there: DoD Platform One’s Big Bang ships in-enclave Prometheus and Grafana as the sanctioned monitoring pattern for air-gapped Kubernetes, and the SWIFT deployment runs “hundreds of Kubernetes clusters around the world, fully disconnected from the internet using GitOps.”

Regulated teams short of a full air gap face the same architectural pressure. FedRAMP boundary guidance requires federal data including metadata in “logs, audit trails, and vulnerability reports” to sit within the authorization boundary, so routing telemetry to an external SaaS pulls that platform into scope or requires its own authorization. A Gartner 2023 APM Magic Quadrant reprint flagged that Datadog’s SaaS-only model “may not be suitable for clients with regulations around data sovereignty.”

groundcover covers this deployment class directly. The Enterprise On-Premises tier at $50/host/month deploys the data plane and a self-hosted control plane on customer premises. The air-gapped model keeps sensors and the data plane inside the customer environment, along with the self-hosted control plane and authentication. The tier includes fully dedicated support for the customer-hosted deployment.

How ingestion-free monitoring fits your cost strategy

Showback and chargeback are the two ways platform teams operationalize cost data, and the FinOps Foundation draws the line precisely: showback reporting is “used for awareness and visibility across the organization” while expenses stay in a central budget, whereas chargeback “charges actual consumption spend of IT services to P&L budgets” and “requires IT Finance Integration.” Forrester found only about half of IT shops have adopted chargeback, and the FinOps community’s maturity distribution sits at Crawl 42.1%, Walk 33.8%, Run 24.1%, so showback is where most teams operate today.

The pricing model changes how hard each is. Flat node-based pricing makes showback arithmetic trivial (nodes × rate) and gives finance a number they can forecast against headcount and cluster growth. Chargeback still requires namespace- and label-level attribution, which OpenCost or platform-level breakdowns supply on top of the flat bill.

Broad access is what turns either model into behavior change, and per-node pricing removes the seat penalty that usually blocks it: Afida expanded from 10 to approximately 100 groundcover users with no change in cost, because pricing is per node and user count does not affect the bill.

If you want to validate the architecture on your own cluster, the free plan includes BYOC and requires no credit card. Deploy Flora on one cluster and evaluate full-cluster visibility within hours.

FAQ

These answers summarize the pricing, deployment, allocation, and rightsizing decisions covered above.

Why do SaaS ingestion fees get so expensive at scale on Kubernetes?

Because Kubernetes can multiply billable units when teams turn changing attributes into labels. Pod replacements create new label combinations, and label cardinalities multiply into new time series. Depending on the vendor, those series increase active-series charges, datapoint volume, or per-GB ingestion, so the bill can grow faster than the cluster.

Which open-source tools eliminate ingestion fees?

Prometheus (Apache 2.0, metrics only), Grafana OSS, the OpenTelemetry Collector, and OpenCost for cost allocation all carry zero license cost. The trade-off is staffing: named-company accounts put self-hosted maintenance at an engineer-day per month per team and multi-month implementation projects. Customer-owned compute and storage costs also grow with telemetry volume and retention.

Can I get accurate cost allocation without a SaaS platform?

Yes. OpenCost allocates in real time by cluster, node, namespace, controller, service, or pod across the major clouds, and groundcover’s BYOC model provides namespace, label, pod, service, and cluster breakdowns with all data in your VPC. Watch for OpenCost’s exporter-only mode, which reports requests without usage.

Which costs less in total, node-based or per-GB pricing?

It depends on telemetry volume per node, and Kubernetes clusters produce a lot of it. The vendor-stated 700-node comparison above modeled an 87% difference at Datadog list prices, and TRM Labs published an over-80% reduction on its own engineering blog (customer-authored, not an independent audit); at low volumes the gap narrows. Total cost under BYOC also includes customer-owned compute and storage.

How do I set up monitoring for an air-gapped cluster?

Run the stack inside the enclave. In-enclave Prometheus and Grafana is the DoD-sanctioned pattern, and groundcover’s air-gapped deployment keeps sensors and the data plane inside your environment, along with the self-hosted control plane and authentication.

Which metrics matter most for Kubernetes cost?

CPU and memory requests versus actual usage, persistent volume capacity versus bytes used, network egress (especially cross-zone), custom metric cardinality, and log volume per namespace. The requests-versus-usage gap is the primary rightsizing signal.

How do I find idle and overprovisioned resources?

Compare requests to actual consumption per workload and track cluster idle cost as OpenCost defines it: allocated capacity assigned to no workload. Also audit PVCs left behind by deleted StatefulSets. Cast AI’s vendor-published study of its own customers’ pre-optimization clusters put average CPU utilization at 8%, so the headroom is usually there.

What’s the difference between showback and chargeback?

Showback reports each team’s consumption while the expense stays in a central budget; chargeback posts the expense to the team’s P&L and requires finance-system integration. AWS notes that “To implement chargeback, a showback mechanism must already be in place,” so showback is the starting point either way.