This workflow supports both cluster-level and namespace-level cost analysis.
Confirm the anomaly window and affected cluster or namespace.
query_aks_costs supports daily or monthly cost granularity, not hourly
attribution. Query the affected day and comparable baseline days with the
same grouping, and report each currency separately.
If the available Azure Resource Manager MCP surface exposes node-count, CPU,
memory, autoscaler,
or Kubernetes event evidence, correlate it with the cost change. Otherwise
state that hourly utilization evidence is unavailable; do not infer an
hour-level cause from daily cost data.
Compare namespace allocation and idle categories before and during the
anomaly. Check new workloads, missing requests or limits, batch schedules,
PodDisruptionBudgets, and blocked scale-down.
Correlate the result with Resource Graph change history. Run generated
queries through validate_query before execute_query; empty history is
inconclusive because retention and permissions are limited.
Present the cost delta, utilization evidence, likely cause, confidence, and
next action. Hand rightsizing or autoscaler remediation to
cost-optimization.
Do not create budgets, resize node pools, enable add-ons, or change autoscaling
without explicit confirmation.