Why a shared Kafka cluster needs metering and chargeback
Metering and chargeback on a shared Kafka cluster means measuring how much of the platform each team uses and assigning a share of the platform cost to that team. You need it once several teams write to the same brokers and one budget pays for them, because without a measured allocation the platform owner cannot explain the bill, spot the team that drives growth, or justify capacity requests. Apache Kafka itself is licensed under Apache-2.0 with no paid edition from the project, so the money you spend is infrastructure, storage, network, and the people who run the cluster. Those costs are yours to allocate, and the allocation rules are a decision the platform owner makes, not something the software decides for you.
Showback and chargeback differ in one way: showback reports each team's consumption and cost to that team without moving money, while chargeback moves an internal transfer from the team's budget to the platform's. Showback is usually the first step, because it builds trust in the numbers before any budget changes hands. Chargeback needs agreed unit rates, a finance owner who accepts the rates, and a dispute process. DeployOpen plans and builds the metering pipeline and the monthly report, and documents how each figure is derived so finance and team leads can check it. DeployOpen does not set your internal transfer prices or allocation policy, and you should confirm with finance which cost pools, such as shared brokers, controllers and monitoring, are split and how.
Before you start, confirm three things with your organization: which cost pools go into the allocation, how often reports are issued, and who signs off the rates. Also confirm which Kafka metrics your monitoring stack already collects, because per-principal throughput and storage figures come from different sources and may need extra collection. Teams that agree these points early avoid rebuilding the report after the first dispute. The rest of this page covers how each usage signal is measured and turned into a monthly showback view.
Allocation drivers: throughput, storage, partitions
Throughput allocation charges each team for the bytes its clients produce and consume. On a Kafka cluster with authentication enabled, the most useful key is the authenticated principal, because it maps to a service account or team identity. Broker-side client quota metrics can report byte rates per user, which gives you a per-principal series for produce and fetch traffic without parsing broker logs. Confirm in your environment whether your metrics pipeline exposes per-user byte rates and at what sampling interval, and whether your identity model maps each principal to exactly one owning team.
- What it measures: Bytes in and bytes out attributed to a principal over a billing window, which tracks network and broker I/O load.
- What it misses: Shared broker overhead such as request handling, replication traffic between brokers, and the cost of idle connections.
- Replication effects: Producer bytes are counted once, while the cluster writes them to several replicas, so the replication cost is not visible in this driver unless you add a multiplier.
- Shared principals: One service account used by several teams hides ownership, so the throughput split is only as accurate as your principal-to-team mapping.
- Data source to confirm: Per-user client quota metrics or an equivalent broker metric exported to your monitoring system, retained for the full billing period.
Check that every production principal has a documented owner before you rely on this driver for chargeback.
Storage allocation charges each team for the bytes its topics keep on disk. If your topic naming convention puts the owning team or product in a prefix, you can sum retained bytes per prefix from the broker log directory sizes or a per-partition size metric, then assign the totals to teams. This driver reflects the retention policy each team chose, so a team that keeps seven days of data pays more than one that keeps one day. Confirm that the prefix convention is enforced, because topics cannot be renamed and an unlabeled topic will fall into an unowned bucket.
- What it measures: Bytes retained on disk per topic, summed across partitions and grouped by naming prefix.
- What it misses: Replica copies unless you multiply by the replication factor, index and metadata files, and compaction state that changes size over time.
- Retention changes: A retention change mid-month shifts the charge, so decide whether you use the peak, the end-of-period value, or a time-weighted average.
- Unprefixed topics: Topics created before the convention, or outside it, need a mapping table or a remediation rule.
- Data source to confirm: Per-partition log size metrics from your broker monitoring, and the topic configuration export that records retention settings.
Confirm the averaging method with finance before the first monthly report, because it changes results for teams with volatile retention.
Partition allocation charges each team for the partitions it has reserved, whether or not they carry traffic. Partitions consume broker memory, file handles, controller metadata, and recovery time, so a large number of idle partitions has a real cost even when throughput is low. Treating partitions as a reservation charge rewards teams that right-size their topics and makes the cost visible before anyone adds capacity. Confirm the partition counts from your metadata and decide whether replicas count toward the charge, since each replica adds its own load.
- What it measures: Partition count per topic, multiplied by replication factor if you choose to count replicas, aggregated per owning team.
- What it misses: Actual load on each partition, so a hot partition and an idle one can carry the same weight.
- Idle partitions: Topics with no traffic still hold metadata and open resources, which is why the reservation model fits this cost.
- Shared broker cost: Controller and metadata load scales with total partitions across the cluster, which you must spread across teams with a fixed overhead or a share of the total.
