> For the complete documentation index, see [llms.txt](https://docs.finout.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.finout.io/kubernetes-integrations/kubernetes/finout-eks-kubernetes-agent.md).
# Finout EKS Kubernetes Agent
The Finout EKS Kubernetes Agent collects the workload metrics Finout needs for Kubernetes cost allocation, without requiring an existing monitoring system.
**Availability:** Generally available for EKS.
The agent runs inside your cluster, queries native Kubernetes APIs, and deploys its own kube-state-metrics exporter. It uploads metric files to Finout over HTTPS using S3 presigned URLs. No additional monitoring infrastructure required. Cluster access is scoped to least-privilege RBAC, provisioned automatically by the Helm chart.
### How it works
The Finout EKS Kubernetes Agent is deployed via Helm and runs as three components in a dedicated namespace:
* **kube-state-metrics (Deployment)** exposes cluster-wide Kubernetes metadata — workload ownership, labels, and resource requests — as Prometheus metrics.
* **Node Otel Collector (DaemonSet)** runs on every node in the cluster. It scrapes node-local cAdvisor metrics via the kubelet endpoint and forwards usage telemetry to the Central Collector over gRPC (OTLP).
* **Central Collector (Deployment)** receives usage metrics from the Node Collectors, scrapes kube-state-metrics, and stages all metrics on disk. A sidecar uploader generates compressed metric files periodically and uploads them to Finout's S3 bucket using presigned URLs fetched from the Finout API.
The agent does not modify, block, or mutate any workloads running in your cluster.
### What metrics are collected
The Finout EKS Kubernetes Agent collects only the metrics required for Kubernetes cost allocation from two standard sources:
**cAdvisor (via kubelet):**
* `container_cpu_usage_seconds_total`
* `container_memory_working_set_bytes`
* `container_network_receive_bytes_total`
* `container_network_transmit_bytes_total`
{% hint style="info" %}
**Note:** The agent automatically excludes `container_network_receive_bytes_total` and `container_network_transmit_bytes_total` for pods running with `hostNetwork: true`. These pods share the node's network namespace, causing cAdvisor to report full node-level traffic per pod — the agent filters them out to prevent network cost inflation.
{% endhint %}
**kube-state-metrics:**
* `kube_pod_container_resource_requests`
* `kube_pod_init_container_resource_requests`
* `kube_node_status_capacity`
* `kube_node_info`
* `kube_pod_info`
* `kube_pod_labels`
* `kube_namespace_labels`
* `kube_node_labels`
* `kube_replicaset_owner`, `kube_job_owner`
### Security model
The Finout Kubernetes Agent operates under a least-privilege model.
* **RBAC:** The Helm chart provisions two ServiceAccounts.
* The Node Collector is bound to a ClusterRole with a single rule: `get` on `nodes/metrics`, enabling kubelet/cAdvisor scraping.
* The Central Collector has no ClusterRole and communicates exclusively with in-namespace services.
* kube-state-metrics runs under its own dedicated ServiceAccount with read-only permissions (`list` and `watch`) scoped to pods, nodes, namespaces, ReplicaSets, and jobs.
* **Pod security:** All containers run as non-root (UID 10001 / GID 2000). `allowPrivilegeEscalation` is disabled, all capabilities are dropped, and the Node Collector runs with a read-only root filesystem. \
There is no `hostNetwork`, `hostPID`, privileged mode, or `hostPath` mount.
* **Network:** The agent requires outbound HTTPS only — no inbound ports are opened. Egress is to two destinations:
* `app.finout.io` — to fetch presigned S3 upload URLs
* AWS S3 — to upload metric files
Upload credentials are short-lived presigned URLs, not static API keys. Each URL is scoped to a single upload operation and expires automatically.
### Storage
The Central Collector uses a single `ReadWriteOnce` PersistentVolumeClaim (default: 10 GiB) as a durable staging area for metric files.
**A default StorageClass must be available in the cluster, or you can specify one at install time.**
Rotated metric files on the PVC survive pod restarts, rescheduling, and node failures. Once a file is uploaded successfully, it is removed from the PVC.
### Lifecycle management
The agent follows standard Helm lifecycle practices. You can pin, upgrade, or roll back to specific versions using standard `helm upgrade` and `helm rollback` commands.
### Next steps
Install the [Finout Kubernetes Agent - step-by-step installation](/kubernetes-integrations/kubernetes/finout-kubernetes-agent/install-the-finout-kubernetes-agent.md) guide.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://docs.finout.io/kubernetes-integrations/kubernetes/finout-eks-kubernetes-agent.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
