specification: FinOps Framework
specificationVersion: '1.0'
schema: https://www.finops.org/framework/
provider: Cilium
providerId: cilium
created: '2026-05-04'
# Provenance stamped 2026-08-11: this artifact was written by the API Evangelist
# bulk sweep dated 2026-05-04, not harvested from the provider. See roadmap#35.
method: generated
modified: '2026-05-05'
reconciled: false
tags:
  - Cloud Native
  - eBPF
  - Kubernetes
  - Networking
  - Open Source
  - Security
  - FinOps
  - FOCUS
description: 'FOCUS-aligned FinOps for Cilium: the upstream project itself is free (Apache 2.0). The
  cost surface is internal — compute / memory consumed by cilium-agent, Hubble, Hubble Relay, and
  Tetragon DaemonSets in customer clusters, plus the optional Isovalent Enterprise subscription
  (Cisco) for organizations that want a supported distribution. There is no metered billing surface
  exposed by Cilium itself.'
notes: Cilium is free and open source. Cost surfaces below describe internal infrastructure cost
  (cluster overhead) and optional commercial subscription cost.
sources:
  - https://cilium.io/
  - https://docs.cilium.io/
  - https://isovalent.com/
alignedWith:
  framework: FinOps Foundation Framework
  frameworkUrl: https://www.finops.org/framework/
  dataSpec: FOCUS
  dataSpecVersion: '1.3'
  dataSpecUrl: https://focus.finops.org/focus-specification/v1-3/
publisherName: Cilium Authors / CNCF
serviceCategory: Cloud Native Networking & Security
billingModel:
  pricingCategory: Open Source (Optional Commercial Subscription)
  billingFrequency: N/A (upstream) / Annual (Isovalent Enterprise)
  billingCurrency: USD
  chargeCategories:
    - Adjustment
    - Purchase
focusColumns:
  ServiceName: Cilium
  ServiceCategory: Cloud Native Networking & Security
  ProviderName: Cilium / CNCF
  PublisherName: Cilium Authors / CNCF
  InvoiceIssuerName: N/A (upstream); Cisco / Isovalent for Enterprise
  BillingCurrency: USD
  ChargeCategory: Adjustment
  PricingCategory: Open Source
meters:
  - name: agent_overhead
    description: vCPU and RAM consumed by cilium-agent DaemonSets across cluster nodes
    unit: vCPU-hour
    aggregation: sum
    dimensions:
      - cluster
      - node_pool
  - name: hubble_overhead
    description: Resources consumed by Hubble and Hubble Relay (observability stack)
    unit: vCPU-hour
    aggregation: sum
    dimensions:
      - cluster
  - name: tetragon_overhead
    description: Resources consumed by Tetragon DaemonSets (runtime security)
    unit: vCPU-hour
    aggregation: sum
    dimensions:
      - cluster
  - name: enterprise_subscription
    description: Optional Isovalent Enterprise / Cisco subscription line (when purchased)
    unit: month
    aggregation: sum
    dimensions:
      - tier
principles:
  - name: Visibility
    description: Track Cilium's cluster overhead through Kubernetes resource usage (cAdvisor,
      kube-state-metrics, Prometheus) and tag DaemonSet cost back to platform engineering.
  - name: Allocation
    description: Allocate Cilium overhead to the platform / networking cost center; allocate
      Hubble / Tetragon overhead to the security observability team if separately funded.
  - name: Optimization
    description: Tune Hubble flow retention, Tetragon policy footprint, and cilium-agent memory
      limits to reduce per-node overhead; only enable Cluster Mesh and advanced features where they
      pay back in security or operational simplification.
  - name: Accountability
    description: Platform engineering owns Cilium runtime cost and version cadence; security owns
      Tetragon policy; finance reviews any Isovalent Enterprise subscription against the value
      delivered (support, hardening, certified releases).
maintainers:
  - FN: Kin Lane
    email: kin@apievangelist.com