- Data source to confirm: Topic metadata export that lists partition count and replication factor for every topic, captured on the same schedule as the report.
Agree the reservation rate and whether it applies per partition or per replica before you publish any monthly figures.
Choosing the allocation model for each cost component
This table compares five ways to split Kafka platform costs across teams: an equal split, throughput weighting, storage weighting by topic prefix, partition weighting and a fixed platform fee. Read each row against the cost component it fits, since broker compute, disk, and shared control-plane work respond to different drivers. The main takeaway is that no single model fits every cost, so most platforms combine two or three.
| Allocation option | What it measures | Best fit | Main distortion |
|---|---|---|---|
| Equal split across teams | Number of onboarded teams or principals | Shared overhead such as platform administration, monitoring and upgrades | Small teams with heavy traffic pay the same as light users, which encourages large shared topics |
| Throughput-weighted | Produce and consume bytes per principal, taken from broker quota metrics | Broker network and request-handling capacity | Replication fan-out and consumer count can make a team's real load higher than its produced bytes suggest |
| Storage-weighted by prefix | Retained bytes per topic name prefix, including replicas | Disk capacity and retention-driven growth | Teams that set long retention or large compacted topics dominate, and prefix ownership must match topic naming |
| Partition-weighted | Partition count per team, including replicas where the platform counts them | Controller metadata load and leadership overhead | Idle partitions count as heavily as busy ones, so teams may be charged for capacity they never use |
| Fixed platform fee | Agreed amount per team or tier, set in advance | Recurring baseline costs that do not change with usage, such as cluster licensing or staffing | Does not signal consumption, so it gives teams no reason to reduce throughput or retention |
Building the monthly showback report
This sequence turns raw Kafka quota metrics, broker storage figures and ownership records into a monthly report that each team can check against its own usage. Each step closes with a reconciliation so the totals can be trusted before they reach a budget conversation.
Confirm the principal-to-team mapping
The platform owner lists every Kafka principal (SASL user, certificate identity or OAuth client) that produces or consumes on the cluster, then assigns each one to a team using ACL entries and ownership metadata from the topic catalog. Principals with no owner go into an explicit unallocated bucket rather than being guessed. The step is done when every principal seen in the last billing period maps to exactly one team or to the unallocated bucket, and the mapping is signed off by the platform team.
Enable and verify usage metric collection
Confirm that broker metrics for client byte rates, request throttling and log size are being scraped and retained for the full reporting period, and that per-principal and per-client-ID series are present where quotas are configured. Check the retention window of the metrics store, because a month of data is needed for a month of showback. The step closes when a spot query for a known principal returns throughput values that match a manual check against a producer test run.
Define the topic prefix to team mapping
Write down which topic name prefixes belong to which team, using the naming convention the cluster already enforces. Record any topics that do not match a prefix and assign them by owner metadata, marking them as exceptions. The mapping is a versioned file in the same repository as the topic definitions, so changes are reviewed. The step is complete when a query over all topics returns a count that equals the number of topics in the cluster metadata, with no topic left unassigned.
Aggregate storage and throughput for the month
For each team, sum the bytes produced and consumed across its principals for the month, and sum the stored log size of its topics from the broker data at the end of the period. Record partition counts per team as a separate measure, since partitions drive controller and metadata load even when traffic is low. Keep replication factor visible so storage is reported both as logical data and as replicated bytes. The step closes when per-team totals for each measure are saved with the query used to produce them.
Agree the shared-cost pool
Agree in writing which platform costs are shared and split across teams, such as broker and controller infrastructure, load balancers, monitoring and, if used, MirrorMaker 2 clusters and their Kafka Connect workers. Decide whether each cost is split by throughput, storage or an equal share, and record the rule for each cost line. Finance and the platform owner should both confirm the pool. The step is done when every infrastructure line in the cluster bill or budget is assigned to the pool or to a team, with none left undecided.
Produce the monthly showback report
Apply the agreed allocation rules to the aggregated usage and the shared pool, and generate one report per team with its throughput, stored bytes, partition count and allocated share of the pool. Include a cluster-level page showing the sum of all team allocations against the total cluster footprint. The report is complete when the allocated amounts across all teams plus the unallocated bucket add up to the cluster total within the rounding rule written in the method note.
Review the report with each team
Send each team its own report with the method note, the principals and topics included, and the reconciliation figures. Ask the team to confirm that its topics and principals are correct and to raise any unknown principal or misassigned topic. Corrections go back into the mapping from the first two steps, and the report is reissued with a change log. The step is closed when every team has responded or the review window agreed in advance has passed, and the final version is archived with the reconciliation it was checked against.
