Open-source FinOps tools are cost tools whose code is published under an open licence and that any team can run itself; for cloud cost, three projects cover three of the tool types: OpenCost for Kubernetes cost allocation, Infracost for cost estimates of infrastructure-as-code changes, and Cloud Custodian for policy rules on cloud resources. All three are licensed under Apache 2.0, and two are projects of the Cloud Native Computing Foundation (CNCF). What matters for the bill is the difference between licence and operation: the licence is free, running the tool is not, through hosting, upgrades, price data and the time of whoever owns it.
How it works
| Project | Type | What it reads | Licence and home on 2026-10-16 | Where it runs |
|---|---|---|---|---|
| OpenCost | Kubernetes cost allocation | cluster metrics through Prometheus, provider pricing APIs, optionally billing data | Apache 2.0; CNCF, accepted 2022-06-17, Incubating since 2024-10-25 | in the cluster, installed with Helm |
| Infracost | estimation in code | Terraform, Terragrunt, CloudFormation and AWS CDK; prices from the project's Cloud Pricing API | Apache 2.0; the infracost organisation on GitHub, no foundation | developer machine, editor, CI pipeline |
| Cloud Custodian | policy engine | resource APIs of AWS, Azure and Google Cloud | Apache 2.0; CNCF, accepted 2020-06-25, Incubating since 2022-09-14 | on a schedule from a server, or as serverless functions in your own account |
OpenCost
OpenCost measures and allocates the cost of Kubernetes clusters and can also show cloud cost from several providers' billing data. It needs a Kubernetes cluster at version 1.21 or later and Prometheus for metrics and storage; in Kubernetes it is now installed only through the official Helm chart. Node prices come from the AWS, Azure and Google Cloud pricing APIs, for your own data centre from a CSV file you maintain, and negotiated rates can be entered as custom prices. Configuration pages for billing and pricing APIs exist for AWS, Azure, Google Cloud and Oracle among others, and for the European providers OVHcloud, STACKIT and Open Telekom Cloud. For the Cloud Costs feature, credentials to the billing data are stored as a Kubernetes secret; costs appear once they reach the billing data, usually after several hours and up to 24. Results come through an API, a kubectl plugin, an MCP server, and CSV and Parquet exports. How OpenCost spreads cost across namespaces is covered in Kubernetes cost data and Kubernetes cost allocation.
Infracost
Infracost reads infrastructure code and shows what a change would cost, in the terminal, in the editor or as a pull request comment. The CLI parses the code locally, extracts the cost-relevant settings such as instance type or disk size, and queries the Cloud Pricing API the project runs; according to the project, neither the plan file nor credentials or secrets are sent there. It needs a free API key. Usage-based resources such as functions or storage are estimated from a usage profile, and an AWS auto scaling group with neither desired capacity nor minimum size counts as one instance. With version 2.0 the project split its code into separate repositories, and the CLI now lives in infracost/cli. Where the estimate fits in the development process is covered in shift left: cost checks before deployment.
Cloud Custodian
Cloud Custodian is a rules engine for cloud accounts: a policy in YAML names a resource type, filters and actions, such as stopping resources outside working hours or removing unused ones. Policies run as a one-off pull, on a schedule, or as serverless functions that Custodian provisions with their event sources at the provider, and a dry run shows what they would do first. They can also check infrastructure code, in the pipeline or on a developer's machine. How policies enforce tagging rules is covered in policy as code: enforcing tagging rules.
Openness in FinOps extends beyond tools to specifications: OpenCost publishes its own specification for Kubernetes cost, and FOCUS is the open specification for billing data across cloud, SaaS, AI and data centres.
What it means for your cost
An open-source tool moves cost from the licence to operation. This table shows where it lands:
| Cost item | OpenCost | Infracost | Cloud Custodian |
|---|---|---|---|
| Hosting | pods and Prometheus storage in the cluster | runtime in the CI pipeline | a server or serverless functions in your own account |
| Upgrades | Helm chart, Kubernetes versions | CLI releases, the repository split | packages prefixed c7n on PyPI |
| Price data | provider pricing APIs; custom prices kept by you | the project's hosted pricing API | none, it acts on resources |
| Ownership | Who reads the allocation and maintains the credentials? | Who weighs the estimate in review? | Who approves policies with actions? |
Permissions follow the type: OpenCost reads inside the cluster and, with Cloud Costs, the billing data; Infracost reads only code and, according to the project, sends no credentials to its API; Cloud Custodian needs write permissions in the accounts for every action. That projects and commercial offerings sit side by side is stated on the projects' own pages: OpenCost's website lists commercial products and support from other vendors built on OpenCost, and Infracost's pricing page lists paid plans beside a free one.
How Kubernetes cost becomes visible inside a cluster, step by step, is shown in Kubernetes cluster cost visibility.
Where it goes wrong
- The estimate read as the invoice. Infracost estimates the configuration at Cloud Pricing API prices; usage the code does not state is missing without a usage profile. OpenCost's own documentation says it does not currently reconcile on-demand prices with the actual costs in the billing data.
- List prices instead of negotiated rates. Without custom prices, OpenCost uses the provider APIs' prices. For Infracost, the pricing page lists custom price books in a paid plan; otherwise the pipeline shows figures that can sit above the invoice.
- Policies that act without review. A Custodian policy with an action runs as a serverless function on every matching event and stops or deletes before anyone has read the dry run. Actions belong behind an approval like any other change (policy as code).
- The paid part assumed to be the project. A team plans around a feature it saw in a demo and finds it only in a commercial offering. Which features belong to the project is shown by its repository and documentation, not by a vendor's product page.
- A tool without an owner. OpenCost runs, but its Helm chart is months old and the Cloud Costs credentials belong to an account nobody uses any more.
Sources
Read on 2026-10-16. OpenCost repository, overview, installation, provider configuration and Cloud Costs and commercial offerings; CNCF OpenCost and Cloud Custodian; Infracost repository, CLI repository, getting started, FAQ and pricing; Cloud Custodian repository, governance and documentation; FOCUS project site.