Skip to main content

Anomaly Detection

K8Cost continuously monitors your cluster costs and alerts you when spending deviates significantly from historical patterns. Catch cost spikes before they become billing surprises.

What It Does​

The anomaly detection engine uses z-score statistical analysis to compare current cost data against a historical baseline. When a metric deviates beyond a configurable threshold, K8Cost flags it as an anomaly and sends a notification.

This runs automatically as a background job -- no manual configuration required. Anomalies are detected across all connected clusters and surfaced in the dashboard.

What Gets Monitored​

  • Cluster-level daily spend -- Detects sudden increases in total cluster cost
  • Namespace-level cost changes -- Identifies when a specific team or service starts spending more than usual
  • Node count fluctuations -- Flags unexpected scaling events that drive up compute costs
  • Resource utilization shifts -- Catches changes in CPU or memory consumption patterns that may indicate misconfiguration or runaway processes

Key Capabilities​

  • Configurable sensitivity -- Adjust the z-score threshold to control how aggressively anomalies are flagged (default: 2.0 standard deviations)
  • Configurable lookback window -- Set how many days of historical data the engine uses as a baseline (default: 30 days)
  • Alert integration -- Anomalies trigger notifications via email, Slack, Microsoft Teams, PagerDuty, or custom webhooks
  • Root cause drill-down -- Click an anomaly to see which namespaces, pods, or nodes contributed to the cost deviation
  • Active / resolved status -- Anomalies are automatically resolved when costs return to normal patterns

How It Prevents Surprise Bills​

A typical scenario: a developer accidentally sets replicas: 50 instead of replicas: 5 in a staging deployment. Without anomaly detection, this quietly runs up your cloud bill for days or weeks until someone notices during the monthly review.

With K8Cost, the spike is detected within the next analysis cycle (hourly by default), flagged as a cost anomaly, and a notification is sent to your team's Slack channel. The anomaly detail page shows exactly which deployment caused the spike and links to the recommendation to fix it.

Sign up free to enable anomaly detection on your clusters.