Install via AWS Marketplace

Clu is currently in preview and available exclusively through AWS Marketplace. You subscribe, install via Helm against your EKS cluster, and Clu runs in your cluster.

Subscription is required before any of the install steps below will work. All artifacts (Helm chart, container images) live in Marketplace ECR and are gated by your Marketplace subscription — helm install, helm pull, and docker pull all return 403 Forbidden until your AWS account is subscribed and the entitlement has propagated. Subscribe first; install second.

First 30 days are free. A trial activates automatically when you subscribe — no charges until it ends.

Preview / pilot. AWS Marketplace is the only distribution channel during the preview. Public-registry distribution with a self-managed licensing option will follow once Clu expands beyond EKS; there's no separate non-Marketplace install path today.

How billing works

One flat hourly rate — $0.10/hr per pod-hour while Clu is running. Roughly $72/cluster/month for a single-pod install at 24/7. AWS meters pod uptime automatically.
30 days free on first subscribe — no charges until it ends.
Clu reports usage hourly via aws-marketplace:MeterUsage. Best- effort — a failed report logs a warning and retries on the next tick.
You're billed while the Clu pod is running. Scale to zero to pause billing.
Every capability is included in the flat rate. Which ones you enable in Helm values (modules.core.enabled, modules.corePlus.enabled, modules.cloud.enabled, modules.developerPlatform.enabled) is independent of billing — the bill doesn't change based on which ones are on. See Pricing for the full breakdown.

Open the listing on AWS Marketplace and search for Clu (published by Cloudology LLC).
Click Continue to Subscribe and accept the terms.
Single flat-rate container product — no tiers or dimensions to choose.

After subscribing, give AWS a few minutes for the entitlement to propagate before attempting the pulls below.

2. Create the IRSA role

Clu's service account needs AWS permissions: Bedrock at minimum, plus read-only AWS APIs if you plan to enable the Cloud Agent.

The full per-capability IAM JSON policies + the trust-policy template

the apply commands are paste-ready in IAM setup. At the highest level the flow is:

# 1. Save the JSON for each capability you've enabled
#    (Cluster Agent always; Cloud / IDP optional) — copy from
#    /docs/iam-setup into local files.
# 2. Create one IAM policy per file:
aws iam create-policy --policy-name clu-cluster --policy-document file://cluster.json
aws iam create-policy --policy-name clu-cloud   --policy-document file://cloud.json    # optional
aws iam create-policy --policy-name clu-idp     --policy-document file://idp.json      # optional

# 3. Create the role (trust policy in /docs/iam-setup):
aws iam create-role --role-name clu-irsa-role --assume-role-policy-document file://trust.json

# 4. Attach each policy you created:
ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)
aws iam attach-role-policy --role-name clu-irsa-role \
  --policy-arn arn:aws:iam::$ACCOUNT_ID:policy/clu-cluster
# Repeat for clu-cloud / clu-idp as applicable.

No source repo to clone — every paste-able artifact is in the docs above.

3. Install via Helm

The Marketplace ECR registry gates chart and image pulls by your AWS Marketplace subscription. Authenticate Helm against the registry — your AWS credentials must resolve to a subscribed account — then install:

# Authenticate Helm against the Marketplace ECR registry.
aws ecr get-login-password --region us-east-1 \
  | helm registry login --username AWS --password-stdin \
    709825985650.dkr.ecr.us-east-1.amazonaws.com

helm install clu-ops-agent \
  oci://709825985650.dkr.ecr.us-east-1.amazonaws.com/cloudology/clu-ops-agent \
  --namespace clu-ops --create-namespace \
  --set serviceAccount.annotations."eks\.amazonaws\.com/role-arn"=arn:aws:iam::ACCOUNT_ID:role/clu-irsa-role \
  --set llm.bedrock.region=us-east-1

The chart and images live at:

Chart: oci://709825985650.dkr.ecr.us-east-1.amazonaws.com/cloudology/clu-ops-agent
Backend image: 709825985650.dkr.ecr.us-east-1.amazonaws.com/cloudology/clu-ops-agent-backend
Frontend image: 709825985650.dkr.ecr.us-east-1.amazonaws.com/cloudology/clu-ops-agent-frontend

All three are Marketplace-gated by your subscription. Without one, the pulls 403.

4. Verify entitlement

Once installed, Clu calls RegisterUsage at startup and reports the result. You can confirm in the UI under Settings → Licensing, or from the backend logs:

kubectl logs -n clu-ops -l app.kubernetes.io/name=clu-ops-agent -c backend \
  | grep -i marketplace

You should see:

marketplace: RegisterUsage ok product=9pq7ujvo9ghaaqd2ofi9imjm9

5. Access the UI

kubectl port-forward -n clu-ops svc/clu-ops-agent 8080:8080

For production access with ALB + Cognito SSO, see UI access.

Unsubscribing

Uninstall the chart with helm uninstall clu-ops-agent -n clu-ops. Clu tears down cleanly — the namespace and the IRSA role (which you manage) are all that remain. Billing stops when the pod stops running.

Next:

Configuration reference
IAM setup — full inline JSON for every capability
Write operations — IDP Platform safety model

On the roadmap: support for additional cloud providers, plus a public GHCR distribution with a self-managed licensing model for customers who want to run Clu outside the AWS Marketplace billing path.