feat(init): init --with-opencost deploys OpenCost for precise Tier-2 cost

Make `kubectl tidy init` optionally install OpenCost into the cluster so scans
get precise allocated cost (spot/reserved/CUD discounts) out of the box, instead
of blended derived pricing — no separate OpenCost setup.

- Embed a minimal OpenCost manifest (namespace, SA, ClusterRole/Binding,
  Deployment, Service on :9003 at opencost.opencost.svc — which kubetidy already
  auto-detects for Tier 2). Prometheus endpoint is templated via a placeholder.
- `init --with-opencost` applies it; `--prometheus-url` points OpenCost at your
  Prometheus (defaults to http://prometheus-server.monitoring.svc:80).
- `init --print --with-opencost` emits the manifests for GitOps instead.
- `uninstall --with-opencost` removes it (off by default, so a user's own
  OpenCost is never touched); deleted before the operator, idempotently.
- Docs: README setup + Tier 2 section, ROADMAP (producer side of Tier 2),
  CHANGELOG [Unreleased].

Author: mayur-tolexo

CHANGELOG.md

@@ -8,6 +8,12 @@ fixes/UX).
 ## [Unreleased]
 
 ### Added
+- **`kubetidy init --with-opencost`** — optionally deploy OpenCost into the cluster (namespace,
+  RBAC, deployment, service; embedded manifests) so scans get precise Tier-2 cost out of the box.
+  OpenCost reads usage from Prometheus; point it with `--prometheus-url` (defaults to
+  `http://prometheus-server.monitoring.svc:80`). `kubetidy uninstall --with-opencost` removes it
+  again (off by default, so a user's own OpenCost is never touched). `init --print --with-opencost`
+  emits the manifests for GitOps instead of applying them.
 - **`kubetidy cost`** — the CI cost-guardrail. Prices CPU/memory requests in manifests (no
   cluster) and, with `--base`/`--head`, reports the monthly $ a change adds or saves
   ("this change adds $88/mo"); `--fail-over <budget>` fails CI on a net increase. Example

README.md

@@ -54,7 +54,8 @@ Tier 1 works on **any cluster** with no cost dependency — the dollar figure is
 blended cloud pricing (override with `--cpu-cost` / `--mem-cost`). Tier 2 kicks in when an
 in-cluster **OpenCost** is present (it needs Prometheus, which is why it sits above Tier 1):
 kubetidy auto-detects it and replaces the derived prices with real allocated cost. Point at one
-explicitly with `--opencost-url`.
+explicitly with `--opencost-url`, or let kubetidy deploy it for you with
+`kubectl tidy init --with-opencost` (see [setup](#one-command-setup-kubectl-tidy-init)).
 
 Within Tier 1, kubetidy auto-detects the best **usage** source — Prometheus or the kubetidy
 operator (historical, high-confidence) over a bare metrics-server snapshot (a conservative
@@ -111,18 +112,37 @@ kubectl tidy init                 # install the CRD + operator (server-side appl
 kubectl tidy init --crd-only      # just the CRD (e.g. GitOps manages the Deployment)
 kubectl tidy init --print         # print the manifests instead of applying them
 kubectl tidy init --image REPO/kubetidy-operator:TAG   # pin a custom operator image
+kubectl tidy init --with-opencost # also deploy OpenCost for precise Tier-2 cost (needs Prometheus)
 ```
 
 `init` applies the CRD first, waits for it to become Established, then deploys the operator.
 It is idempotent — re-run it any time to converge the cluster to the embedded manifests.
 
+### Precise cost out of the box: `--with-opencost`
+
+`--with-opencost` additionally deploys [OpenCost](https://www.opencost.io/) (namespace, RBAC,
+deployment, and service — all embedded) so scans report **precise Tier-2 cost** from your
+cluster's actual node pricing (spot / reserved / committed-use discounts included), instead of
+blended derived pricing. kubetidy auto-detects the deployed OpenCost at `opencost.opencost.svc:9003`.
+
+OpenCost reads usage from Prometheus, so point it at yours:
+
+```sh
+kubectl tidy init --with-opencost \
+  --prometheus-url http://prometheus-server.monitoring.svc:80   # this is the default
+```
+
+`--print --with-opencost` emits the OpenCost manifests too, for GitOps. To remove it later,
+`kubectl tidy uninstall --with-opencost` (off by default, so your own OpenCost is never touched).
+
 To remove everything `init` created, use its inverse:
 
