Release Notes

Cherry-picked a change that was missed in the 3.2.2 release. Without this change, the helm chart values .Values.frontend.bufferConfig and .Values.frontend.extraServerConfig are not deduplicated, meaning that if these configuration blocks apply any overlapping directives, the frontend pod will fail to start. For example:

frontend:
  bufferConfig:
    proxy_busy_buffers_size: "512k"
  extraServerConfig:
    proxy_busy_buffers_size: "1024k"

Will cause nginx to crash. After the changes applied to 3.2.3, the keys are deduped and priority is given to values in extraServerConfig.

Release Notes

Frontend

• Improved the speed at which totals rows load for very large numbers of items
• Added a missing parameter (includeCount) to cloud cost API calls
• Fix issues in rendering hardware capacity in the Capacity Planning graph

Aggregator

• Added missing database connection closures, which may fix an issue with APIs not returning due to connection starvation
• Fixed an issue where the Assets API would fail to return data if the recorded active minutes of the asset were 0
• Fixed an issue where the API powering the Assets page graphs were missing item names when aggregated by label
• Added the first stage of support for the new Kubemodel pipeline (see the Opencost section for details on Kubemodel)
• Update "totals" endpoints to use a memory-cheap approximate count when there are more than 4,096 items (see second item in Frontend)
• Enhanced enterprise custom pricing so that the "version" field of a pricing spec is no longer case-sensitive
• Fix an issue where RBAC users that had both Admin and Editor roles applied would be treated as Editors
• Updated the /model/savings/requestSizingV2 API endpoint to correctly return a 400 Bad Request when given invalid parameters
  • Previously returned 500 Internal Server Error

Opencost

• Added first stage of support for the new Kubemodel pipeline: opencost/opencost#3875

Kubecost (Helm chart)

• Added new default nginx buffer sizes to allow larger request/response bodies: #4712
• Added common Kubecost labels to two templates so that Operators can manage manifests more effectively: #4729

Helm Chart Comparison Report

Before Chart: kubecost/kubecost@v3.2.1

After Chart: kubecost/kubecost@v3.2.2

CVE by Severity

Unchanged CVEs

High

Medium

Low

What's Changed

• Enhance v2.9 error messages by @thomasvn in #4561
• Default all Kubecost images to ICR by @thomasvn in #4613
• Bump in-code version for 2.9.7 by @cliffcolvin in #4721
• Bump images and chart version for 2.9.7 by @ErikTorres1998 in #4724

Full Changelog: v2.9.6...v2.9.7

What's Changed

• Default all Kubecost images to ICR (v2.8) by @thomasvn in #4615
• Bump in-code version for 2.8.7 by @cliffcolvin in #4716

Full Changelog: v2.8.6...v2.8.7

Security patch release

Removal of deprecated execution path

The legacyMode option for cluster-controller has been removed from the Helm chart, along with the execution mode that it enabled. This mode has been deprecated since the release of Kubecost 3.0.0, and depended on very old versions of libraries in which CVEs had begun to appear.

Dependency upgrades

Base images, system libraries, and code libraries received version bumps across the board to resolve vulnerabilities.

Other bug fixes

• Fixed an issue where updating the Budgets configmap would erroneously fail with a "duplicate name" error.
• Removed an overly-noisy ECP log
• Fixed an issue with ECP retroactive pricing in RBAC Teams

Image list

icr.io/ibm-finops/agent:v1.0.20
icr.io/kubecost/cluster-controller:v0.16.37
icr.io/kubecost/cost-model:3.2.1
icr.io/kubecost/frontend:3.2.1
icr.io/kubecost/modeling:v0.1.36
icr.io/kubecost/network-costs:v0.19.0

