Finout EKS Kubernetes Agent

The Finout EKS Kubernetes Agent collects the workload metrics Finout needs for Kubernetes cost allocation, without requiring an existing monitoring system.

Availability: Generally available for EKS.

The agent runs inside your cluster, queries native Kubernetes APIs, and deploys its own kube-state-metrics exporter. It uploads metric files to Finout over HTTPS using S3 presigned URLs. No additional monitoring infrastructure required. Cluster access is scoped to least-privilege RBAC, provisioned automatically by the Helm chart.

How it works

The Finout EKS Kubernetes Agent is deployed via Helm and runs as three components in a dedicated namespace:

• kube-state-metrics (Deployment) exposes cluster-wide Kubernetes metadata — workload ownership, labels, and resource requests — as Prometheus metrics.

• Node Otel Collector (DaemonSet) runs on every node in the cluster. It scrapes node-local cAdvisor metrics via the kubelet endpoint and forwards usage telemetry to the Central Collector over gRPC (OTLP).

• Central Collector (Deployment) receives usage metrics from the Node Collectors, scrapes kube-state-metrics, and stages all metrics on disk. A sidecar uploader generates compressed metric files periodically and uploads them to Finout's S3 bucket using presigned URLs fetched from the Finout API.

The agent does not modify, block, or mutate any workloads running in your cluster.

What metrics are collected

The Finout EKS Kubernetes Agent collects only the metrics required for Kubernetes cost allocation from two standard sources:

cAdvisor (via kubelet):

• container_cpu_usage_seconds_total

• container_memory_working_set_bytes

• container_network_receive_bytes_total

• container_network_transmit_bytes_total

Note: The agent automatically excludes container_network_receive_bytes_total and container_network_transmit_bytes_total for pods running with hostNetwork: true. These pods share the node's network namespace, causing cAdvisor to report full node-level traffic per pod — the agent filters them out to prevent network cost inflation.

kube-state-metrics:

• kube_pod_container_resource_requests

• kube_pod_init_container_resource_requests

• kube_node_status_capacity

• kube_node_info

• kube_pod_info

• kube_pod_labels

• kube_namespace_labels

• kube_node_labels

• kube_replicaset_owner, kube_job_owner

Security model

The Finout Kubernetes Agent operates under a least-privilege model.

• RBAC: The Helm chart provisions two ServiceAccounts.

  • The Node Collector is bound to a ClusterRole with a single rule: get on nodes/metrics, enabling kubelet/cAdvisor scraping.

  • The Central Collector has no ClusterRole and communicates exclusively with in-namespace services.

  • kube-state-metrics runs under its own dedicated ServiceAccount with read-only permissions (list and watch) scoped to pods, nodes, namespaces, ReplicaSets, and jobs.

• Pod security: All containers run as non-root (UID 10001 / GID 2000). allowPrivilegeEscalation is disabled, all capabilities are dropped, and the Node Collector runs with a read-only root filesystem. There is no hostNetwork, hostPID, privileged mode, or hostPath mount.

• Network: The agent requires outbound HTTPS only — no inbound ports are opened. Egress is to two destinations:

  • app.finout.io — to fetch presigned S3 upload URLs

  • AWS S3 — to upload metric files

Upload credentials are short-lived presigned URLs, not static API keys. Each URL is scoped to a single upload operation and expires automatically.

Storage

The Central Collector uses a single ReadWriteOnce PersistentVolumeClaim (default: 10 GiB) as a durable staging area for metric files.

A default StorageClass must be available in the cluster, or you can specify one at install time.

Rotated metric files on the PVC survive pod restarts, rescheduling, and node failures. Once a file is uploaded successfully, it is removed from the PVC.

Lifecycle management

The agent follows standard Helm lifecycle practices. You can pin, upgrade, or roll back to specific versions using standard helm upgrade and helm rollback commands.

Next steps

Install the Finout Kubernetes Agent - step-by-step installation guide.