Skip to content
Kong Logo | Kong Docs Logo
search
  • We're Hiring!
  • Docs
    • Kong Gateway
    • Kong Konnect
    • Kong Mesh
    • Plugin Hub
    • decK
    • Kubernetes Ingress Controller
    • Insomnia
    • Kuma

    • Docs contribution guidelines
  • Plugin Hub
  • Support
  • Community
  • Kong Academy
Get a Demo Start Free Trial
  • Kong Gateway
  • Kong Konnect
  • Kong Mesh
  • Plugin Hub
  • decK
  • Kubernetes Ingress Controller
  • Insomnia
  • Kuma

  • Docs contribution guidelines
  • 2.1.x (latest)
  • 2.0.x
  • 1.9.x
  • 1.8.x
  • 1.7.x
  • 1.6.x
  • 1.5.x
  • 1.4.x
  • 1.3.x
  • 1.2.x
  • 1.1.x
  • 1.0.x
    • Introduction to Kong Mesh
    • What is Service Mesh?
    • How Kong Mesh works
    • Deployments
    • Version support policy
    • Stability
    • Release notes
    • Installation Options
    • Kubernetes
    • Helm
    • OpenShift
    • Docker
    • Amazon ECS
    • Amazon Linux
    • Red Hat
    • CentOS
    • Debian
    • Ubuntu
    • macOS
    • Windows
    • Explore Kong Mesh with the Kubernetes demo app
    • Explore Kong Mesh with the Universal demo app
    • Standalone deployment
    • Multi-zone deployment
    • License
    • Overview
    • Data plane proxy
    • Data plane on Kubernetes
    • Data plane on Universal
    • Gateway
    • Zone Ingress
    • Zone Egress
    • CLI
    • GUI
    • Observability
    • Inspect API
    • Kubernetes Gateway API
    • Networking
    • Service Discovery
    • DNS
    • Kong Mesh CNI
    • Transparent Proxying
    • IPv6 support
    • Secure access across Kong Mesh components
    • Secrets
    • Kong Mesh API Access Control
    • API server authentication
    • Data plane proxy authentication
    • Zone proxy authentication
    • Data plane proxy membership
    • Dataplane Health
    • Fine-tuning
    • Control Plane Configuration
    • Upgrades
    • Requirements
    • Introduction
    • General notes about Kong Mesh policies
    • Applying Policies
    • How Kong Mesh chooses the right policy to apply
    • Understanding TargetRef policies
    • Protocol support in Kong Mesh
    • Mesh
    • Mutual TLS
    • Traffic Permissions
    • Traffic Route
    • Traffic Metrics
    • Traffic Trace
    • Traffic Log
    • Locality-aware Load Balancing
    • Fault Injection
    • Health Check
    • Circuit Breaker
    • Proxy Template
    • External Service
    • Retry
    • Timeout
    • Rate Limit
    • Virtual Outbound
    • MeshGateway
    • MeshGatewayRoute
    • Service Health Probes
    • MeshTrace (Beta)
    • MeshAccessLog (Beta)
    • MeshTrafficPermission (Beta)
    • Overview
    • HashiCorp Vault CA
    • Amazon ACM Private CA
    • cert-manager Private CA
    • OPA policy support
    • Multi-zone authentication
    • FIPS support
    • Certificate Authority rotation
    • Role-Based Access Control
    • UBI Images
    • Windows Support
    • Auditing
    • HTTP API
    • Annotations and labels in Kubernetes mode
    • Kong Mesh data collection
      • Mesh
      • CircuitBreaker
      • ExternalService
      • FaultInjection
      • HealthCheck
      • MeshGateway
      • MeshGatewayRoute
      • ProxyTemplate
      • RateLimit
      • Retry
      • Timeout
      • TrafficLog
      • TrafficPermission
      • TrafficRoute
      • TrafficTrace
      • VirtualOutbound
      • Dataplane
      • ZoneEgress
      • ZoneIngress
      • kuma-cp
      • kuma-dp
      • kumactl
    • Kuma-cp configuration reference

github-edit-pageEdit this page

report-issueReport an issue

enterprise-switcher-iconSwitch to OSS

On this page
  • Licensed metrics
  • License behaviours
  • License API
  • Configure the license
    • Kubernetes (kumactl)
    • Kubernetes (Helm)
    • Universal
  • Multi-zone
Kong Mesh
2.0.x
  • Home
  • Kong Mesh
  • Plan And Deploy
  • License
You are browsing documentation for an outdated version. See the latest documentation here.

License

Kong Mesh requires a valid license before it can start the global kuma-cp process. When the license is not set, Kong Mesh automatically uses a pre-bundled license with the following limits:

  • Number of data plane proxies (DPPs) allowed: 5
  • Expiration date: 30 days

The pre-bundled license can be overwritten by explicitly setting a new one. You can obtain a Kong Mesh license by getting in touch with the Kong team.