 ```sh
 kubectl tidy uninstall              # delete the operator + all CRDs (and recorded data); prompts first
 kubectl tidy uninstall --dry-run    # list exactly what would be removed; deletes nothing
 kubectl tidy uninstall --yes        # skip the confirmation prompt
 kubectl tidy uninstall --keep-crds  # remove only the operator; keep the CRDs and history
+kubectl tidy uninstall --with-opencost  # also remove OpenCost installed via init --with-opencost
 kubectl tidy cleanup                # alias for uninstall
 ```
 

ROADMAP.md

@@ -48,9 +48,11 @@ This roadmap is intentionally public and open for discussion — please weigh in
       no Prometheus (the real Tier 0). The first, safe increment of the operator. See
       [docs/design/operator.md](docs/design/operator.md).
 - [x] **`kubectl tidy init`** — install the CRD + operator from manifests embedded in the
-      binary; no manual `kubectl apply`.
+      binary; no manual `kubectl apply`. `--with-opencost` also deploys OpenCost (the producer
+      side of Tier 2) so precise cost works out of the box; `uninstall --with-opencost` reverses it.
 - [ ] Guarded `apply` with auto-rollback on SLO regression
-- [x] Tier 2: OpenCost integration for precise allocated cost (auto-detected, or `--opencost-url`)
+- [x] Tier 2: OpenCost integration for precise allocated cost — consume an existing OpenCost
+      (auto-detected, or `--opencost-url`) **or deploy one** with `init --with-opencost`
 - [x] **Recommendation CRDs** — the operator writes a per-workload `Recommendation` (the LLM
       target; rules-engine source today). Multi-cluster aggregation still to come.
 - [x] **Confidence that grows with data** — recommendations are graded low/med/high and gated

internal/cli/init.go

@@ -15,10 +15,12 @@ import (
 )
 
 type initFlags struct {
-	kubeContext string
-	crdOnly     bool
-	printOnly   bool
-	image       string
+	kubeContext   string
+	crdOnly       bool
+	printOnly     bool
+	image         string
+	withOpenCost  bool
+	prometheusURL string
 }
 
 // discoveryFor is a seam so tests can substitute the discovery client. In production it builds
@@ -60,6 +62,8 @@ func newInitCommand() *cobra.Command {
 	flags.BoolVar(&f.crdOnly, "crd-only", false, "install only the UsageProfile CRD, not the operator")
 	flags.BoolVar(&f.printOnly, "print", false, "print the manifests that would be applied, and exit")
 	flags.StringVar(&f.image, "image", "", "operator container image to deploy (required on a real cluster; the embedded default is a local kind-only tag)")
+	flags.BoolVar(&f.withOpenCost, "with-opencost", false, "also deploy OpenCost (needs Prometheus) so scans get precise Tier-2 cost out of the box")
+	flags.StringVar(&f.prometheusURL, "prometheus-url", "", "Prometheus endpoint OpenCost reads from (with --with-opencost; default http://prometheus-server.monitoring.svc:80)")
 	return cmd
 }
 
@@ -76,6 +80,10 @@ func runInit(ctx context.Context, f *initFlags) error {
 			b.WriteString("---\n")
 			b.Write(installer.OperatorManifest())
 		}
+		if f.withOpenCost {
+			b.WriteString("---\n")
+			b.Write(installer.OpenCostManifest(f.prometheusURL))
+		}
 		_, err := io.WriteString(os.Stdout, b.String())
 		return err
 	}
@@ -91,15 +99,21 @@ func runInit(ctx context.Context, f *initFlags) error {
 
 	opts := installer.Options{
 		IncludeOperator: !f.crdOnly,
+		IncludeOpenCost: f.withOpenCost,
+		PrometheusURL:   f.prometheusURL,
 		Image:           f.image,
 		Log:             func(msg string) { _, _ = fmt.Fprintln(os.Stdout, "•", msg) },
 	}
 	if err := installer.Install(ctx, dyn, disco, opts); err != nil {
 		return err
 	}
 
-	_, err = io.WriteString(os.Stdout,
