Usage Instructions

ClairAI Observability Platform — AWS Marketplace Usage Instructions

Field	Value
Document	AWS Marketplace Usage Instructions
Version	v1.0.1
Publisher	Info Services
Delivery Type	Helm-based container product for Amazon EKS
Target Platform	Amazon EKS
Chart Version	1.0.2

Topics

• 1. Purpose and AWS Marketplace Coverage
• 2. Product Overview
• 3. AWS Marketplace Delivery Information
• 4. Prerequisites
• 5. Subscribe to ClairAI
• 6. Authenticate Helm to AWS Marketplace ECR
• 7. Create Kubernetes Namespaces
• 8. IAM Roles for Service Accounts (IRSA)
• 9. Secret Management
• 10. Deploy ClairAI Components
• 11. Deploy MCP Servers
• 12. Create Ingress (ALB)
• 13. Validate Deployment
• 14. Monitoring and Logs
• 15. Upgrade Instructions
• 16. Uninstall Instructions
• 17. Troubleshooting
• 18. AWS Service Quotas and Cost Guidance
• 19. Support

1. Purpose and AWS Marketplace Coverage

This document provides buyer-facing instructions to deploy, configure, validate, monitor, upgrade, and uninstall ClairAI as an AWS Marketplace Helm-based container product on Amazon EKS.

2. Product Overview

ClairAI is an AI-powered observability platform for AWS infrastructure. It provides:

• Observability Backend — Monitoring, alerting, log aggregation, and cost management
• Frontend Dashboard — React-based UI for visualization and interaction
• AI Agent — Three specialized agents (Auto, RCA, FinOps) powered by Amazon Bedrock
• Prometheus MCP Server — Queries AWS Managed Prometheus metrics via Model Context Protocol
• Loki MCP Server — Queries Grafana Loki logs via Model Context Protocol
• Billing MCP Server — AWS Cost Explorer and billing analysis via Model Context Protocol
• YACE — Yet Another CloudWatch Exporter for collecting AWS CloudWatch metrics

3. AWS Marketplace Delivery Information

Component	Image Tag
Backend	v1.0.1-backend
Frontend	v1.0.1-frontend
Agent	v1.0.1-agent
Prometheus MCP	v1.0.1-prometheus-mcp
Loki MCP	v1.0.1-loki-mcp
Billing MCP	v1.0.1-billing-mcp
YACE	v1.0.1-yace

Artifact	URI
Helm Chart	oci://709825985650.dkr.ecr.us-east-1.amazonaws.com/info-services/clairai
Chart Version	1.0.2
ECR Registry	709825985650.dkr.ecr.us-east-1.amazonaws.com
Repository	info-services/clairai

All images are linux/amd64 architecture, Docker V2 manifest format.

4. Prerequisites

AWS Prerequisites

• Active AWS account with AWS Marketplace subscription for ClairAI
• Amazon EKS cluster (Kubernetes 1.29+, standard support recommended)
• AWS CLI v2 configured for the target account
• kubectl configured for the EKS cluster
• Helm 3.8+ with OCI registry support
• eksctl (for IRSA setup)

AWS Services Required

Service	Purpose
Amazon EKS	Container orchestration
AWS Managed Prometheus (AMP)	Metrics storage
Amazon Bedrock	AI inference (Claude 3 Sonnet)
DynamoDB	Configuration storage
S3	Data storage
AWS Secrets Manager	Credential management

Recommended EKS Configuration

Item	Value
Kubernetes version	1.32 (standard support)
Worker nodes	2-3 nodes minimum (t3.large or m6g.large)
Architecture	x86_64 (linux/amd64)
AWS Load Balancer Controller	Required for ALB ingress

5. Subscribe to ClairAI

1. Open AWS Marketplace and search for ClairAI
2. Subscribe to the product
3. Wait until subscription is active before proceeding

6. Authenticate Helm to AWS Marketplace ECR

aws ecr get-login-password --region us-east-1 | \
  helm registry login --username AWS --password-stdin \
  709825985650.dkr.ecr.us-east-1.amazonaws.com

Validate chart access:

helm pull oci://709825985650.dkr.ecr.us-east-1.amazonaws.com/info-services/clairai \
  --version 1.0.2 --untar --destination /tmp/clairai-chart

7. Create Kubernetes Namespaces

kubectl create namespace clairai-core
kubectl create namespace clairai-agent
kubectl create namespace clairai-mcp
kubectl create namespace clairai-metrics-manager

8. IAM Roles for Service Accounts (IRSA)

8.1 Associate OIDC Provider

eksctl utils associate-iam-oidc-provider \
  --cluster <CLUSTER_NAME> --region <REGION> --approve

