OpenCost just shipped v1.120.2, and if you have ever stared at a cloud bill wondering where the money went, this release has your name on it.
OpenCost is an open-source tool that tells you exactly what your Kubernetes workloads cost to run. It connects to your cloud provider, pulls pricing data, and breaks down spend by pod, namespace, label, or cluster. Think of it as the receipt you never got from your cloud provider. It solves the “cloud bill surprise” — that monthly moment of panic when the invoice arrives and nobody can explain half the line items. Teams running Kubernetes in production use it, from startups watching every dollar to enterprises tracking spend across hundreds of clusters.
So why should you care about v1.120.2? This release brings AWS CUR 2.0 support, which is a big deal for anyone on AWS who has been meaning to migrate their cost reports to the newer format. It also adds a brand-new OVH cloud provider, lets you set custom persistent volume pricing via annotations, and ships SLSA provenance signing for its container images. That is a lot of ground covered in one release.
Imagine your cloud bill is a restaurant check written in a language you sort of understand. OpenCost is the friend who translates it, line by line, and points out that someone ordered three lobsters.
Version v1.120.2 was released on May 18, 2026. It is a packed release with several meaningful features and an important security fix. Let us walk through the highlights.
What Is New
AWS CUR 2.0 Support
AWS has been pushing users toward Cost and Usage Report (CUR) 2.0, its next-generation billing format with improved granularity and column coverage. If you are an AWS user, this is not optional — AWS is deprecating CUR 1.0. OpenCost now reads CUR 2.0 reports natively, which means your cost tracking keeps working through the migration without manual workarounds.
This matters because CUR 2.0 includes columns and data structures that did not exist in CUR 1.0. Without this support, you would either lose cost visibility or need to maintain a fork. Neither is fun.
# CUR 2.0 is configured in your cloud-integration.json
# OpenCost v1.120.2 reads it automatically
{
"aws": {
"cur": {
"version": "2.0"
}
}
}PR #3653 — Opencost Support for CUR 2.0
OVH Cloud Provider
OVH is one of Europe’s largest cloud providers, and OpenCost now supports it out of the box. If you are running Kubernetes clusters on OVH and have been flying blind on costs, this is your moment. The integration pulls OVH-specific pricing so you get the same per-pod, per-namespace cost breakdown that AWS and GCP users already enjoy.
This is also a signal about where OpenCost is heading: broader multi-cloud coverage. Every new provider makes the project more useful for teams running heterogeneous infrastructure.
PR #3627 — feat(cloud): add OVH cloud provider
Custom Persistent Volume Pricing via Annotations
Not all storage costs what your cloud provider says it costs. Maybe you have negotiated rates. Maybe you are using local disks. Maybe you are running on-prem and the “price” is an internal chargeback number. Whatever the reason, OpenCost now lets you set custom PV prices directly on the PersistentVolume using an annotation.
# Set a custom price on your PV
apiVersion: v1
kind: PersistentVolume
metadata:
annotations:
open-cost.io/custom-price: "0.15"
...This is one of those features that seems small until you need it. If your storage costs do not match public cloud list prices, you no longer have to hack around OpenCost — you just annotate and move on.
PR #3075 — feat: Use custom PV price from annotations
SLSA Provenance and Cosign Keyless Signing
Supply chain security is no longer optional. OpenCost v1.120.2 now signs its container images with cosign keyless signing and attests SLSA provenance in CI. This means you can verify that the image you are pulling was actually built by the OpenCost project and has not been tampered with.
For teams with compliance requirements — and honestly, for everyone — this is a meaningful trust improvement. You can verify images before deploying them:
# Verify the OpenCost image provenance
cosign verify-attestation \
--type slsaprovenance \
ghcr.io/opencost/opencost:v1.120.2PR #3737 — feat(ci): sign container images with cosign keyless and attest SLSA provenance
Auth Middleware and Security Hardening
OpenCost now includes authentication middleware, a long-requested feature for teams exposing the cost API to broader audiences. Previously, if you wanted to control access to cost data, you had to rely on network policies or external proxies. Now, auth is built in.
Additionally, this release fixes CVE-2026-34986 (a denial-of-service vulnerability in the Go JOSE library, CVSS 7.5) and GHSA-xmrv-pmrh-hhx2 (a denial-of-service issue in AWS SDK EventStream). Neither is a zero-day, but both are worth patching.
PR #3651 — add middleware for auth
PR #3776 — fix: upgrade vulnerable Go dependencies
Other Notable Improvements
- AWS Spot Price History API Caching — Reduces API calls to the AWS spot pricing endpoint, which means fewer rate-limit errors and more accurate spot instance cost data. PR #3731
- Streaming Bingen Support and WAL — The internal metrics pipeline gets a streaming overhaul and a Write-Ahead Log for better reliability under heavy load. PR #3671 and PR #3726
- CPU Usage Counter Overflow Protection — Prevents cost calculations from going haywire when CPU counters wrap around during long-running deployments. PR #3787
- Cluster Name in CSV Export — The CSV export now includes the cluster name column, making multi-cluster cost reports actually usable. PR #3703
- Local Storage Cost Simplification — Replaces complex storage cost queries with straightforward math, which is both faster and easier to maintain. PR #3755
Security Fixes
- CVE-2026-34986 — Denial-of-service vulnerability in Go JOSE library (CVSS 7.5). A crafted JWE token with an empty
encrypted_keycould trigger a panic. Fixed by upgrading the dependency. PR #3776 - GHSA-xmrv-pmrh-hhx2 — Denial-of-service in AWS SDK EventStream (CVSS 5.9). Fixed as part of the same dependency upgrade. PR #3776
OpenCost v1.120.2 keeps expanding what “free Kubernetes cost monitoring” actually means — more clouds, better AWS billing support, custom pricing, and supply chain security baked into the build pipeline. If you are not running OpenCost yet, this is a solid release to start with.