-		"\n✓ kubetidy installed. The operator needs a few minutes to accumulate history;\n"+
-			"  after that, `kubectl tidy scan` runs at Tier 0 with no Prometheus.\n")
+	msg := "\n✓ kubetidy installed. The operator needs a few minutes to accumulate history;\n" +
+		"  after that, `kubectl tidy scan` runs at Tier 0 with no Prometheus.\n"
+	if f.withOpenCost {
+		msg += "  OpenCost is deploying in the opencost namespace; once it's ready, scans show\n" +
+			"  precise Tier-2 cost from your cluster's actual node pricing.\n"
+	}
+	_, err = io.WriteString(os.Stdout, msg)
 	return err
 }

internal/cli/init_test.go

@@ -19,13 +19,45 @@ func TestInitCommandFlags(t *testing.T) {
 	if cmd.Use != "init" {
 		t.Errorf("Use = %q, want init", cmd.Use)
 	}
-	for _, name := range []string{"context", "crd-only", "print", "image"} {
+	for _, name := range []string{"context", "crd-only", "print", "image", "with-opencost", "prometheus-url"} {
 		if cmd.Flags().Lookup(name) == nil {
 			t.Errorf("init command missing --%s flag", name)
 		}
 	}
 }
 
+func TestRunInitPrintWithOpenCost(t *testing.T) {
+	out := captureStdout(t, func() {
+		if err := runInit(context.Background(), &initFlags{
+			printOnly:     true,
+			withOpenCost:  true,
+			prometheusURL: "http://prom.observability.svc:9090",
+		}); err != nil {
+			t.Errorf("runInit --print --with-opencost error: %v", err)
+		}
+	})
+	if !strings.Contains(out, "kubetidy-operator") {
+		t.Error("print output missing the operator")
+	}
+	if !strings.Contains(out, "opencost") {
+		t.Error("print output missing OpenCost manifest")
+	}
+	if !strings.Contains(out, "http://prom.observability.svc:9090") {
+		t.Error("print output missing the substituted Prometheus URL")
+	}
+}
+
+func TestRunInitPrintNoOpenCostByDefault(t *testing.T) {
+	out := captureStdout(t, func() {
+		if err := runInit(context.Background(), &initFlags{printOnly: true}); err != nil {
+			t.Errorf("runInit --print error: %v", err)
+		}
+	})
+	if strings.Contains(out, "PROMETHEUS_SERVER_ENDPOINT") {
+		t.Error("OpenCost manifest should not be printed without --with-opencost")
+	}
+}
+
 func TestRunInitPrintFull(t *testing.T) {
 	out := captureStdout(t, func() {
 		if err := runInit(context.Background(), &initFlags{printOnly: true}); err != nil {

internal/cli/uninstall.go

@@ -14,10 +14,11 @@ import (
 )
 
 type uninstallFlags struct {
-	kubeContext string
-	keepCRDs    bool
-	yes         bool
-	dryRun      bool
+	kubeContext  string
+	keepCRDs     bool
+	withOpenCost bool
+	yes          bool
+	dryRun       bool
 }
 
 // confirmReader is the input used for the interactive confirmation prompt; overridable in
@@ -43,6 +44,7 @@ func newUninstallCommand() *cobra.Command {
 	flags := cmd.Flags()
 	flags.StringVar(&f.kubeContext, "context", "", "kubeconfig context to use")
 	flags.BoolVar(&f.keepCRDs, "keep-crds", false, "remove only the operator; keep the CRDs and recorded data")
+	flags.BoolVar(&f.withOpenCost, "with-opencost", false, "also remove the OpenCost deployment kubetidy installed with init --with-opencost")
 	flags.BoolVar(&f.dryRun, "dry-run", false, "list what would be removed without deleting anything")
 	flags.BoolVarP(&f.yes, "yes", "y", false, "skip the confirmation prompt")
 	return cmd
@@ -76,9 +78,10 @@ func runUninstall(ctx context.Context, f *uninstallFlags) error {
 
 	logf := func(msg string) { _, _ = fmt.Fprintln(os.Stdout, "•", msg) }
 	if err := installer.Uninstall(ctx, dyn, disco, installer.UninstallOptions{
-		KeepCRDs: f.keepCRDs,
-		DryRun:   f.dryRun,
-		Log:      logf,
+		KeepCRDs:        f.keepCRDs,
+		IncludeOpenCost: f.withOpenCost,
+		DryRun:          f.dryRun,
+		Log:             logf,