Protecting the integrity of allocation data
A chargeback report is only as credible as the identity behind each byte it counts. The cards below cover the authentication, access, change control and retention decisions that keep per-team allocations defensible when finance or a team lead questions a line item.
Authenticate every principal
Attribution starts at the client connection. Give each application and team its own principal using SCRAM, Kerberos, OAUTHBEARER or mTLS, so the quota and request metrics that feed the report can be tied to a specific owner. Check that every listener used by production clients requires authentication, because an unauthenticated connection has no principal to bill.
Retire shared service accounts
A single service account used by several applications turns every team's traffic into one line item. Count the principals in use and map each to an owner. Where a shared account exists for a legacy connector or gateway, record which teams depend on it and plan a split, since usage from that account cannot be allocated accurately until it is separated.
Unsecured listeners break attribution
Kafka allows clusters to run unsecured or to mix secured and unsecured listeners. Traffic on a plaintext listener carries no authenticated identity, so its throughput cannot be assigned to a team. Confirm which listeners are exposed, restrict unsecured ones to tightly controlled internal use, and report any unattributed traffic as its own line so it stays visible rather than being spread across tenants.
Restrict access to cost data
Showback reports reveal how much each team consumes and how the platform is priced internally, which can become a negotiating or competitive matter. Limit read access to the metrics store, the report repository and the allocation rules to the platform and finance owners. Teams should see their own figures through a controlled view, not the raw data for every tenant.
Change-control ACLs and ownership
The allocation logic depends on which principal may write to which topic prefix and on the ownership metadata that maps topics to cost centers. Authorizer rules in the cluster metadata and the ownership records should change only through reviewed pull requests with an audit trail. Without that control, a topic can move to another team's prefix and its historical cost will follow the wrong owner.
Keep metric history for the period
A monthly report can only be reproduced or disputed if the source metrics still exist. Decide how long throughput, request and storage snapshots are kept, and make that at least as long as the reporting and dispute window your finance team sets. Ask the platform owner to confirm the retention of the metrics store and to export closed months to a write-once location before the source data ages out.
Questions teams ask before building Kafka chargeback
How much effort does building Kafka showback take?
The effort depends less on Kafka itself and more on how cleanly your teams map to topics, principals and quotas. Most of the work is in three places: deciding the allocation rules, collecting per-principal throughput and per-topic storage from your metrics stack, and turning both into a report that finance accepts. Expect the largest share to go into the mapping: which topic prefix or service account belongs to which cost center, what happens to shared topics, and how platform overhead such as brokers, controllers and monitoring is split. Effort rises with the number of teams, the number of principals per team, the amount of unowned or legacy topics, and how many metrics sources you must join. It falls when naming conventions and ownership metadata already exist. Ask any partner to break the estimate into discovery, metrics pipeline, allocation model, report build and handover, and to state which of those assume your existing naming and access model.
Can our own team build Kafka chargeback without outside help?
Yes, a platform team with metrics and data engineering skills can build showback in-house, and many do. The work is well bounded: export quota-related throughput metrics, measure topic log sizes per prefix, apply an allocation rule, and publish a monthly table. The risks are in the edges. Your team must agree on what counts as shared overhead, handle topics that were created outside the naming standard, and keep the pipeline working through broker upgrades that change metric names. Outside help is most useful when the allocation model needs review by finance, when several clusters must be combined, or when the team lacks capacity to own the report after launch. Whichever route you take, ask for the design written down before build, so the logic can be audited and handed over. DeployOpen plans, implements and documents self-hosted platforms in your own infrastructure, and scope is agreed in writing before work starts.
What does chargeback need from finance and platform owners?
It needs two decisions from finance and one from the platform owner before any code is written. Finance must define the cost pool: which infrastructure lines, such as compute, storage, network transfer and support time, are allocated, and which budget codes receive them. Finance must also agree on the cost units, for example storage by gigabyte-month and throughput by gigabytes moved, and whether shared overhead is spread evenly or by usage. The platform owner must confirm that each team's principals, topic prefixes and service accounts map to a named owner, and must decide who approves exceptions. Without these decisions, the report will be technically correct but disputed. Plan a review cycle where finance checks a dry run against the prior month's invoices or allocation totals before the report becomes official. Ask who signs off on the model and how changes are versioned.
How long does a first Kafka showback report take to produce?
