Merge pull request #10 from mayur-tolexo/feat/opencost-pricing

feat(pricing): OpenCost-backed precise cost (Tier 2), auto-detected

Author: mayur-tolexo

README.md

@@ -39,15 +39,23 @@ and **acting on** the recommendations. kubetidy is built around trust:
 kubetidy auto-detects the best data source available and stamps every finding with the tier
 that proved it. It never fails hard — it degrades to whatever is present.
 
-| Tier | Needs | You get | Confidence |
-|------|-------|---------|------------|
-| 0 | K8s API + **kubetidy operator** | historical P50/P95/max with **no Prometheus** | high |
-| — | K8s API + metrics-server only | single live snapshot (fallback, conservative) | low |
-| 1 | + Prometheus | historical P50/P95/max over a window | high |
-| 2 | + OpenCost *(coming)* | precise allocated cost | high |
+There are two tiers — the difference is **how the dollars are priced**:
 
-kubetidy prefers, in order: **Prometheus (Tier 1)** → **kubetidy operator (Tier 0)** → bare
-metrics-server snapshot (a conservative fallback). All are auto-detected; no flags required.
+| Tier | Needs | Usage data | Cost basis |
+|------|-------|------------|------------|
+| 1 | K8s API + metrics-server **or** Prometheus | live snapshot (metrics-server) or historical P50/P95/max (Prometheus / kubetidy operator) | **derived** node pricing (blended `$/core`, `$/GiB`, refined by instance type) |
+| 2 | Prometheus + **OpenCost** | historical P50/P95/max | **precise allocated cost** from OpenCost (spot / reserved / committed-use discounts included) |
+
+Tier 1 works on **any cluster** with no cost dependency — the dollar figure is derived from
+blended cloud pricing (override with `--cpu-cost` / `--mem-cost`). Tier 2 kicks in when an
+in-cluster **OpenCost** is present (it needs Prometheus, which is why it sits above Tier 1):
+kubetidy auto-detects it and replaces the derived prices with real allocated cost. Point at one
+explicitly with `--opencost-url`.
+
+Within Tier 1, kubetidy auto-detects the best **usage** source — Prometheus or the kubetidy
+operator (historical, high-confidence) over a bare metrics-server snapshot (a conservative
+fallback) — and stamps every finding with what proved it. No flags required; it never fails
+hard, degrading to whatever is present.
 
 ## Install
 
@@ -277,8 +285,8 @@ All defaults are surfaced in `--explain` and overridable. The number is never a
 ## Status
 
 🚧 **Active development.** `scan`, `diff`, `pr`, and `init` work today, with a read-only
-operator (Tier 0) and Prometheus auto-detection. See the [roadmap](ROADMAP.md) for what is
-next (guarded apply, OpenCost cost, multi-cluster), and
+operator, Prometheus auto-detection, and OpenCost auto-detection for precise cost (Tier 2). See
+the [roadmap](ROADMAP.md) for what is next (guarded apply, multi-cluster), and
 [docs/ARCHITECTURE.md](docs/ARCHITECTURE.md) for the high-level design and flow diagrams.
 
 ## Contributing

ROADMAP.md

@@ -49,7 +49,7 @@ This roadmap is intentionally public and open for discussion — please weigh in
 - [x] **`kubectl tidy init`** — install the CRD + operator from manifests embedded in the
       binary; no manual `kubectl apply`.
 - [ ] Guarded `apply` with auto-rollback on SLO regression
-- [ ] Tier 2: OpenCost integration for precise allocated cost
+- [x] Tier 2: OpenCost integration for precise allocated cost (auto-detected, or `--opencost-url`)
 - [ ] Accountability: per-team showback + budgets
 - [ ] Recommendation CRDs + multi-cluster aggregation (continuous, in-cluster)
 - [ ] Cleanup detectors (orphaned services/PVCs, idle namespaces, zombie workloads)

