feat(infra): Infracost configuration and usage profiles for the product

🤖 AI agent: owner request in chat (2026-11-02): add Infracost to the product. Refs #168 (idle cost below 10 EUR/month).

Filed from the owner account at the owner's request in chat; the bot identity was not available in this session.

Context

The owner connected Infracost Cloud (GitHub integration) to this repository and to valentinalexeev/agentdev-valabs. First run: https://dashboard.infracost.io/org/valentinalekseev/repos/6492ea18-8efd-41f0-8081-635ad440442b/runs/ce01391a-1525-4836-b9bd-2cb72e9ad9ec. Without a config file Infracost detects projects by itself; the only finding here is in infra/terraform/bootstrap. The main module infra/terraform has required inputs without defaults, so check in the dashboard whether it was priced at all.

Change

infracost.yml at the repository root (format of the current Infracost version; 2.0 moved the CLI to infracost/cli, check the config schema there):
- infra/terraform with example.tfvars, profile idle and profile busy (two entries with different usage files);
- infra/terraform/bootstrap with its example.tfvars;
- examples/deployment/gcp-gke/terraform with its example values.
Usage files infra/terraform/infracost-usage-idle.yml and -busy.yml: agent pool node hours (idle: 0; busy: e.g. 2 nodes x 160 h), NAT data, log volume. Comments say where each number comes from.
Costs Infracost cannot see: objects made by Kubernetes or Ansible (agent PVCs, Postgres PVC, Gateway forwarding rule with public_hosts). A small script scripts/cost-extra.sh (agents x disk size x disk price, plus the forwarding rule) prints them, and docs/admin.md explains how to add them to the Infracost total. Numbers checked against ^[0-9]+$ before arithmetic (reviewer checklist item 5).
Known gaps of the estimate, in the docs: the GKE zonal control plane fee is shown without the free tier (correct it in the usage file if possible, otherwise state it); Spot pricing of node pools to be checked on the first run.
Guardrail: idle total above the target of Idle cost of an instance below 10 EUR/month #168 makes the Infracost PR comment fail (Infracost Cloud guardrail if the plan has it; otherwise a follow-up issue for a CI check, which needs the workflow scope: the bot posts the diff, the owner applies it).
Docs: docs/admin.md (cost estimate section), infra/terraform/README.md (cost section points to Infracost), docs/private-deployment.md (a deployment repository adds its own infracost.yml), examples/deployment/gcp-gke gets an infracost.yml, CHANGELOG (Added).

Questions

Tagging policy in Infracost Cloud. GCP label keys and values must be lower case, so the current policy (Environment in Dev/Stage/Prod, Service) can never pass on GCP resources. Proposed: change it in the dashboard (owner action) to environment in dev/stage/prod and service required. Blocks the label fix (feat(terraform): labels on all resources (service, environment) #184).
Blocking PR comments. The findings have pr_requires_fix: true. Proposed: keep it on for FinOps policies with savings, off (comment only) for tagging until feat(terraform): labels on all resources (service, environment) #184 is released. Does not block.

"As proposed" counts as the answer.

Acceptance criterion

A PR that changes infra/terraform gets an Infracost comment with the idle and busy totals of the example instance; scripts/cost-extra.sh prints the costs outside Terraform for a given agent count; the docs state the gaps.

Generated by Claude Code

Clarify question 1.
Question 2 - ok

🤖 AI agent: clarification of question 1, answering #183 (comment). Question 2 is recorded as as proposed.

What the problem is. Infracost Cloud has a tagging policy for this org that every resource must pass. Today it requires:

a tag key Environment with value Dev, Stage or Prod
a tag key Service

On GCP, resource tags are labels, and GCP accepts only lower-case label keys and values (a-z, 0-9, _, -). A label Environment=Prod is rejected by the GCP API. So no GCP resource can ever pass this policy, whatever we change in Terraform. Every PR would get a tagging finding that cannot be fixed.

The proposal. You edit the policy in the Infracost dashboard (Org settings, Tagging policies). The bot has no access there.

key environment, allowed values dev, stage, prod
key service, required, any value

#184 then adds these labels to every Terraform resource: environment from a new variable, default prod, and service = "agentdev".

Why it blocks #184. If #184 ships labels before the policy changes, the findings stay red. If the policy changes first, #184 turns them green.

Alternatives

B: keep the policy and add AWS/Azure-style tags only where a provider allows capitals. On GCP that is nowhere, so the findings stay red.
C: turn the tagging policy off until feat(terraform): labels on all resources (service, environment) #184 is released, then switch it back on in lower case.

Reply "A", "B" or "C". "As proposed" means A.

As proposed, A, lowercase labels.

