Elevarq pgAgroal Enterprise

Deploy pgAgroal Enterprise on Amazon EKS

Prerequisites

• An Amazon EKS cluster (Kubernetes 1.28+) with kubectl configured to reach it.
• Helm 3.8+ (OCI registry support).
• A reachable PostgreSQL backend (Amazon RDS, Aurora PostgreSQL, or self-managed).
• AWS Marketplace metering: this paid product is metered per pod-hour via the AWS Marketplace Metering Service (RegisterUsage). Enable IAM Roles for Service Accounts (IRSA) or EKS Pod Identity, create an IAM role granting the AWSMarketplaceMeteringRegisterUsage managed policy, and associate it with the metering service account in the pgagroal-system namespace. AWS injects this service account; you do not configure metering yourself - the chart enforces it. Setup guide: https://github.com/Elevarq/pgAgroal-Enterprise/blob/main/docs/marketplace/metering.md 
• Backend credentials are provided by reference (a Kubernetes Secret or a cloud secrets manager); passwords are never placed in configuration.

Step 1 - Authenticate Helm to the Marketplace registry (the login token is fixed to us-east-1 regardless of your cluster region): aws ecr get-login-password --region us-east-1 | helm registry login --username AWS --password-stdin 709825985650.dkr.ecr.us-east-1.amazonaws.com

Step 2 - Install the operator: helm install pgagroal-enterprise oci://709825985650.dkr.ecr.us-east-1.amazonaws.com/elevarq/pgagroal-enterprise-chart --version 1.2.0 --namespace pgagroal-system --create-namespace This installs the pgAgroal Enterprise operator. Per-pod-hour metering is enforced by the delivered chart: every managed pooler pod calls RegisterUsage under the injected AWS Marketplace service account.

Step 3 - Provide your existing backend credential by reference. pgAgroal Enterprise ships no default password; it reads an existing credential from a Kubernetes Secret (or cloud secrets manager) and fails closed if it cannot resolve one. Create the Secret without putting the password on the command line or in shell history - read it from a file sourced from your own secret store (for example AWS Secrets Manager), then delete it: umask 077; printf '%s' "$PG_PASSWORD" > pg-pass kubectl -n pgagroal-system create secret generic pg-backend --from-literal=username=YOUR_DB_USER --from-file=password=pg-pass rm -f pg-pass PG_PASSWORD is your own backend password from your secret store, not part of this product. To resolve it directly from AWS Secrets Manager instead, see https://github.com/Elevarq/pgAgroal-Enterprise/blob/main/docs/marketplace/aws-listing.md 

Step 4 - Deploy a managed pooler by applying a Pgagroal resource (set image to the Marketplace pooler image so it is pulled under your entitlement): kubectl apply -f - <<'EOF' apiVersion: pgagroal.elevarq.com/v1alpha1 kind: Pgagroal metadata: name: pg1 namespace: pgagroal-system spec: image: 709825985650.dkr.ecr.us-east-1.amazonaws.com/elevarq/pgagroal-enterprise:1.2.0 replicas: 2 backendHost: YOUR_POSTGRES_HOST backendPort: 5432 backendSecretRef: pg-backend backendUsername: YOUR_DB_USER maxConnections: 100 EOF

Step 5 - Verify:

• kubectl get pods -n pgagroal-system : the operator and the pg1 pooler pods become Running and Ready.
• Metering: the pooler pod log shows "marketplace-meter: entitled; hourly metering started", and a RegisterUsage event for product code pcphz1dsw4mexqovimmuqgpx appears in AWS CloudTrail.
• Connectivity: connect an application to the pg1 Service on port 6432 and run a test query such as SELECT 1.

Configuration and support Full configuration - backend TLS, cloud secrets managers (AWS/Azure/GCP), the fleet control plane, coordinated connection limits, audit export, and the Prometheus metrics and Grafana dashboards you import into your own Grafana - is documented at https://github.com/Elevarq/pgAgroal-Enterprise  . Enterprise support is included: email support@elevarq.com  with your AWS account ID and the product version.