Skip to content
Kong Docs are moving soon! Our docs are migrating to a new home. You'll be automatically redirected to the new site in the future. In the meantime, view this page on the new site!
Kong Logo | Kong Docs Logo
  • Docs
    • Explore the API Specs
      View all API Specs View all API Specs View all API Specs arrow image
    • Documentation
      API Specs
      Kong Gateway
      Lightweight, fast, and flexible cloud-native API gateway
      Kong Konnect
      Single platform for SaaS end-to-end connectivity
      Kong AI Gateway
      Multi-LLM AI Gateway for GenAI infrastructure
      Kong Mesh
      Enterprise service mesh based on Kuma and Envoy
      decK
      Helps manage Kong’s configuration in a declarative fashion
      Kong Ingress Controller
      Works inside a Kubernetes cluster and configures Kong to proxy traffic
      Kong Gateway Operator
      Manage your Kong deployments on Kubernetes using YAML Manifests
      Insomnia
      Collaborative API development platform
  • Plugin Hub
    • Explore the Plugin Hub
      View all plugins View all plugins View all plugins arrow image
    • Functionality View all View all arrow image
      View all plugins
      AI's icon
      AI
      Govern, secure, and control AI traffic with multi-LLM AI Gateway plugins
      Authentication's icon
      Authentication
      Protect your services with an authentication layer
      Security's icon
      Security
      Protect your services with additional security layer
      Traffic Control's icon
      Traffic Control
      Manage, throttle and restrict inbound and outbound API traffic
      Serverless's icon
      Serverless
      Invoke serverless functions in combination with other plugins
      Analytics & Monitoring's icon
      Analytics & Monitoring
      Visualize, inspect and monitor APIs and microservices traffic
      Transformations's icon
      Transformations
      Transform request and responses on the fly on Kong
      Logging's icon
      Logging
      Log request and response data using the best transport for your infrastructure
  • Support
  • Community
  • Kong Academy
Get a Demo Start Free Trial
Kong Mesh
2.4.x
  • Home icon
  • Kong Mesh
  • Production
  • Cp Deployment
  • License
github-edit-pageEdit this page
report-issueReport an issue
  • Kong Gateway
  • Kong Konnect
  • Kong Mesh
  • Kong AI Gateway
  • Plugin Hub
  • decK
  • Kong Ingress Controller
  • Kong Gateway Operator
  • Insomnia
  • Kuma