docs/ARCHITECTURE.md

@@ -96,7 +96,11 @@ flowchart LR
     ts --> rec
 ```
 
-Tier 2 (OpenCost) is defined behind the `PriceProvider` interface and deferred.
+Cost is a separate axis from usage, behind the `pricing.Provider` interface. By default kubetidy
+derives prices from blended cloud rates (`pricing.NewConfigProvider`). When an in-cluster
+**OpenCost** is detected (`pricing.DetectOpenCost`) — or pointed at via `--opencost-url` — the
+`opencostProvider` queries its allocation API and serves precise per-workload allocated cost
+(Tier 2). OpenCost needs Prometheus, which is why Tier 2 sits above Tier 1.
 
 ## The operator (Tier 0)
 

internal/cli/diff.go

@@ -33,6 +33,7 @@ func newDiffCommand() *cobra.Command {
 	flags.StringVar(&f.explain, "explain", "", "only show the patch for a single workload")
 	flags.IntVar(&f.topN, "top", 20, "max patches to show (0 = all)")
 	flags.StringVar(&f.prometheusURL, "prometheus-url", "", "Prometheus base URL (forces Tier 1)")
+	flags.StringVar(&f.opencostURL, "opencost-url", "", "OpenCost base URL for precise cost (forces Tier 2; auto-detected otherwise)")
 	flags.StringVar(&f.window, "window", "14d", "Prometheus lookback window")
 	flags.Float64Var(&f.cpuCoreMonth, "cpu-cost", 0, "override $ per CPU core-month (0 = default)")
 	flags.Float64Var(&f.memGiBMonth, "mem-cost", 0, "override $ per GiB-month (0 = default)")

internal/cli/orchestration_test.go

@@ -2,13 +2,16 @@ package cli
 
 import (
 	"context"
+	"net/http"
+	"net/http/httptest"
 	"strings"
 	"testing"
 
 	appsv1 "k8s.io/api/apps/v1"
 	corev1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/api/resource"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/client-go/kubernetes"
 	kfake "k8s.io/client-go/kubernetes/fake"
 	mfake "k8s.io/metrics/pkg/client/clientset/versioned/fake"
 
@@ -191,3 +194,67 @@ func TestRunPRInjectedEmpty(t *testing.T) {
 		t.Errorf("unexpected pr output:\n%s", out)
 	}
 }
+
+// --- price provider selection (Tier 1 derived vs Tier 2 OpenCost) ----------------------------
+
+func TestSelectPriceProviderDefaultDerived(t *testing.T) {
+	var warnings []string
+	p := selectPriceProvider(context.Background(), orchFakeClients(t), &scanFlags{window: "14d"}, &warnings)
+	if p.Name() != "node pricing" {
+		t.Errorf("provider = %q, want node pricing (Tier 1 default)", p.Name())
+	}
+}
+
+func TestSelectPriceProviderExplicitOpenCost(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		_, _ = w.Write([]byte(`{"code":200,"data":[{"shop/api":{"name":"shop/api",` +
+			`"properties":{"namespace":"shop","controller":"api"},` +
+			`"cpuCoreHours":10,"cpuCost":0.5,"ramByteHours":1073741824000,"ramCost":0.2}}]}`))
+	}))
+	defer srv.Close()
+
+	var warnings []string
+	p := selectPriceProvider(context.Background(), orchFakeClients(t),
+		&scanFlags{opencostURL: srv.URL, window: "7d"}, &warnings)
+	if p.Name() != "OpenCost" {
+		t.Errorf("provider = %q, want OpenCost", p.Name())
+	}
+	if !strings.Contains(strings.Join(warnings, " "), "OpenCost") {
+		t.Errorf("warnings = %v, want an OpenCost note", warnings)
+	}
+}
+
+func TestSelectPriceProviderBadOpenCostFallsBack(t *testing.T) {
+	var warnings []string
+	p := selectPriceProvider(context.Background(), orchFakeClients(t),
+		&scanFlags{opencostURL: "http://opencost.invalid:9003", window: "7d"}, &warnings)
+	if p.Name() != "node pricing" {
+		t.Errorf("provider = %q, want node pricing fallback", p.Name())
+	}
+	if !strings.Contains(strings.Join(warnings, " "), "unavailable") {
+		t.Errorf("warnings = %v, want an unavailable note", warnings)
+	}
+}
+
+func TestSelectPriceProviderAutoDetect(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		_, _ = w.Write([]byte(`{"code":200,"data":[{"shop/api":{"name":"shop/api",` +
+			`"properties":{"namespace":"shop","controller":"api"},` +
+			`"cpuCoreHours":10,"cpuCost":0.5,"ramByteHours":1073741824000,"ramCost":0.2}}]}`))
+	}))
+	defer srv.Close()
+
+	// Override the detection seam so auto-detect resolves to the reachable test server.
+	origDetect := detectOpenCost
+	defer func() { detectOpenCost = origDetect }()
+	detectOpenCost = func(kubernetes.Interface) string { return srv.URL }
+
+	var warnings []string
+	p := selectPriceProvider(context.Background(), orchFakeClients(t), &scanFlags{window: "7d"}, &warnings)