8.2 Create IAM Policy

Create clairai-policy.json:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AMP",
      "Effect": "Allow",
      "Action": ["aps:QueryMetrics", "aps:GetSeries", "aps:GetLabels", "aps:GetMetricMetadata", "aps:RemoteWrite"],
      "Resource": "arn:aws:aps:<REGION>:<ACCOUNT_ID>:workspace/<AMP_WORKSPACE_ID>"
    },
    {
      "Sid": "DynamoDB",
      "Effect": "Allow",
      "Action": ["dynamodb:GetItem", "dynamodb:PutItem", "dynamodb:Query", "dynamodb:Scan", "dynamodb:UpdateItem", "dynamodb:DeleteItem"],
      "Resource": "arn:aws:dynamodb:<REGION>:<ACCOUNT_ID>:table/clairai-*"
    },
    {
      "Sid": "S3",
      "Effect": "Allow",
      "Action": ["s3:GetObject", "s3:PutObject", "s3:ListBucket"],
      "Resource": ["arn:aws:s3:::<BUCKET>", "arn:aws:s3:::<BUCKET>/*"]
    },
    {
      "Sid": "Bedrock",
      "Effect": "Allow",
      "Action": ["bedrock:InvokeModel", "bedrock:InvokeModelWithResponseStream"],
      "Resource": "*"
    },
    {
      "Sid": "SecretsManager",
      "Effect": "Allow",
      "Action": ["secretsmanager:GetSecretValue"],
      "Resource": "arn:aws:secretsmanager:<REGION>:<ACCOUNT_ID>:secret:clairai-*"
    },
    {
      "Sid": "CloudWatch",
      "Effect": "Allow",
      "Action": ["cloudwatch:GetMetricData", "cloudwatch:ListMetrics", "cloudwatch:GetMetricStatistics"],
      "Resource": "*"
    },
    {
      "Sid": "CostExplorer",
      "Effect": "Allow",
      "Action": ["ce:GetCostAndUsage", "ce:GetCostForecast", "ce:GetReservationUtilization", "ce:GetSavingsPlansUtilization"],
      "Resource": "*"
    }
  ]
}

aws iam create-policy --policy-name ClairAI-EKS-Policy \
  --policy-document file://clairai-policy.json

8.3 Create Service Accounts

for NS in clairai-core clairai-agent clairai-mcp clairai-metrics-manager; do
  eksctl create iamserviceaccount \
    --cluster <CLUSTER_NAME> \
    --namespace ${NS} \
    --name clairai-sa \
    --role-name "ClairAI-${NS}-role" \
    --attach-policy-arn arn:aws:iam::<ACCOUNT_ID>:policy/ClairAI-EKS-Policy \
    --approve
done

9. Secret Management, Sensitive Data, and Encryption

Do not store passwords, API keys, or tokens directly in values.yaml. Use Kubernetes Secrets or AWS Secrets Manager.

kubectl create secret generic clairai-secrets \
  --namespace clairai-core \
  --from-literal=SECRET_KEY="<YOUR_SECRET>"

10. Deploy ClairAI Components

Pull the chart first:

helm pull oci://709825985650.dkr.ecr.us-east-1.amazonaws.com/info-services/clairai \
  --version 1.0.2 --untar --destination /tmp/clairai

10.1 Backend

helm install clairai-backend /tmp/clairai/clairai \
  --namespace clairai-core \
  --set deploy.enabled=true \
  --set deployment.enabled=true \
  --set nameOverride=clairai-backend \
  --set fullnameOverride=clairai-backend \
  --set image.repository=709825985650.dkr.ecr.us-east-1.amazonaws.com/info-services/clairai \
  --set image.tag=v1.0.1-backend \
  --set serviceAccount.create=false \
  --set serviceAccount.name=clairai-sa \
  --set service.type=ClusterIP \
  --set "service.ports[0].port=80" \
  --set "service.ports[0].targetPort=8000" \
  --set-string "env[0].name=AWS_REGION" \
  --set-string "env[0].value=<REGION>" \
  --set-string "env[1].name=AUTH_ENABLED" \
  --set-string "env[1].value=true" \
  --wait --timeout 5m

10.2 Frontend

helm install clairai-frontend /tmp/clairai/clairai \
  --namespace clairai-core \
  --set deploy.enabled=true \
  --set deployment.enabled=true \
  --set nameOverride=clairai-frontend \
  --set fullnameOverride=clairai-frontend \
  --set image.repository=709825985650.dkr.ecr.us-east-1.amazonaws.com/info-services/clairai \
  --set image.tag=v1.0.1-frontend \
  --set serviceAccount.create=false \
  --set serviceAccount.name=clairai-sa \
  --set service.type=ClusterIP \
  --set "service.ports[0].port=80" \
  --set "service.ports[0].targetPort=8080" \
  --wait --timeout 5m

Note: Frontend nginx listens on port 8080 (unprivileged container).