 	}); err != nil {
 		return err
 	}

internal/cli/uninstall_test.go

@@ -13,7 +13,7 @@ func TestUninstallCommandFlags(t *testing.T) {
 	if cmd.Use != "uninstall" {
 		t.Errorf("Use = %q, want uninstall", cmd.Use)
 	}
-	for _, name := range []string{"context", "keep-crds", "yes"} {
+	for _, name := range []string{"context", "keep-crds", "with-opencost", "yes"} {
 		if cmd.Flags().Lookup(name) == nil {
 			t.Errorf("uninstall command missing --%s flag", name)
 		}

internal/installer/assets/opencost.yaml

@@ -0,0 +1,130 @@
+# Minimal OpenCost deployment, applied by `kubectl tidy init --with-opencost`. OpenCost reads
+# usage from Prometheus and exposes an allocation API on :9003 at opencost.opencost.svc — which
+# kubetidy auto-detects for precise Tier-2 cost. __PROMETHEUS_URL__ is substituted by the
+# installer with the Prometheus endpoint.
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: opencost
+  labels:
+    app.kubernetes.io/managed-by: kubetidy
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: opencost
+  namespace: opencost
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: opencost
+rules:
+  - apiGroups: [""]
+    resources:
+      - configmaps
+      - nodes
+      - pods
+      - services
+      - resourcequotas
+      - replicationcontrollers
+      - limitranges
+      - persistentvolumeclaims
+      - persistentvolumes
+      - namespaces
+      - endpoints
+      - events
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["apps"]
+    resources: ["daemonsets", "deployments", "replicasets", "statefulsets"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["batch"]
+    resources: ["cronjobs", "jobs"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["autoscaling"]
+    resources: ["horizontalpodautoscalers"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["storage.k8s.io"]
+    resources: ["storageclasses"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["metrics.k8s.io"]
+    resources: ["pods", "nodes"]
+    verbs: ["get", "list", "watch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: opencost
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: opencost
+subjects:
+  - kind: ServiceAccount
+    name: opencost
+    namespace: opencost
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: opencost
+  namespace: opencost
+  labels:
+    app: opencost
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: opencost
+  template:
+    metadata:
+      labels:
+        app: opencost
+    spec:
+      serviceAccountName: opencost
+      containers:
+        - name: opencost
+          image: ghcr.io/opencost/opencost:latest
+          imagePullPolicy: IfNotPresent
+          ports:
+            - name: http
+              containerPort: 9003
+          env:
+            - name: PROMETHEUS_SERVER_ENDPOINT
+              value: "__PROMETHEUS_URL__"
+            - name: CLUSTER_ID
+              value: "kubetidy"
+          resources:
+            requests:
+              cpu: 10m
+              memory: 55Mi
+            limits:
+              cpu: "1"
+              memory: 1Gi
+          livenessProbe:
+            httpGet:
+              path: /healthz
+              port: 9003
+            initialDelaySeconds: 30
+            periodSeconds: 20
+          readinessProbe:
+            httpGet:
+              path: /healthz
+              port: 9003
+            initialDelaySeconds: 10
+            periodSeconds: 10
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: opencost
+  namespace: opencost
+  labels:
+    app: opencost
+spec:
+  selector:
+    app: opencost
+  ports:
+    - name: opencost
+      port: 9003
+      targetPort: 9003