Major

• (Enterprise) Resource Quota rightsizing has been integrated with the container rightsizing Action. Customers can now orchestrate the resizing process of both containers and Kubernetes Resource Quotas from a single job using custom profiles and dedicated lookback windows.
• The return of free Actions! Kubecost 3.2 brings back container resizing actions for users of the free edition. Actions are limited to a single cluster and do not include the Resource Quota rightsizing integration. Some manual setup steps are required so be sure to read the documentation.
• An all-new Audit Log is available for Actions with separate tables for the Kubernetes resource types, a comprehensive click-in experience, column manager, the ability to download log entries as JSON, and more.
• (Enterprise) Enterprise Custom Pricing (ECP) has a new UI under the Settings page which allows customers to manage the entire lifecycle of CSV-based custom pricing from the UI including adding, updating, and removing custom pricing specifications. A new (optional) v2 spec provides the ability to supply up to three (3) total labels for greater flexibility in node matching. The UI provides helpful guidance on which row(s) may result in retroactive pricing adjustments along with timelines. And validation has been greatly expanded and improved to ensure the pricing specs provided are accurate.

Minor

• Resource Quota custom profiles can now be named and saved similar to container resizing profiles. Profiles are accessible to both the Resource Quota Rightsizing card on the Savings Insights page as well as the container resizing Action on the Savings Actions page.
• (Enterprise) Kubecost Teams RBAC now supports the Resource Quota Rightsizing page in Savings Insights allowing you to construct roles for your users with the same filters found on that page.
• The Kubecost Health Alert has been enhanced to now include health status changes of your cloud integrations.
• A couple of new banners are present, one reminding you how and where to set up cloud integrations, and a second allowing you to tell us about your experiences in exchange for a gift card.
• The Container Request Rightsizing page now supports downloading a PDF in addition to CSV.
• The Diagnostics page now includes the configured cloud integrations making easier to see health status of your Kubecost estate in one page.
• Carbon emissions equivalents can now be seen in the Allocation Details view.
• Added new diagnostic visualizations for secondary agent heartbeats overtime, and agent CPU and RAM usage on secondary clusters.
• Added a new API to return a summary of the actions dispatched as part of a scheduled run.
• Added account filter support to Allocations.
• (Cluster Controller) A new environment variable MIN_NAMESPACE_AGE can be used to configure the minimum age that a namespace must have before it can be deleted by namespace turndown. Default 4h.
• (Cluster Controller) A new environment variable ACTION_TTL can be used to tell Actions executors to ignore Actions messages older than the TTL. Defaults to 1h.
• (UI) Added the ability to Edit an existing Cloud Integration via the UI.
• (UI) Added orchestrator diagnostics and ECP diagnostics to the Bug Report export.
• (UI) Added Cloud Provider integrations as a sub-navigation item of the Settings nav item.
• (UI) Added a dismissible banner to the Overview page prompting setup of a Cloud Integration when none are present.
• (UI) Removed broken "Cluster Turndown" option from the Actions menu.
• (UI) Added new visualizations for Cluster Diagnostics.
• (UI) Added carbon costs to the Allocation Details page.
• (UI) Added a date tooltip to the Cluster List "Last Seen" field. I.e., mousing over "1 month ago" will show the precise date of last data reported.
• (UI) Added a link to a form for user feedback - link lives in the Settings page.
• FinOps agent is updated to 1.0.19.
• Cluster Controller is updated to v0.16.35.
• Network Costs is updated to v0.18.3.
• Forecasting is updated to v0.1.35.
• (Helm) Added persistent storage to cloud costs.
• (Helm) Added a flag to disable showing of cloud costs in the UI.
• (Helm) Added annotations to PVCs.
• (Helm) Added a rate limiter value for use in cluster controller.
• (Helm) Added a log level env var to cloud costs and set imagePullPolicy.
• (Helm) Added the release namespace to all remaining Helm templates.
• (Helm) Added a method to run aggregator without a persistent volume (not recommended!).
• (Helm) Added a storage lookback value for diagnostics and heartbeat.
• Standardized base image on ubi9-minimal:latest.

