AWS Marketplace

NES for Ingress NGINX is available on AWS Marketplace as a metered container product. You subscribe through AWS Marketplace and deploy the Helm chart that AWS hosts in the Marketplace container registry (Amazon ECR). The chart and every image it uses are served from that registry. You are billed per running controller pod, per hour, on your existing AWS bill. No separate HeroDevs invoice or registry.nes.herodevs.com access token is required for this delivery.

How this differs from the NES registry deployment

Most NES for Ingress NGINX customers deploy from the NES registry (registry.nes.herodevs.com) using a HeroDevs access token. The AWS Marketplace path is different in several ways. Handle these specifically when deploying from AWS Marketplace:

How billing works

You are billed per running controller pod, per hour, metered to the second with a one-minute minimum and prorated. There is no upfront or annual commitment. Customers who need custom commercial terms can contact HeroDevs to request a custom quote and private offer through AWS Marketplace. The underlying compute (Amazon EC2 or AWS Fargate) and any other AWS resources are billed separately by AWS. Billing continues for as long as controller pods are running, even after you unsubscribe, until those pods are stopped.

At startup the controller verifies entitlement by calling the AWS Marketplace Metering Service RegisterUsage API. Per-pod-hour metering is then handled automatically by AWS. No metering sidecar or custom dimension configuration is required.

Prerequisites

• An Amazon EKS cluster running a Kubernetes version in the currently supported matrix of the Support Policy. AWS Marketplace container metering requires EKS. It is not supported on other Kubernetes distributions.
• kubectl and Helm 3.8 or later (OCI registry support) configured against the cluster.
• An active AWS Marketplace subscription to NES for Ingress NGINX.
• An IAM OIDC provider associated with the cluster (the IRSA prerequisite — see the Amazon EKS IRSA documentation).
• Permission to create an IAM role and configure IAM Roles for Service Accounts (IRSA).
• Worker nodes whose IAM role can read from Amazon ECR (included by default in managed EKS node groups). Both x86_64 and arm64 (AWS Graviton) nodes are supported; the Marketplace images are multi-architecture.

Step 1: Subscribe

Subscribe to NES for Ingress NGINX in AWS Marketplace. The subscription entitles your AWS account to pull the chart and images from the Marketplace registry and to run metered pods.

Step 2: Configure IAM Roles for Service Accounts (IRSA)

The controller pod must be able to call aws-marketplace:RegisterUsage. On EKS this must be done with IAM Roles for Service Accounts (IRSA).

Create an IAM role for the controller's service account and attach a policy that grants RegisterUsage. The simplest option is the AWS managed policy AWSMarketplaceMeteringRegisterUsage. An inline policy also works:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "aws-marketplace:RegisterUsage",
      "Resource": "*"
    }
  ]
}

Associate the role with the service account using eksctl, the AWS console, or your infrastructure-as-code tooling. The role ARN goes in the install values below.

Step 3: Install the Helm chart

Follow the product Usage Instructions to install the chart from the AWS Marketplace registry. Authenticate Helm to the registry, then install the chart; the chart pulls every image from Marketplace ECR, so there is no external registry and no pull secret. Pass your IRSA role through the controller service account:

# config.yaml
serviceAccount:
  create: true
  annotations:
    eks.amazonaws.com/role-arn: arn:aws:iam::<ACCOUNT_ID>:role/<IRSA_ROLE>

aws ecr get-login-password --region us-east-1 \
  | helm registry login --username AWS --password-stdin 709825985650.dkr.ecr.us-east-1.amazonaws.com

helm install ingress-nginx \
  oci://709825985650.dkr.ecr.us-east-1.amazonaws.com/herodevs/ingress-nginx \
  --version <chart-version> \
  -n ingress-nginx --create-namespace \
  -f config.yaml

The Marketplace registry lives in us-east-1 regardless of the region your cluster runs in, so the helm registry login always targets us-east-1. Your EKS cluster can run in any AWS Region.

Use the exact chart reference and version from the product Usage Instructions. Customize the deployment through config.yaml as usual: replica count, resources, ingressClassName, service annotations, and other supported chart values.

Migrating an existing ingress-nginx release

If you are replacing an existing upstream or NES-registry ingress-nginx Helm release, your ingress rules, annotations, and values carry over unchanged — export them as described in Migrate an existing ingress-nginx Helm release to NES. Before reusing a values file on the Marketplace chart, remove any controller.image.* overrides and any imagePullSecrets: the Marketplace chart already points at the Marketplace registry, and a leftover HeroDevs or upstream image reference or pull secret will break the deployment.

Step 4: Verify

Confirm the controller pods are running and Ready:

kubectl get pods -n ingress-nginx
kubectl describe deployment ingress-nginx-controller -n ingress-nginx

On success, the controller logs aws-marketplace: entitlement verified and continues normal startup. Usage charges appear in AWS Billing and Cost Management, but billing data is not updated in real time.

Troubleshooting

If the AWS account has no active subscription, or IRSA is misconfigured, the controller cannot verify entitlement and exits during startup. Kubernetes then restarts the pod until the problem is resolved. Check the pod logs for a message prefixed aws-marketplace::

Upgrading

HeroDevs ships CVE patches and maintenance updates as new chart and image versions in the Marketplace registry — watch the release notes. To upgrade, authenticate Helm to the Marketplace registry as in Step 3, then upgrade the release in place with the new chart version from the product Usage Instructions:

helm upgrade ingress-nginx \
  oci://709825985650.dkr.ecr.us-east-1.amazonaws.com/herodevs/ingress-nginx \
  --version <new-chart-version> \
  -n ingress-nginx \
  -f config.yaml

Your ingress rules, annotations, and config.yaml values are preserved across upgrades. The controller rolls out with the deployment's update strategy, and metering follows the running pods automatically.

Uninstalling

Remove the release to stop the controller and the metering:

helm uninstall ingress-nginx -n ingress-nginx

License and support

NES for Ingress NGINX is provided under the NES license terms in the Subscription Agreement. Supported Kubernetes versions, testing and validation, security posture, and customer obligations are described in the Support Policy.

AWS Marketplace subscribers receive the same NES support as direct customers. Contact support@herodevs.com for help with usage, troubleshooting, or billing.