  • Docs contribution guidelines
  • dev
  • 2.10.x (latest)
  • 2.9.x
  • 2.8.x
  • 2.7.x (LTS)
  • 2.6.x
  • 2.5.x
  • 2.4.x
  • 2.3.x
  • 2.2.x
  • Introduction
    • About service meshes
    • Overview of Kong Mesh
    • How Kong Mesh works
    • Architecture
    • Stages of software availability
    • Version support policy
    • Mesh requirements
    • Release notes
  • Getting Started
  • Kong Mesh in Production
    • Overview
    • Deployment topologies
      • Overview
      • Standalone deployment
      • Multi-zone deployment
    • Install kumactl
    • Use Kong Mesh
    • Control plane deployment
      • Kong Mesh license
      • Deploy a standalone control plane
      • Deploy a multi-zone global control plane
      • Zone Ingress
      • Zone Egress
      • Configure zone proxy authentication
      • Control plane configuration reference
      • Systemd
      • Kubernetes
    • Create multiple service meshes in a cluster
    • Data plane configuration
      • Data plane proxy
      • Configure the data plane on Kubernetes
      • Configure the data plane on Universal
      • Configure the Kong Mesh CNI
      • Configure transparent proxying
      • IPv6 support
    • Secure your deployment
      • Manage secrets
      • Authentication with the API server
      • Authentication with the data plane proxy
      • Configure data plane proxy membership
      • Secure access across services
      • Kong Mesh RBAC
      • FIPS support
    • Kong Mesh user interface
    • Upgrades and tuning
      • Upgrade Kong Mesh
      • Performance fine-tuning
  • Deploy
    • Explore Kong Mesh with the Kubernetes demo app
    • Explore Kong Mesh with the Universal demo app
  • Explore
    • Gateway
      • Delegated
      • Builtin
    • CLI
      • kumactl
    • Observability
      • Demo setup
      • Control plane metrics
      • Configuring Prometheus
      • Configuring Grafana
      • Configuring Datadog
      • Observability in multi-zone
    • Inspect API
      • Matched policies
      • Affected data plane proxies
      • Envoy proxy configuration
    • Kubernetes Gateway API
      • Installation
      • Gateways
      • TLS termination
      • Customization
      • Multi-mesh
      • Multi-zone
      • GAMMA
      • How it works
  • Networking
    • Service Discovery
    • DNS
      • How it works
      • Installation
      • Configuration
      • Usage
    • Non-mesh traffic
      • Incoming
      • Outgoing
    • Transparent Proxying
  • Monitor & manage
    • Dataplane Health
      • Circuit Breaker Policy
      • Kubernetes and Universal Service Probes
      • Health Check Policy
    • Control Plane Configuration
      • Modifying the configuration
      • Inspecting the configuration
      • Store
  • Policies
    • Introduction
    • General notes about Kong Mesh policies
    • Applying Policies
    • How Kong Mesh chooses the right policy to apply
    • Understanding TargetRef policies
    • Protocol support in Kong Mesh
    • Mutual TLS
      • Usage of "builtin" CA
      • Usage of "provided" CA
      • Permissive mTLS
      • Certificate Rotation
    • Traffic Permissions
      • Usage
      • Access to External Services
    • Traffic Route
      • Usage
    • Traffic Metrics
      • Expose metrics from data plane proxies
      • Expose metrics from applications
      • Override Prometheus settings per data plane proxy
      • Filter Envoy metrics
      • Secure data plane proxy metrics
    • Traffic Trace
      • Add a tracing backend to the mesh
      • Add TrafficTrace resource
    • Traffic Log
      • Add a logging backend
      • Add a TrafficLog resource
      • Logging external services
      • Builtin Gateway support
      • Access Log Format
    • Locality-aware Load Balancing
      • Enabling locality-aware load balancing
    • Fault Injection
      • Usage
      • Matching
    • Health Check
      • Usage
      • Matching
    • Circuit Breaker
      • Usage
      • Matching
      • Builtin Gateway support
      • Non-mesh traffic
    • External Service
      • Usage
      • Builtin Gateway support
    • Retry
      • Usage
      • Matching
      • Builtin Gateway support
    • Timeout
      • Usage
      • Configuration
      • Default general-purpose Timeout policy
      • Matching
      • Builtin Gateway support
      • Inbound timeouts
      • Non-mesh traffic
    • Rate Limit
      • Usage
      • Matching destinations
      • Builtin Gateway support
    • Virtual Outbound
      • Examples
    • MeshGateway
      • TLS Termination
    • MeshGatewayRoute
      • Listener tags
      • Matching
      • Filters
      • Reference
    • MeshGatewayInstance
    • Service Health Probes
      • Kubernetes
      • Universal probes
    • MeshAccessLog (Beta)
      • TargetRef support matrix
      • Configuration
      • Examples
    • MeshCircuitBreaker (Beta)
      • TargetRef support matrix
      • Configuration
      • Examples
    • MeshFaultInjection (Beta)
      • TargetRef support matrix
      • Configuration
      • Examples
    • MeshHealthCheck (Beta)
      • TargetRef support matrix
      • Configuration
      • Examples
    • MeshHTTPRoute (Beta)
      • TargetRef support matrix
      • Configuration
      • Examples
      • Merging
    • MeshProxyPatch (Beta)
      • TargetRef support matrix
      • Configuration
      • Examples
      • Merging
    • MeshRateLimit (Beta)
      • TargetRef support matrix
      • Configuration
      • Examples
    • MeshRetry (Beta)
      • TargetRef support matrix
      • Configuration
      • Examples
    • MeshTCPRoute (Beta)
      • TargetRef support matrix
      • Configuration
      • Examples
      • Route policies with different types targeting the same destination
    • MeshTimeout (Beta)
      • TargetRef support matrix
      • Configuration
      • Examples
    • MeshTrace (Beta)
      • TargetRef support matrix
      • Configuration
      • Examples
    • MeshTrafficPermission (Beta)
      • TargetRef support matrix
      • Configuration
      • Examples
    • MeshLoadBalancingStrategy (Beta)
      • TargetRef support matrix
      • Configuration
      • Examples
    • OPA policy
    • MeshOPA (beta)
    • MeshGlobalRateLimit (beta)
  • Enterprise Features
    • Overview
    • HashiCorp Vault CA
    • Amazon ACM Private CA
    • cert-manager Private CA
    • OPA policy support
    • MeshOPA (beta)
    • Multi-zone authentication
    • FIPS support
    • Certificate Authority rotation
    • Role-Based Access Control
    • UBI Images
    • Windows Support
    • ECS Support
    • Auditing
    • MeshGlobalRateLimit (beta)
  • Reference
    • HTTP API
    • Kubernetes annotations and labels
    • Kuma data collection
    • Control plane configuration reference
    • Envoy proxy template
  • Community
    • Contribute to Kuma
enterprise-switcher-icon Switch to OSS
On this pageOn this page
  • Licensed metrics
  • License behaviours
  • License API
  • Configure the license
    • Kubernetes (kumactl)
    • Kubernetes (Helm)
    • Universal
  • Update a license
    • Kubernetes
    • Universal
  • Multi-zone
You are browsing documentation for an older version. See the latest documentation here.