Fixes

• (Important) The same fix we put in place in Kubecost 3.1.8 which improves cost accuracy in some cases has been incorporated into Kubecost 3.2.0 as well. Whether you upgrade from 3.1.8 or an earlier version, rest assured you’ll get the fix.
• Fix an issue where Efficiency views would send the wrong ?idle= parameter in some cases.
• Fix an issue where navigating to request sizing from the Allocations page would pass parameter “filters” instead of “filter”
• (Helm) Fix a typing issue in the value aggregator.dbConcurrentIngestionCount.
• (Helm) Fix an issue with disabling of diagnostics and heartbeats.
• Fixed/improved response of budgets API.
• Fixed an issue with a panic when global config was enabled but health alert was not.
• Fixed adding Resource Quota savings amounts to savings cache.
• Fixed handling of null values in webhooks in budget actions.
• Fixed an issue where unauthed monitoring endpoints would fail to work when RBAC teams was enabled.
• Fixed cluster status API showing cluster name with resource group.
• Fixed an issue where users with Editor permissions in RBAC/Teams setups could not create/edit Budgets.
• Fixed an issue which could cause excessive file build-up from heartbeats and diagnostics.
• Fixed an issue where shared costs will now behave correctly when filtering by a namespace and sharing another namespace, with idle enabled/separate.
• Fixed an issue which would allow duplicate role names upon editing.
• Fixed an issue where downloading a CSV/PDF from Collections didn't use the display currency but always USD.
• Fixed an issue in the actions scheduler where if the logic was "Run everywhere EXCEPT at this time" with nothing selected the action would not run.
• Fixed an issue in the container request rightsizing API where when quantileOfMaxes algorithm had qCPU and qRAM set to 1.0 it would not equal max but instead 99%.
• Fixed an issue where core counts would divide by zero which resulted in a query failure.
• Fixed an issue where the "Test Cloud Integration" functionality would erroneously show a failure on success.
• Defunct Settings fields have been removed from the Settings page.
• Fixed issues with Settings page failing to save.
• Fixed an error in fetching / deleting RBAC teams when the team name contained special characters.
• Fixed an issue in allocation PDF downloads where filters were not applied correctly.
• Fixed an issue where the browser's Back button did not work on Teams and Diagnostics pages.
• Fixed an issue where CSV report downloads would repeat the report title twice in the file name.
• Fixed an issue where "Upgrade" prompts could show up in installs that already used a v2 enterprise license.
• Fixed a bug where tooltip content could not be clicked because mousing onto the tooltip caused it to close.
• Fixed a bug where global behavior for idle could default to Share By Cluster instead of Separate.
• Fixed a bug where a new Action with the same name would overwrite the existing same-named Action (due to using names as IDs).

Helm Chart Comparison Report

After Chart: kubecost/kubecost@3.2.0

Before Chart: kubecost/kubecost@3.1.8

CVE by Severity

Unchanged CVEs

High

Medium

Important Notice

Kubecost 3.1.8 includes a significant patch for the agent that will need to be upgraded on all clusters.
This patch should improve cost accuracy in large clusters and in clusters under significant load.

What's Changed

• Fix: Enterprise Custom Pricing bug that would cause incorrect/$0 costs by @nik-kc
• Fix: service monitor indentations in 3.1 by @jessegoodier in #4658
• Fix agent: Improve metric quality that could cause negative usage/costs by @mbolt35 in opencost/opencost#3787
• Fix agent: increase default scrape interval to 60s (up from 30s) to improve cost accuracy caused by incomplete metrics when using intervals that are too short by @jessegoodier in #4660
• Fix: reduce CVE with dependency bumps. Details below. Shout out to @thomasvn!

Helm Chart Comparison Report

Before Chart: kubecost/kubecost@3.1.7

After Chart: kubecost/kubecost@3.1.8

CVE by Severity

Unchanged CVEs

High

Medium

Low

Kubecost 3.1.7 resolves cost calculation accuracy issues affecting environments with undersized agents experiencing frequent restarts. While overall cost reporting remained directionally accurate, some users observed intermittent negative cost values in their reports.

