What MarshalCloud does with it
- CPU and memory requested and actually used, per pod, with its node, namespace and workload, so spend can be split per namespace and per team.
- Whether each node is ready, and which pods are stuck pending, with the reason.
- It samples every five minutes and posts the numbers out to MarshalCloud.
What it never does
- It reads nodes and pods only, and only to get and list them. It has no permission to change anything in your cluster.
- No logs, no environment variables, no secrets and no container contents are collected or sent.
- MarshalCloud is given no credentials to your cluster. The agent connects outward with a token you can revoke, and deleting its namespace stops it.
Read-only is the default everywhere. A fix is drafted, priced and explained, and then waits for a person to approve it. The whole access path is on Security and access.
Which plan includes it
Growth and above (Growth is $149 a month, Scaled is quoted). See every plan limit.
How to connect it
- Add a cluster in MarshalCloud. It shows you a token once and a one-line install command.
- Run the command against your cluster. It fetches the manifest and fills in your token and cluster id locally, then applies it: one namespace, one service account with read-only access, one small pod.
- Samples start arriving every five minutes. To stop it, delete the marshal namespace.
Questions
- What access does the Kubernetes agent need?
- Permission to get and list nodes and pods, and to read the usage numbers the node itself reports. Nothing else, and no permission to change anything.
- Does MarshalCloud get access to my cluster?
- No. The agent runs inside your cluster and pushes numbers out; MarshalCloud is given no cluster credentials at all. Deleting the marshal namespace ends it.
- Which plan includes Kubernetes?
- Growth and above. Kubernetes cost allocation is per namespace and workload, from the in-cluster collector.