Skip to content

Weekly report

Attune can post one plain-text rightsizing report per cluster per ISO week. The report is off unless you enable it. It goes to Slack, Teams, or both. It is not a cloud bill and it is not dollars saved this week.

The dollars are the gap between current requests and the current non-stale recommendation, priced from costPricing or the built-in rates, times 730 hours.

Turn it on

Create the Secret in the operator namespace. The chart does not create it and does not store the URL.

kubectl -n attune-system create secret generic attune-weekly-report \
  --from-literal=slack-url='https://hooks.slack.com/services/T000/B000/XXXX'

A Teams Workflows URL is allowed only on *.environment.api.powerplatform.com with /powerautomate/ in the path. Office 365 connector hosts are rejected. In the flow, copy the trigger text field into the channel message. Attune does not build an Adaptive Card.

weeklyReport:
  enabled: true
  endpoints:
    - name: slack
      secretName: attune-weekly-report
      secretKey: slack-url

At most two endpoints. Names are DNS labels and must be unique. Two endpoints must not share one Secret name and key.

The manager flags are --weekly-report-enabled and repeatable --weekly-report-endpoint=name/secretName/secretKey. POD_NAMESPACE must be set when the report is enabled. There is no URL flag.

Set fleetReport.clusterId when more than one cluster posts to the same channel. The chart passes --fleet-report-cluster-id when either report is enabled. An empty id leaves the week header without a cluster name.

What gets sent

The leader checks once at start, then every 15 minutes. The first eligible moment is Monday 00:00 UTC. A missed week is one report on the next start, not a backlog.

The stamp is ConfigMap attune-weekly-report in the operator namespace, annotation attune.io/last-report-week (for example 2026-W43). A week with no policies also sets attune.io/last-report-skipped to the unix time of that check. A later post removes it. A new leader that finds the annotation publishes that same time on its skip gauge, so replacing the pod does not move the window or drop the suppression. The chart does not create that ConfigMap. Helm would wipe a chart-owned stamp on upgrade.

Delivery is at-least-once. A crash after a chat service returns success and before the stamp is written can send that week again.

Enable the report on one operator. With --watch-namespaces, the message includes only the namespaces that instance watches.

Zero policies still write the stamp and do not post. The operator logs weekly report skipped with reason no policies. A policy created later that same week waits until the next week. With --watch-namespaces, an empty watch list is the same skip. A missing Secret does not stamp the week unless another endpoint already returned success.

kubectl describe attunepolicy shows reconcile error text. The chat message names the policy and the workload and leaves that text out.

Alert

metrics.prometheusRule.rules.weeklyReportStale is off by default. Turn it on only when weeklyReport.enabled is true. The alert fires when the newer of the last post and the last no-policy week is older than 8 days, and only when a post has succeeded at least once. A restart or a report that has never posted leaves the last-success gauge at 0 and does not fire the alert. A week with zero policies keeps the last post time. It records the skip time instead, including when another replica still has an older post time. The next successful post sets the last-success gauge again and clears the skip time on that pod. The overview dashboard shows how many reports were sent, when the last one succeeded, and when the last no-policy week was. A gauge of 0 displays as never.