10.3 Agent

helm install clairai-assistant /tmp/clairai/clairai \
  --namespace clairai-agent \
  --set deploy.enabled=true \
  --set deployment.enabled=true \
  --set nameOverride=clairai-assistant \
  --set fullnameOverride=clairai-assistant \
  --set image.repository=709825985650.dkr.ecr.us-east-1.amazonaws.com/info-services/clairai \
  --set image.tag=v1.0.1-agent \
  --set serviceAccount.create=false \
  --set serviceAccount.name=clairai-sa \
  --set service.type=ClusterIP \
  --set "service.ports[0].port=80" \
  --set "service.ports[0].targetPort=8001" \
  --set-string "env[0].name=AWS_REGION" \
  --set-string "env[0].value=<REGION>" \
  --set-string "env[1].name=BEDROCK_MODEL_ID" \
  --set-string "env[1].value=anthropic.claude-3-sonnet-20240229-v1:0" \
  --set-string "env[2].name=PROMETHEUS_MCP_URL" \
  --set-string "env[2].value=http://prometheus-mcp-server.clairai-mcp.svc.cluster.local:8080/mcp" \
  --set-string "env[3].name=LOKI_MCP_URL" \
  --set-string "env[3].value=http://loki-mcp-server.clairai-mcp.svc.cluster.local:8080/stream" \
  --set-string "env[4].name=BILLING_MCP_URL" \
  --set-string "env[4].value=http://billing-cost-mcp-server.clairai-mcp.svc.cluster.local:8080/mcp" \
  --wait --timeout 5m

11. Deploy MCP Servers

11.1 Prometheus MCP Server

helm install prometheus-mcp-server /tmp/clairai/clairai \
  --namespace clairai-mcp \
  --set deploy.enabled=true \
  --set deployment.enabled=true \
  --set nameOverride=prometheus-mcp-server \
  --set fullnameOverride=prometheus-mcp-server \
  --set image.repository=709825985650.dkr.ecr.us-east-1.amazonaws.com/info-services/clairai \
  --set image.tag=v1.0.1-prometheus-mcp \
  --set serviceAccount.create=false \
  --set serviceAccount.name=clairai-sa \
  --set service.type=ClusterIP \
  --set "service.ports[0].port=8080" \
  --set "service.ports[0].targetPort=8080" \
  --set-string "env[0].name=AWS_REGION" \
  --set-string "env[0].value=<REGION>" \
  --set-string "env[1].name=PROMETHEUS_URL" \
  --set-string "env[1].value=https://aps-workspaces.<REGION>.amazonaws.com/workspaces/<WORKSPACE_ID>" \
  --wait --timeout 5m

11.2 Loki MCP Server

helm install loki-mcp-server /tmp/clairai/clairai \
  --namespace clairai-mcp \
  --set deploy.enabled=true \
  --set deployment.enabled=true \
  --set nameOverride=loki-mcp-server \
  --set fullnameOverride=loki-mcp-server \
  --set image.repository=709825985650.dkr.ecr.us-east-1.amazonaws.com/info-services/clairai \
  --set image.tag=v1.0.1-loki-mcp \
  --set serviceAccount.create=false \
  --set serviceAccount.name=clairai-sa \
  --set service.type=ClusterIP \
  --set "service.ports[0].port=8080" \
  --set "service.ports[0].targetPort=8080" \
  --set-string "env[0].name=LOKI_URL" \
  --set-string "env[0].value=http://loki-gateway.<LOKI_NAMESPACE>.svc.cluster.local" \
  --wait --timeout 5m

11.3 Billing MCP Server

helm install billing-cost-mcp-server /tmp/clairai/clairai \
  --namespace clairai-mcp \
  --set deploy.enabled=true \
  --set deployment.enabled=true \
  --set nameOverride=billing-cost-mcp-server \
  --set fullnameOverride=billing-cost-mcp-server \
  --set image.repository=709825985650.dkr.ecr.us-east-1.amazonaws.com/info-services/clairai \
  --set image.tag=v1.0.1-billing-mcp \
  --set serviceAccount.create=false \
  --set serviceAccount.name=clairai-sa \
  --set service.type=ClusterIP \
  --set "service.ports[0].port=8080" \
  --set "service.ports[0].targetPort=8080" \
  --set-string "env[0].name=AWS_REGION" \
  --set-string "env[0].value=<REGION>" \
  --wait --timeout 5m

11.4 YACE (CloudWatch Exporter)

helm install clairai-yace /tmp/clairai/clairai \
  --namespace clairai-metrics-manager \
  --set deploy.enabled=true \
  --set deployment.enabled=true \
  --set nameOverride=clairai-yace \
  --set fullnameOverride=clairai-yace \
  --set image.repository=709825985650.dkr.ecr.us-east-1.amazonaws.com/info-services/clairai \
  --set image.tag=v1.0.1-yace \
  --set serviceAccount.create=false \
  --set serviceAccount.name=clairai-sa \
  --set service.type=ClusterIP \
  --set "service.ports[0].port=9090" \
  --set "service.ports[0].targetPort=9090" \
  --wait --timeout 5m

12. Create Ingress (ALB)

Requires AWS Load Balancer Controller installed on the cluster.

