Enterprise License

Kong Ingress Controller can manage Kong Gateway Enterprise instances. This guide explains how to apply an enterprise license to running Gateways.

Applying a license using the KongLicense CRD

Kong Ingress Controller v3.1 introduced a KongLicense CRD (reference) that applies a license to Kong Gateway Enterprise using the Admin API.

1. Create a file named license.json containing your Kong Gateway Enterprise license.

2. Create a KongLicense object with the rawLicenseString field set to your license:

   echo "
   apiVersion: configuration.konghq.com/v1alpha1
   kind: KongLicense
   metadata:
     name: kong-license
   rawLicenseString: '$(cat ./license.json)'
   " | kubectl apply -f -
   

3. Verify that Kong Ingress Controller is using the license:

   kubectl describe konglicense kong-license
   

   The results should look like this, including the Programmed condition with True status:

   Name:         kong-license
   Namespace:
   Labels:       <none>
   Annotations:  <none>
   API Version:  configuration.konghq.com/v1alpha1
   Enabled:      true
   Kind:         KongLicense
   Metadata:
    Creation Timestamp:  2024-02-06T15:37:58Z
    Generation:          1
    Resource Version:    2888
   Raw License String:   <your-license-string>   
   Status:
    Controllers:
     Conditions:
      Last Transition Time:  2024-02-06T15:37:58Z
      Message:
      Reason:                PickedAsLatest
      Status:                True
      Type:                  Programmed
     Controller Name:        konghq.com/kong-ingress-controller/5b374a9e.konghq.com
   

All Kong Gateway instances that are configured by the Kong Ingress Controller will have the license provided in KongLicense applied. To update your license, update the KongLicense resource and Kong Ingress Controller will dynamically propagate it to all Kong Gateway Enterprise instances with no downtime. There is no need to restart your Pods when updating a license.

Applying a static license

An alternative option is to use a static license Secret that will be used to populate Kong Gateway Enterprise’s KONG_LICENSE_DATA environment variable. This option allows you to store the license in Kubernetes secrets, but requires a Pod restart when the value of the secret changes.

1. Create a file named license.json containing your Kong Gateway Enterprise license and store it in a Kubernetes secret:

    kubectl create namespace kong
    kubectl create secret generic kong-enterprise-license --from-file=license=./license.json -n kong
   

2. Create a values.yaml file:

    gateway:
      image:
        repository: kong/kong-gateway
      env:
        LICENSE_DATA:
          valueFrom:
            secretKeyRef:
              name: kong-enterprise-license
              key: license
   

3. Install Kong Ingress Controller and Kong Gateway with Helm:

    helm upgrade --install kong kong/ingress -n kong --create-namespace --values ./values.yaml