🤖 AI agent: Decision recorded (owner, #183 (comment)): question 1 A, lower-case labels environment (dev/stage/prod) and service. Owner action: update the tagging policy in the Infracost dashboard. Question 2: as proposed. #184 is unblocked. Removing needs-decision; this issue is queued for the bot.

🤖 AI agent: question 1, the exact settings proposed for the Infracost Cloud tagging policy (Governance > Tagging policies, policy "FinOps tags"). Owner action in the dashboard.

Posted from the owner account at the owner's request in chat; the bot identity was not available in this session.

Key	Mandatory	Value type	Allowed values	Message
`environment`	yes	List	`dev`, `stage`, `prod`	GCP labels are lower case: environment = dev, stage or prod. Set the module input `labels` (#184).
`service`	yes	Regex	`^[a-z][a-z0-9_-]{0,62}$` (or List `agentdev` if only agentdev repos are connected)	Lower-case service name, e.g. agentdev. The module sets it by default (#184).

Remove the keys Environment and Service. With upper-case keys and values (Dev, Stage, Prod) no GCP resource can pass: GCP label keys and values must be lower case.
PR behaviour: comment only, not blocking (pr_requires_fix off) until feat(terraform): labels on all resources (service, environment) #184 is released and applied; then blocking.
Scope: both repositories. The run also checks Kubernetes manifests (k8s/funnel-forwarder.yaml was flagged), so the same keys apply to Kubernetes labels.
After feat(terraform): labels on all resources (service, environment) #184: if google_monitoring_notification_channel is still flagged (Infracost reads its labels field, which is the channel config with email_address), dismiss that finding as a false positive in the dashboard, with this reason.

Not confirmed (docs site not reachable from the session): whether value matching is case sensitive, and the exact name of the PR-blocking switch in the dashboard.

Generated by Claude Code

🤖 AI agent: Decision recorded: question 1 (owner, in chat, 2026-11-02): the Infracost Cloud tagging policy is updated as proposed in #183 (comment) (lower-case environment and service). #184 is unblocked.

Still open: question 2 (PR comments blocking or comment-only until #184 is applied). needs-decision stays for it.

Posted from the owner account at the owner's request in chat; the bot identity was not available in this session.

Generated by Claude Code

Review under which conditions infracost check is run. Make sure it is only launched when anything infra-related is touched (not the other app code).

🤖 AI agent: findings on when the Infracost check runs.

Infracost runs as the Infracost Cloud GitHub App, not a workflow, so there is no on: paths: filter in this repo to tune. The App receives every PR event and always posts a status, then decides from the diff whether any detected Terraform project is affected.
Observed behaviour already matches the request: app-only PRs feat(operator): one disk per agent (#173) #189 and feat: scale idle agents to zero by default, router wake poll (#181) #190 (operator Go code, scripts, docs) got Infracost: skipping in ~20 s, no estimate, no comment. Infra PRs bootstrap: abort incomplete multipart uploads in tfstate bucket #186 (infra/terraform/bootstrap/main.tf) and feat(terraform): create the global static IP only with public_hosts #188 (infra/terraform/*.tf) got a real run (pass).
The only thing the App ever does on app-only PRs is that short skipped status. That cannot be removed from the repo side, and skipping does not block merging.
An infracost.yml is therefore not needed for this. It would only pin the project list (infra/terraform, infra/terraform/bootstrap, examples/deployment/**/terraform) instead of autodetect, which is feat(infra): Infracost configuration and usage profiles for the product #183's original scope anyway. I am not opening a separate PR for it.

Owner-only, optional: if you don't want the skipped status to show up at all, the only option is in the Infracost dashboard (repo settings) or uninstalling the App from the repo. Neither is recommended. Also, if Infracost ever becomes a required check in branch protection, keep in mind that skipping counts as success, so app-only PRs will not be blocked.

feat(infracost): pin projects and add 2-3 agent usage profile (#183) (#…

Navigation Menu

Repository navigation

feat(infra): Infracost configuration and usage profiles for the product #183

Context

Change

Questions

Acceptance criterion

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

feat(infra): Infracost configuration and usage profiles for the product #183

Description

Context

Change

Questions

Acceptance criterion

Activity

valentinalexeev commented on Nov 2, 2026

valentinalexeev-bot commented on Nov 2, 2026

valentinalexeev commented on Nov 2, 2026

valentinalexeev-bot commented on Nov 2, 2026

valentinalexeev commented on Nov 2, 2026

valentinalexeev commented on Nov 2, 2026

valentinalexeev commented on Nov 2, 2026

valentinalexeev-bot commented on Nov 2, 2026

Metadata

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Issue actions