# clairai-ingress.yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: clairai-ingress
  namespace: clairai-core
  annotations:
    alb.ingress.kubernetes.io/scheme: internet-facing
    alb.ingress.kubernetes.io/target-type: ip
    alb.ingress.kubernetes.io/load-balancer-name: clairai-alb
    alb.ingress.kubernetes.io/group.name: clairai
    alb.ingress.kubernetes.io/listen-ports: '[{"HTTP":80}]'
    alb.ingress.kubernetes.io/healthcheck-path: /
    alb.ingress.kubernetes.io/healthcheck-port: "8080"
spec:
  ingressClassName: alb
  rules:
    - http:
        paths:
          - path: /api
            pathType: Prefix
            backend:
              service:
                name: clairai-backend
                port:
                  number: 80
          - path: /
            pathType: Prefix
            backend:
              service:
                name: clairai-frontend
                port:
                  number: 80
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: clairai-agent-ingress
  namespace: clairai-agent
  annotations:
    alb.ingress.kubernetes.io/scheme: internet-facing
    alb.ingress.kubernetes.io/target-type: ip
    alb.ingress.kubernetes.io/load-balancer-name: clairai-alb
    alb.ingress.kubernetes.io/group.name: clairai
    alb.ingress.kubernetes.io/listen-ports: '[{"HTTP":80}]'
    alb.ingress.kubernetes.io/healthcheck-path: /health
spec:
  ingressClassName: alb
  rules:
    - http:
        paths:
          - path: /v1
            pathType: Prefix
            backend:
              service:
                name: clairai-assistant
                port:
                  number: 80

kubectl apply -f clairai-ingress.yaml

13. Validate Deployment and Application Health

# Check all pods
kubectl get pods -A | grep clairai

# Check services
kubectl get svc -A | grep clairai

# Check ingress (ALB DNS)
kubectl get ingress -A

# Test backend health
kubectl exec -n clairai-core deploy/clairai-backend -- curl -s localhost:8000/

# Test frontend
kubectl exec -n clairai-core deploy/clairai-backend -- curl -s http://clairai-frontend.clairai-core.svc.cluster.local/

Expected: All pods Running, ALB provisioned with DNS name.

14. Monitoring and Logs

kubectl logs -n clairai-core deploy/clairai-backend --tail=50
kubectl logs -n clairai-agent deploy/clairai-assistant --tail=50
kubectl logs -n clairai-mcp deploy/prometheus-mcp-server --tail=50
kubectl logs -n clairai-mcp deploy/billing-cost-mcp-server --tail=50

15. Upgrade Instructions

helm upgrade clairai-backend /tmp/clairai/clairai \
  --namespace clairai-core \
  --set image.tag=<NEW_TAG> \
  --reuse-values --wait

16. Uninstall Instructions

helm uninstall clairai-yace -n clairai-metrics-manager
helm uninstall billing-cost-mcp-server -n clairai-mcp
helm uninstall loki-mcp-server -n clairai-mcp
helm uninstall prometheus-mcp-server -n clairai-mcp
helm uninstall clairai-assistant -n clairai-agent
helm uninstall clairai-frontend -n clairai-core
helm uninstall clairai-backend -n clairai-core

kubectl delete namespace clairai-metrics-manager clairai-mcp clairai-agent clairai-core

17. Troubleshooting

Issue	Cause	Fix
ImagePullBackOff	ECR auth or subscription inactive	Re-run helm registry login
Backend 500 "Unable to locate credentials"	Missing IRSA	Annotate SA with IAM role
Agent CrashLoopBackOff	Billing MCP not deployed	Deploy billing-cost-mcp-server first
Frontend 502 Bad Gateway	ALB target group unhealthy	Check targetPort is 8080 (not 80)
Double /api/api path	Wrong REACT_APP_API_BASE_URL	Set to ALB URL without /api suffix
ALB not provisioning	ALB controller IRSA broken	Check controller logs, fix IAM role trust

18. AWS Service Quotas and Cost Guidance

Resource	Estimated Cost
EKS control plane	$0.10/hr
2-3 worker nodes (t3.large)	~$0.08/hr each
ALB	~$0.02/hr + LCU
AMP	Based on ingestion volume
Bedrock (Claude 3)	Per-token pricing
DynamoDB	On-demand pricing

19. Support

Contact: support@infoservices.com

Include: AWS Region, K8s version, chart version, pod logs, and values.yaml (secrets removed).