+	if p.Name() != "OpenCost" {
+		t.Errorf("provider = %q, want auto-detected OpenCost", p.Name())
+	}
+	if !strings.Contains(strings.Join(warnings, " "), "auto-detected OpenCost") {
+		t.Errorf("warnings = %v, want auto-detected OpenCost note", warnings)
+	}
+}

internal/cli/scan.go

@@ -22,6 +22,7 @@ type scanFlags struct {
 	explain       string
 	topN          int
 	prometheusURL string
+	opencostURL   string
 	window        string
 	cpuCoreMonth  float64
 	memGiBMonth   float64
@@ -53,6 +54,7 @@ func newScanCommand() *cobra.Command {
 	flags.StringVar(&f.explain, "explain", "", "show full derivation for a single workload")
 	flags.IntVar(&f.topN, "top", 20, "max recommendations to show (0 = all)")
 	flags.StringVar(&f.prometheusURL, "prometheus-url", "", "Prometheus base URL (forces Tier 1)")
+	flags.StringVar(&f.opencostURL, "opencost-url", "", "OpenCost base URL for precise cost (forces Tier 2; auto-detected otherwise)")
 	flags.StringVar(&f.window, "window", "14d", "Prometheus lookback window")
 	flags.Float64Var(&f.cpuCoreMonth, "cpu-cost", 0, "override $ per CPU core-month (0 = default)")
 	flags.Float64Var(&f.memGiBMonth, "mem-cost", 0, "override $ per GiB-month (0 = default)")
@@ -100,14 +102,7 @@ func runEngineWithClients(ctx context.Context, f *scanFlags, clients *kube.Clien
 	var warnings []string
 	usageProvider := selectUsageProvider(clients, f, &warnings)
 
-	cfg := pricing.DefaultConfig()
-	if f.cpuCoreMonth > 0 {
-		cfg.CPUCoreMonth = f.cpuCoreMonth
-	}
-	if f.memGiBMonth > 0 {
-		cfg.MemGiBMonth = f.memGiBMonth
-	}
-	priceProvider := pricing.NewConfigProvider(cfg)
+	priceProvider := selectPriceProvider(ctx, clients, f, &warnings)
 
 	engine := &scan.Engine{
 		Workloads: workloads,
@@ -158,6 +153,47 @@ func selectUsageProvider(clients *kube.Clients, f *scanFlags, warnings *[]string
 	return usage.NewMetricsServerProvider(clients.Metrics)
 }
 
+// detectOpenCost is a seam over pricing.DetectOpenCost so tests can point auto-detection at a
+// reachable endpoint (the real detector returns an in-cluster URL that a unit test can't reach).
+var detectOpenCost = pricing.DetectOpenCost
+
+// selectPriceProvider picks the cost source, mirroring selectUsageProvider:
+//   - an explicit --opencost-url forces Tier 2 (precise allocated cost);
+//   - otherwise kubetidy auto-detects an in-cluster OpenCost/Kubecost service and uses it when
+//     its allocation API answers, upgrading cost to Tier 2 with no configuration;
+//   - failing that, it falls back to derived node pricing (configProvider), honoring the
+//     --cpu-cost / --mem-cost overrides.
+//
+// Every upgrade or failed attempt is recorded in warnings so the report explains the source.
+func selectPriceProvider(ctx context.Context, clients *kube.Clients, f *scanFlags, warnings *[]string) pricing.Provider {
+	cfg := pricing.DefaultConfig()
+	if f.cpuCoreMonth > 0 {
+		cfg.CPUCoreMonth = f.cpuCoreMonth
+	}
+	if f.memGiBMonth > 0 {
+		cfg.MemGiBMonth = f.memGiBMonth
+	}
+	fallback := pricing.NewConfigProvider(cfg)
+
+	if f.opencostURL != "" {
+		p, err := pricing.NewOpenCostProvider(ctx, f.opencostURL, f.window)
+		if err == nil {
+			*warnings = append(*warnings, fmt.Sprintf("using OpenCost at %s for cost (Tier 2)", f.opencostURL))
+			return p
+		}
+		*warnings = append(*warnings, fmt.Sprintf("OpenCost unavailable (%v); using derived node pricing", err))
+		return fallback
+	}
+
+	if url := detectOpenCost(clients.Kube); url != "" {
+		if p, err := pricing.NewOpenCostProvider(ctx, url, f.window); err == nil {
+			*warnings = append(*warnings, fmt.Sprintf("auto-detected OpenCost at %s (Tier 2 cost)", url))
+			return p
+		}
+	}
+	return fallback
+}
+
 func render(result model.ScanResult, f *scanFlags) error {
 	switch f.output {
 	case "json":

internal/pricing/config.go

@@ -17,9 +17,9 @@ type Config struct {
 //
 // These are deliberate approximations: ~$24.0 per vCPU-core-month and ~$3.2 per GiB-month,
 // roughly a general-purpose vCPU/GiB blended across AWS/GCP/Azure on-demand list pricing as
-// of 2025. They give the Tier-0/Tier-1 scan a credible dollar figure without any external
-// cost source. When OpenCost is available (Tier 2, deferred), these derived prices are
-// replaced by precise allocated cost. Operators can override via flags.
