Kubernetes excess
Idle and over-provisioned workloads, unallocated node capacity and orphaned volumes across on-prem clusters, AKS, GKE and EKS, with allocation costs from OpenCost.
CEMS · Excess Management Platform
CEMS reports utilisation and excess in cost terms across Kubernetes clusters, virtual machines, hypervisors and physical estates, and rolls it up to the people who own the cost. Deterministic queries compute every figure; the assistant only explains what the data already says.
Platform
Idle, over-provisioned, unallocated, orphaned, end-of-life and disaster-recovery excess, found by deterministic detectors and priced with your own cost data.
Idle and over-provisioned workloads, unallocated node capacity and orphaned volumes across on-prem clusters, AKS, GKE and EKS, with allocation costs from OpenCost.
Utilisation percentiles for every VM on ESX and Proxmox, host-level allocation and asset cost, so a quiet machine shows up as money, not as a graph.
End-of-life components, expiring licences and disaster-recovery capacity that no longer matches the tier it protects, each with a date and an owner.
Trend and seasonality on the cost history, with anomalies flagged against the product's own baseline rather than a global threshold.
Plain-language questions on every page. The assistant explains numbers that deterministic queries produced; a critic rejects any figure it cannot trace to a tool result.
Collection runs, data freshness per source and machine, audit of every tool call, licences and feature flags, in one place for the people who run the platform.
How it works
Two rules shape the whole platform, and they are what make its numbers safe to put in front of a board.
Collectors pull inventory, utilisation and cost through read-only interfaces: cluster and allocation APIs, hypervisor APIs, metrics endpoints, or your own estate data feed. Nothing is ever written back.
GET only · audited · tenant on every rowDetectors, roll-ups and forecasts run as versioned query code against time-series, cost-history and metadata stores. Thresholds and policies are configuration promoted by pull request, never changed by hand.
every figure = one traceable queryAgents narrate what the queries found, for the scope of the person asking. A critic node checks each narrative number against the tool results before anything reaches a screen.
no number without a sourceWho it is for
Three reporting chains roll the same numbers up to the Group CEO. Each person sees exactly their own scope, derived from your ownership data, never from a manual list.
Domain leads, team leads and product owners get the same figures at their own altitude. Nobody reconciles spreadsheets before a review.
Pseudonymous identifiers travel through the platform; real names are resolved only in your people's own browsers against a resolver you run. Device trust modes let you decide who may sign in from where.
Sign-in is through your own identity provider. Nobody gets a local password.
Trust
No tool, endpoint or query can write to a monitored system. Tests enforce it at the code, database, network and gateway layers.
Every tool call records who asked, from which device, through which services, what ran and how many rows came back.
The same artifact set runs as a hosted cell or inside your own Kubernetes on AWS, Azure, GCP or your data centre, with no dependency on us at runtime.
Credentials are short-lived leases from a vault, workloads carry cryptographic identities, and configuration moves only by reviewed pull requests.
Get started
Customers sign in at cems.fatsmash.in with their Fatsmash identity. New here? Request an account: an administrator approves it, then you sign in with the same identity everywhere. For a walkthrough on your data, write to us:
hello@fatsmash.in