burn

README

burn

Your Kubernetes cluster is burning money. Find out where.

Why

Running Kubernetes in production gets expensive fast. Most teams overprovision by 40-60% without realizing it. burn identifies exactly which nodes are wasting money and tells you what to do about it.

Features

• Per-node cost breakdown (hourly/monthly)
• Waste detection for underutilized resources
• AI recommendations via Claude (--ai)
• Natural language questions (burn ask)
• Slack slash commands (burn serve)
• Multi-cloud pricing: AWS, Azure (spot aware)
• Multi-cluster support (--context)
• Slack integration (--slack)
• Prometheus integration for real usage metrics (--prometheus)

Install

go install github.com/tanrikuluozlem/burn/cmd/burn@latest

Quick Start

# Basic analysis
burn analyze

# With AI recommendations
burn analyze --ai

# Ask questions about costs
burn ask "which nodes should I convert to spot?"

# Send report to Slack
burn analyze --ai --slack

Configuration

Environment variables:

Variable	Description	Required
ANTHROPIC_API_KEY	Claude API key	For --ai, ask, serve
SLACK_WEBHOOK_URL	Slack webhook URL	For --slack
SLACK_SIGNING_SECRET	Slack app signing secret	For serve

Usage

# Analyze specific namespace
burn analyze -n production

# JSON output
burn analyze -o json

# With Prometheus metrics
burn analyze --prometheus http://prometheus:9090

# Analyze different cluster (multi-cluster)
burn analyze --context my-prod-cluster
burn analyze --context my-staging-cluster --ai

# Ask questions
burn ask "why is this node so expensive?"
burn ask "how can I reduce costs?"
burn ask "what's the risk of using spot instances?"

# Ask with specific cluster context
burn ask --context my-prod-cluster "which nodes should I convert to spot?"

Slack Slash Commands

Run burn serve to enable Slack slash commands:

burn serve --port 8080

# With specific cluster context
burn serve --port 8080 --context my-prod-cluster

Setup

1. Create a Slack App at https://api.slack.com/apps
2. Add a Slash Command: /burn
3. Set Request URL to your server endpoint (e.g., https://burn.example.com/slack)
4. Copy the Signing Secret to SLACK_SIGNING_SECRET
5. Install the app to your workspace

Usage in Slack

/burn analyze                              # Cluster cost summary
/burn ask "which nodes are expensive?"     # AI-powered answers

Endpoints

Endpoint	Method	Description
/health	GET	Health check
/slack	POST	Slack slash command handler

Sample Output

Cluster Cost Analysis - 2024-01-15T09:00:00Z
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

Nodes: 3 | Pods: 47
Hourly: $0.7200 | Monthly: $525.60

NODE                  TYPE        SPOT  PODS  CPU%  MEM%  HOURLY    MONTHLY
────                  ────        ────  ────  ────  ────  ──────    ───────
ip-10-0-1-101         m5.large    yes   8     45%   52%   $0.0500   $36.50
ip-10-0-1-102         m5.xlarge   no    12    68%   72%   $0.1920   $140.16
ip-10-0-1-103         m5.large    yes   3     12%   8%    $0.0500   $36.50

Waste Analysis:
  Underutilized: 1 nodes
  Potential savings: $25.55/mo

  - ip-10-0-1-103 (12%): Very low utilization - consider smaller instance type

How it Works

K8s API → Collector → Analyzer → Advisor (Claude) → Output
              ↑            ↑
         Prometheus    Pricing API
         (recommended)  (AWS/Azure)

When Prometheus is configured, burn uses actual CPU/memory usage for analysis. Without it, pod resource requests are used as a fallback.

Pricing

Costs are calculated using list prices from cloud provider APIs. We fetch prices from AWS Pricing API and Azure Retail Prices API weekly and embed them in the binary. This means you get accurate costs out of the box without any cloud credentials.

The pricing data covers 600+ AWS instance types and 300+ Azure VM sizes across major regions. Updates happen every Monday via a GitHub Action that creates a PR when prices change.

If you need real-time prices or have negotiated discounts, the cloud APIs are called at runtime when credentials are available.

Deployment

Build and push to your registry:

docker build -t your-registry/burn:latest .
docker push your-registry/burn:latest

CronJob

Daily cost reports at 9 AM UTC:

apiVersion: batch/v1
kind: CronJob
metadata:
  name: burn-report
spec:
  schedule: "0 9 * * *"
  jobTemplate:
    spec:
      template:
        spec:
          containers:
          - name: burn
            image: your-registry/burn:latest
            args: ["analyze", "--ai", "--slack", "--prometheus", "http://prometheus:9090"]
            envFrom:
            - secretRef:
                name: burn-secrets
          restartPolicy: OnFailure

Helm Values

# values.yaml
schedule: "0 9 * * *"
prometheus:
  url: "http://prometheus-kube-prometheus-prometheus.monitoring:9090"
secrets:
  existingSecret: "burn-secrets"

Development

# Build
make build

# Test
make test

# Lint
make lint

License

Apache 2.0 - See LICENSE for details.