+// of 2025. They give the scan a credible dollar figure without any external cost source
+// (Tier 1). When OpenCost is available (Tier 2), opencostProvider replaces these derived
+// prices with precise allocated cost. Operators can override via flags.
 func DefaultConfig() Config {
 	return Config{CPUCoreMonth: 24.0, MemGiBMonth: 3.2}
 }

internal/pricing/detect.go

@@ -0,0 +1,61 @@
+package pricing
+
+import (
+	"context"
+	"fmt"
+	"time"
+
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/client-go/kubernetes"
+)
+
+// ocCandidate is a well-known OpenCost / Kubecost Service location to probe, in priority order.
+type ocCandidate struct {
+	namespace string
+	service   string
+	port      int32
+}
+
+// opencostCandidates lists common in-cluster OpenCost (and Kubecost) API service locations,
+// most standard first. OpenCost's API listens on 9003; Kubecost's cost-analyzer on 9090.
+var opencostCandidates = []ocCandidate{
+	{"opencost", "opencost", 9003},
+	{"opencost", "opencost-opencost", 9003},
+	{"monitoring", "opencost", 9003},
+	{"kubecost", "kubecost-cost-analyzer", 9090},
+	{"kubecost", "kubecost-cost-analyzer-abc", 9090},
+}
+
+// DetectOpenCost probes the cluster for a well-known OpenCost (or Kubecost) Service and returns
+// its in-cluster API base URL (e.g. "http://opencost.opencost.svc:9003") when found, or ""
+// when none is present. Like DetectPrometheus, it only confirms the Service exists; the caller
+// (NewOpenCostProvider) validates that the API actually answers. Best-effort, never errors.
+func DetectOpenCost(client kubernetes.Interface) string {
+	if client == nil {
+		return ""
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+
+	for _, c := range opencostCandidates {
+		svc, err := client.CoreV1().Services(c.namespace).Get(ctx, c.service, metav1.GetOptions{})
+		if err != nil || svc == nil {
+			continue
+		}
+		port := c.port
+		if p := firstServicePort(svc); p != 0 {
+			port = p
+		}
+		return fmt.Sprintf("http://%s.%s.svc:%d", c.service, c.namespace, port)
+	}
+	return ""
+}
+
+// firstServicePort returns the first declared port of a Service, or 0 if none.
+func firstServicePort(svc *corev1.Service) int32 {
+	if svc == nil || len(svc.Spec.Ports) == 0 {
+		return 0
+	}
+	return svc.Spec.Ports[0].Port
+}

internal/pricing/detect_test.go

@@ -0,0 +1,71 @@
+package pricing
+
+import (
+	"testing"
+
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/client-go/kubernetes/fake"
+)
+
+func svc(name, namespace string, ports ...int32) *corev1.Service {
+	s := &corev1.Service{ObjectMeta: metav1.ObjectMeta{Name: name, Namespace: namespace}}
+	for _, p := range ports {
+		s.Spec.Ports = append(s.Spec.Ports, corev1.ServicePort{Port: p})
+	}
+	return s
+}
+
+func TestDetectOpenCost_NilClient(t *testing.T) {
+	if got := DetectOpenCost(nil); got != "" {
+		t.Fatalf("DetectOpenCost(nil) = %q, want empty", got)
+	}
+}
+
+func TestDetectOpenCost_EmptyCluster(t *testing.T) {
+	if got := DetectOpenCost(fake.NewSimpleClientset()); got != "" {
+		t.Fatalf("DetectOpenCost(empty) = %q, want empty", got)
+	}
+}
+
+func TestDetectOpenCost(t *testing.T) {
+	tests := []struct {
+		name     string
+		services []*corev1.Service
+		want     string
+	}{
+		{
+			name:     "standard opencost in opencost namespace",
+			services: []*corev1.Service{svc("opencost", "opencost", 9003)},
+			want:     "http://opencost.opencost.svc:9003",
+		},
+		{
+			name:     "kubecost cost-analyzer",
+			services: []*corev1.Service{svc("kubecost-cost-analyzer", "kubecost", 9090)},
+			want:     "http://kubecost-cost-analyzer.kubecost.svc:9090",
+		},
+		{
+			name:     "declared port overrides candidate default",
+			services: []*corev1.Service{svc("opencost", "opencost", 8080)},
+			want:     "http://opencost.opencost.svc:8080",
+		},
+		{
+			name:     "no service yields empty",
+			services: nil,
+			want:     "",
+		},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			objs := make([]runtime.Object, 0, len(tc.services))
+			for _, s := range tc.services {
+				objs = append(objs, s)
+			}
+			client := fake.NewSimpleClientset(objs...)
+			if got := DetectOpenCost(client); got != tc.want {
+				t.Errorf("DetectOpenCost = %q, want %q", got, tc.want)
+			}
+		})
+	}
+}