Add workload and application cost tabs

[nadaverell]

Summary

Adds OpenCost-backed cost views at the workload, application, and cluster surfaces covered by this PR:

• Workload Cost tab for Deployments, StatefulSets, and DaemonSets.
• Application Cost tab for multi-workload applications with supported steady-state workloads.
• Single-workload applications continue to jump directly into the workload view; their cost lives in the workload Cost tab.
• Global, home-card, application, and workload cost views are monthly-first for budget scanning, with daily/hourly retained as supporting rate context.
• Node cost rows include cloud-console external links when the node providerID is parseable; cluster-level cloud-console links render only for high-confidence GKE/EKS contexts.

Application and workload cost use OpenCost/Prometheus historical allocation instead of only projecting from the current hourly rate. They aggregate CPU and memory allocation across supported steady-state workloads, show partial coverage clearly, and let contributor rows drill into the workload-level Cost tab.

What changed

• Adds RBAC-preflighted OpenCost APIs:
  • GET /api/opencost/workload/{kind}/{namespace}/{name}
  • GET /api/opencost/workload/{kind}/{namespace}/{name}/trend?range=6h|24h|7d
  • POST /api/opencost/application
  • POST /api/opencost/application/trend
• Adds historical workload cost attribution through owner joins:
  • Deployment: Pod -> ReplicaSet -> Deployment
  • StatefulSet/DaemonSet: direct Pod owner
• Adds a host-wired app Cost tab to the shared application shell without changing consumers that do not provide a cost renderer.
• Adds app-level current totals, historical stacked trend, current CPU/memory split, contributor rows, coverage messaging, and partial responses when individual app workloads are inaccessible or missing.
• Adds provider-aware external console links for parseable GCE/AWS nodes and high-confidence GKE/EKS cluster contexts; unsupported providers omit the external action.
• Makes global, home-card, application, and workload cost views monthly-first where users are scanning budget impact.
• Keeps hourly cost explicit for current rates, CPU/memory split bars, node pricing, and chart tooltips where the UI is explaining rate composition.
• Handles scaled-to-zero workloads, partial current/history availability, unsupported batch/job workloads, no-metrics/no-Prometheus states, query failures, and context-scoped OpenCost discovery retry state.
• Improves the no-Prometheus discovery UX so the UI shows a transient looking-for-Prometheus state while discovery settles.
• Shares cost formatting, chart helpers, and supported workload-kind checks between cluster, workload, and app cost views.

Scope notes

• Cost covers OpenCost CPU and memory allocation for steady-state workloads: Deployment, StatefulSet, and DaemonSet.
• Batch/job cost and app-level batch UI remain separate follow-up work.
• Storage/PVC and network attribution remain namespace/cluster-level for now.
• Monthly and daily figures are projections from current hourly allocation; historical spend uses the selected range on application/workload tabs.
• Current app cost computes namespace workload allocation and then focuses the requested app workloads; this is acceptable for this PR, but a focused current PromQL path or short cache would scale better for very large namespaces.

Testing

• make tsc
• make test
• make build
• go test ./opencost from pkg/
• go test ./internal/server
• npx tsc --noEmit
• npx vitest run web/src/components/cost/format.test.ts web/src/components/cost/ApplicationCostTab.test.ts web/src/components/cost/WorkloadCostTab.test.ts
• npx vitest run web/src/components/cost/ApplicationCostTab.test.ts web/src/components/cost/WorkloadCostTab.test.ts packages/k8s-ui/src/components/applications/ApplicationDetail.test.tsx
• npx vitest run web/src/components/cost/ApplicationCostTab.test.ts web/src/components/cost/WorkloadCostTab.test.ts web/src/components/cost/cloud-console.test.ts web/src/components/cost/format.test.ts
• git diff --check
• Visual-tested on gke_koalabackend_us-east1-b_nonprod-cluster-us-east1 with real OpenCost/Prometheus data:
  • global cost at 1920, 1280, and 2560 widths
  • home cost card
  • application cost tab
  • workload cost tab at 1920 and 1280 widths
  • node cost cloud-console links
  • partial app coverage state
  • single-workload app ?view=cost normalization to workload tab=cost
  • global Cost page regression check
  • browser console: no current-page errors

---

Note

Medium Risk
Touches Prometheus discovery concurrency, many new cost APIs and PromQL paths, and RBAC-sensitive workload preflight; impact is mostly additive UI and read-only metrics, with regression risk on existing cluster cost queries.

Overview
Adds OpenCost-backed cost at workload, multi-workload application, and cluster surfaces, with monthly-first budget framing and hourly rates kept for splits and tooltips.

Backend: New RBAC-preflighted routes for per-workload current/trend cost and POST application current/trend (batched by namespace, partial coverage for denied/missing/unsupported workloads). PromQL now dedupes duplicate node and PV series, enriches node rows with providerID from the node cache, and attributes workload history via Pod → ReplicaSet → Deployment or direct StatefulSet/DaemonSet owners. Scaled-to-zero workloads return valid zero cost. Prometheus EnsureConnected serializes discovery, caches failed discovery for 5s, and avoids clearing a good connection when a probe is context-canceled.

UI: Optional Cost tab on shared ApplicationDetail / WorkloadView; ApplicationCostTab and workload cost tabs with stacked trends, contributor drill-down to workload tab=cost, and a short “looking for Prometheus” grace before hard no_prometheus. React Query hooks add discovery-aware refetch for OpenCost endpoints.

^{Reviewed by Cursor Bugbot for commit b5cc97f. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit cdcb372. Configure here.}