Additional Detail

What to expect upon upgrade

Upon upgrading to 3.1.7, Kubecost automatically recalculates historical cost data to correct affected calculations. The system remains fully operational during this process, with a green status indicator displayed during recalculation. No manual intervention is required.

Validation

Fixes were validated across diverse cluster configurations and datasets to ensure consistent behavior across all environments.

Performance enhancements

This release includes backend optimizations for improved stability during data processing and query-intensive operations:

• Dynamic concurrency management
• Enhanced retry logic for ingestion and derivation
• Database query optimizations

What's Changed

• 🍒 Service Monitor Debugging to v3.1 by @github-actions[bot] in #4636

Full Changelog: v3.1.6...v3.1.7

Helm Chart Comparison Report

After Chart: kubecost/kubecost@3.1.7

Before Chart: kubecost/kubecost@3.1.6

CVE by Severity

Unchanged CVEs

Critical

High

Medium

Low

UI fixes

• Fix an issue where calls to /model/multi-cluster-diagnostics-enabled which returned errors were not handled. Error response are now assumed to mean “not enabled”, preventing further wasted API calls.

• Fixed an issue where the wrong variable name for a piece of config was being used, causing several widgets on the Overview page and the entire Allocation Details page to simply not render.

• Restored the presence of “Save” and “Test Connection” controls when creating a new Cloud Provider Integration. These had been erroneously removed when the ability to edit cloud providers did not ship.

Helm Chart Updates

• Bump default version of the network-costs image referenced in Helm chart, eliminating CVEs that were discovered in the base image after it was published. v0.18.2 -> v0.18.3

• Bump the default version of the cluster-controller image referenced in the Helm chart, eliminating CVEs that were discovered in the base image after it was published. v0.16.32 -> v0.16.34

• Bump the default version of the kubecost-modeling image referenced in the Helm chart, eliminating CVEs that were discovered in the base image after it was published. v0.1.34 -> v0.1.35

• Bump default version of the ibm-finops-agent Helm chart v1.0.14 -> 1.0.15.

  • See https://github.com/kubecost/ibm-finops-agent/releases/tag/v1.0.15

Known caveats

(Added approximately 20 minutes post-release)

While the target version of network-costs (v0.18.3) does resolve a number of CVEs, it still contains two which are rated HIGH by NIST. Namely:

• CVE-2026-4111
• CVE-2026-27135

CVE-2026-27135 is present in the latest version of our upstream base image and we're working on a resolution. CVE-2026-4111 has been resolved in a newer version of the upstream base image, but it is replaced by CVE-2026-4424 in the same library, which holds an equivalent severity rating.

We will publish a patch with resolutions to these issues when we are able.

Image List

• icr.io/kubecost/network-costs:v0.18.3
• icr.io/ibm-finops/agent:v1.0.15
• icr.io/kubecost/cost-model:3.1.6
• icr.io/kubecost/cluster-controller:v0.16.34
• icr.io/kubecost/modeling:v0.1.35
• icr.io/kubecost/frontend:3.1.6
• docker.io/alpine/curl:8.17.0

Helm Chart Security Comparison: v3.1.5 to v3.1.6

CVE by Severity

Unchanged CVEs

Critical

High

Medium

Low

What's Changed

• Add storage lookback time for heartbeat and diagnostics files to speed up initial ingestion

Image List

• icr.io/kubecost/network-costs:v0.18.2
• icr.io/ibm-finops/agent:v1.0.14
• icr.io/kubecost/cost-model:3.1.5
• icr.io/kubecost/cluster-controller:v0.16.32
• icr.io/kubecost/modeling:v0.1.34
• icr.io/kubecost/frontend:3.1.5
• docker.io/alpine/curl:8.14.1

Helm Chart Security Comparison: v3.1.4 to v3.1.5

CVE by Severity

Unchanged CVEs

Critical

High

Medium

Low

Added CVEs

No new vulnerabilities found.

Removed CVEs

No removed vulnerabilities found.

Full Changelog: v3.1.4...v3.1.5