Chargeback Design for Shared and Untaggable Costs

-- Bucket monthly spend into tagged teams vs an untagged tax bucket
WITH normalized AS (
  SELECT
    COALESCE(
      (SELECT value FROM UNNEST(labels) WHERE key = 'team'),
      'UNTAGGED_TAX_BUCKET'
    ) AS team,
    service.description AS service,
    cost,
    IFNULL((SELECT SUM(amount) FROM UNNEST(credits)), 0) AS credits
  FROM `billing.gcp_billing_export_resource_v1_XXXXXX`
  WHERE _PARTITIONTIME >= TIMESTAMP('2026-04-01')
    AND _PARTITIONTIME <  TIMESTAMP('2026-05-01')
)
SELECT
  team,
  ROUND(SUM(cost + credits), 2)                              AS net_cost_usd,
  ROUND(SUM(cost + credits)
        / SUM(SUM(cost + credits)) OVER () * 100, 2)         AS pct_of_total,
  COUNT(DISTINCT service)                                    AS service_count
FROM normalized
GROUP BY team
ORDER BY net_cost_usd DESC;

-- Split shared NAT gateway data processing charges across teams
-- based on each team's share of total tagged data transfer bytes
WITH team_bytes AS (
  SELECT
    resource_tags_user_team AS team,
    SUM(line_item_usage_amount) AS team_bytes
  FROM cur_v2
  WHERE line_item_product_code = 'AmazonEC2'
    AND line_item_usage_type LIKE '%DataTransfer%'
    AND resource_tags_user_team IS NOT NULL
    AND billing_period_start_date = DATE '2026-04-01'
  GROUP BY resource_tags_user_team
),
shared_nat AS (
  SELECT SUM(line_item_unblended_cost) AS total_nat_cost
  FROM cur_v2
  WHERE line_item_usage_type LIKE '%NatGateway%'
    AND (resource_tags_user_team IS NULL OR resource_tags_user_team = '')
    AND billing_period_start_date = DATE '2026-04-01'
)
SELECT
  t.team,
  ROUND(s.total_nat_cost * (t.team_bytes / SUM(t.team_bytes) OVER ()), 2)
    AS allocated_nat_cost_usd
FROM team_bytes t
CROSS JOIN shared_nat s
ORDER BY allocated_nat_cost_usd DESC;

# Kubecost allocation rules for shared platform cluster
# Splits cluster cost by namespace label, not by cloud resource tag
global:
  notifications:
    alertmanager:
      enabled: true

kubecostModel:
  allocation:
    # Required labels on every namespace - enforced by admission controller
    requiredLabels:
      - team
      - environment
      - cost-center

    # Idle and system costs go to the platform team, not user workloads
    shareIdle: false
    shareTenancyCosts: true
    shareNamespaces:
      - kube-system
      - kubecost
      - cert-manager
    shareToTeam: platform

    # Reallocate unassigned spend so user teams see a true-cost view
    shareSplit: weighted