A license file with a valid signature typically looks like the following example:

{
  "license": {
    "version": 1,
    "signature": "...",
    "payload": {
      "customer": "company_inc",
      "license_creation_date": "2021-8-4",
      "product_subscription": "Kong Mesh",
      "dataplanes": "5",
      "license_expiration_date": "2023-11-09",
      "license_key": "..."
    }
  }
}

When installing Kong Mesh, the license file can be passed to kuma-cp with the following instructions.

If running Kong Mesh in a multi-zone deployment, the file must be passed to the global kuma-cp. In this mode, Kong Mesh automatically synchronizes the license to the remote kuma-cp, therefore this operation is only required on the global kuma-cp.

Licensed metrics

The license encourages a pay-as-you-go model that delivers the best benefits to you, the end user, since the derived value of Kong Mesh is directly associated to the positive benefits of real service mesh usage.

These metrics are:

  • Number of connected data plane proxies (DPPs), across every zone.
  • An expiration date that determines the duration of the license.

In the context of the metric, a data plane proxy (DPP) is a standard data plane proxy that is deployed next to your services, either as a sidecar container or in a virtual machine. Gateway data plane proxies, zone ingresses, and zone egresses are not counted.

You can measure the number of data plane proxies needed in Kong Mesh by the number of services you want to include in your service meshes. Use the following formula:

Number of DPPs = Number of Pods + Number of VMs.

License behaviours

With an expired license or invalid license the control-plane will fail to start. If the license expires while the control-plane is running it will keep running but a restart of the instance will fail. The control-plane will issue a warning in the logs and the GUI when the license expires in less than 30 days.

With a valid issued license, a data plane proxy will always be able to join the service mesh, even if you go above the allowed limit to prevent service disruptions. If the number of DPPs does go above the limit, you will see a warning in the GUI and in the control plane logs.

With the pre-bundled license, if you go over the maximum allowed number of DPPs, the system will automatically refuse their connections.

License API

You can inspect the license using the GUI or the API /license endpoint on the control plane. For example:

$ curl <IP of the control plane>:5681/license
{
 "allowedDataplaneProxies": 20,
 "activeDataplaneProxies": 2,
 "expirationDate": "2032-11-09T00:00:00Z",
 "demo": false
}

Configure the license

A valid license file can be passed to Kong Mesh in a variety of ways.

Kubernetes (kumactl)

When installing the Kong Mesh control plane with kumactl install control-plane, provide a --license-path argument with a full path to a valid license file. For example:

$ kumactl install control-plane --license-path=/path/to/license.json

Kubernetes (Helm)

To install a valid license via Helm:

  1. Create a secret named kong-mesh-license in the same namespace where Kong Mesh is being installed. For example:
  $ kubectl create namespace kong-mesh-system
  $ kubectl create secret generic kong-mesh-license -n kong-mesh-system --from-file=/path/to/license.json

Where:

  • kong-mesh-system is the namespace where Kong Mesh control plane is installed
  • /path/to/license.json is the path to a valid license file. The filename should be license.json unless otherwise specified in values.yaml.
  1. Modify the values.yaml file to point to the secret. For example:
  kuma:
    controlPlane:
      secrets:
        - Env: "KMESH_LICENSE_INLINE"
          Secret: "kong-mesh-license"
          Key: "license.json"

Universal

In Universal mode, configure a valid license by using the following environment variables:

  • KMESH_LICENSE_PATH - value with the path to a valid license file.
  • KMESH_LICENSE_INLINE - value with the actual contents of the license file.

Multi-zone

In a multi-zone deployment of Kong Mesh, only the global control plane should be configured with a valid license. The global control plane automatically synchronizes the license to any remote control plane that is part of the cluster.

In a multi-zone deployment, the DPPs count includes the total aggregate of every data plane proxy in every zone. For example, with a limit of 5 DPPs and 2 zones, you can connect 3 DPPs in one zone and 2 in another, but not 5 DPPs for each zone.

Thank you for your feedback.
Was this page useful?
  • Kong
    THE CLOUD CONNECTIVITY COMPANY

    Kong powers reliable digital connections across APIs, hybrid and multi-cloud environments.

    • Company
    • Customers
    • Events
    • Investors
    • Careers Hiring!
    • Partners
    • Press
    • Contact
  • Products
    • Kong Konnect
    • Kong Gateway
    • Kong Mesh
    • Get Started
    • Pricing
  • Resources
    • eBooks
    • Webinars
    • Briefs
    • Blog
    • API Gateway
    • Microservices
  • Open Source
    • Install Kong Gateway
    • Kong Community
    • Kubernetes Ingress
    • Kuma
    • Insomnia
  • Solutions
    • Decentralize
    • Secure & Govern
    • Create a Dev Platform
    • API Gateway
    • Kubernetes
    • Service Mesh
Star
  • Terms•Privacy
© Kong Inc. 2023