The time to a first report depends on the drivers, not on a fixed number. The main ones are how far your access model already matches team boundaries, whether per-principal quota metrics are already collected, how consistent topic naming is, and how many decisions finance needs to make. A shared cluster with enforced prefixes and named service accounts reaches a first report much faster than one where ownership has to be reconstructed from old tickets. Count separately the time to produce a manual first run, which validates the allocation logic, and the time to automate it on a schedule. Ask any partner for a plan that lists which dependencies sit with your teams, such as metrics access, finance sign-off and naming cleanup, so you can see where delays will come from.
Does Kafka licensing add to the cost of chargeback?
Apache Kafka itself carries no licensing cost. It is released under the Apache License 2.0 (SPDX: Apache-2.0), and the project offers no paid edition. The cost you allocate comes from infrastructure and operations: compute for brokers and controllers, storage for retained data, network traffic between sites or zones, monitoring and logging, and the engineering time to run the platform. Some surrounding tools, such as a commercial schema registry, a managed connector product or a vendor support contract, may carry their own license fees, so include those as separate lines if you use them. When you build the cost pool, list each cost line with its source and whether it is one-time or recurring. Ask your infrastructure team which lines they can meter per tenant and which must be spread across all tenants as shared overhead.
How should we start with showback before moving to chargeback?
Start with showback, which reports each team's consumption and estimated cost without moving money between budgets. This lets teams see their share, challenge the allocation rules and fix naming or ownership gaps while nothing is billed. A practical sequence is to pick one or two teams for a pilot, produce a monthly report for a few cycles, compare it with the actual infrastructure spend, and adjust the allocation model. Once finance accepts the numbers and the owners stop disputing them, move to chargeback in a planned change with an effective date. Keep the same report format through the transition so that the only difference is whether the amount is transferred. Document the rules in a short model description that names the cost pool, the units, the owners and the review cadence, so that a later audit or budget review can reproduce any month.
What changes once teams see their own numbers
Once a team receives a monthly showback report, its behavior changes within a few cycles. Teams with high storage charges start asking whether a 30-day retention on a debug topic is still needed, whether a compacted topic would serve the same consumers, and why a topic was created with more partitions than its consumer group can use. Teams with high throughput charges look at their producers for batching and compression gaps. These are useful outcomes, but they only hold if the report shows the drivers behind each line, not just a total. Check that the per-principal throughput and per-prefix storage figures can be traced back to specific topics, principals and configuration keys such as retention.ms and retention.bytes, so a team can act on what it sees.
Quota requests follow. A team whose producer is throttled will ask for a higher produce byte rate, and the metering data is the evidence that justifies or rejects the request. Before granting increases, confirm which quota the team is hitting, using the client quota settings and throttle metrics your Kafka version exposes, and whether the cluster has headroom to absorb the change. Agree in advance that a quota increase is priced into the next showback cycle, so the cost of extra capacity lands on the team that asked for it rather than being spread across the platform.
Disputes about shared overhead are the hardest part. Brokers, controller and metadata work, replication traffic and the monitoring stack benefit every tenant and do not map cleanly to one principal. Teams will argue that their share is inflated by overhead they did not cause. Before the first report is sent, agree in writing how shared costs are split (for example, evenly, by share of traffic or by share of storage), who can challenge a line item, what evidence is required, and who decides. Set a fixed review cadence, such as a monthly review of the previous report with a defined window for corrections, and record each decision so the rules stay consistent. Treat these rules as a governance document, not a spreadsheet detail.
How DeployOpen works on this
DeployOpen scopes chargeback as part of the Kafka platform it runs in your infrastructure, so cost allocation uses the same identities, topic names and quotas your teams already depend on. Engagements are fixed-scope, with deliverables and timelines agreed in writing before work starts, and ongoing support is available as a retainer.
How we scope
- We agree which principals, topic prefixes and teams are in the allocation model before any reporting work starts.
- The written scope names the cost pools to split, such as brokers, storage and shared services, and the allocation rule for each.
- We confirm which metrics your brokers already expose and where they are collected, so the report data source is settled up front.
How we build
- We configure the metrics pipeline that records per-principal produce and fetch byte rates from quota metrics.
- We build storage attribution per topic prefix, using topic naming and ownership metadata already defined in your cluster.
- We test the monthly showback report against known sample workloads so each team's share can be checked by hand.
How we hand over
- You receive the report queries, the allocation configuration and a runbook for the monthly close.
- Documentation covers how each cost component is measured, its limits, and the assumptions behind the split.
- We walk your finance and platform owners through the report and record open questions that need a decision.
How we support
- Ongoing support can cover changes to team mappings, new topic prefixes and report adjustments as your organization changes.
- Retainers can include review of allocation results after Kafka upgrades or quota changes that affect metric names.
- Support scope, response expectations and fees are set in the agreed written terms, and we confirm them with you before work begins.