License

Kong Mesh requires a valid license before it can start the global kuma-cp process. When the license is not set, Kong Mesh automatically uses a pre-bundled license with the following limits:

  • Number of data plane proxies (DPPs) allowed: 5
  • Expiration date: 30 days

The pre-bundled license can be overwritten by explicitly setting a new one. You can obtain a Kong Mesh license by getting in touch with the Kong team.

A license file with a valid signature typically looks like the following example:

{
  "license": {
    "version": 1,
    "signature": "...",
    "payload": {
      "customer": "company_inc",
      "license_creation_date": "2021-8-4",
      "product_subscription": "Kong Mesh",
      "dataplanes": "5",
      "license_expiration_date": "2023-11-09",
      "license_key": "..."
    }
  }
}

When installing Kong Mesh, the license file can be passed to kuma-cp with the following instructions.

If running Kong Mesh in a multi-zone deployment, the file must be passed to the global kuma-cp. In this mode, Kong Mesh automatically synchronizes the license to the remote kuma-cp, therefore this operation is only required on the global kuma-cp.

Licensed metrics

The license encourages a pay-as-you-go model that delivers the best benefits to you, the end user, since the derived value of Kong Mesh is directly associated to the positive benefits of real service mesh usage.

These metrics are:

  • Number of connected data plane proxies (DPPs), across every zone.
  • An expiration date that determines the duration of the license.

In the context of the metric, a data plane proxy (DPP) is a standard data plane proxy that is deployed next to your services, either as a sidecar container or in a virtual machine. Gateway data plane proxies, zone ingresses, and zone egresses are not counted.

You can measure the number of data plane proxies needed in Kong Mesh by the number of services you want to include in your service meshes. Use the following formula:

Number of DPPs = Number of Pods + Number of VMs.

License behaviours

With an expired license or invalid license the control-plane will fail to start. If the license expires while the control-plane is running it will keep running but a restart of the instance will fail. The control-plane will issue a warning in the logs and the GUI when the license expires in less than 30 days.

With a valid issued license, a data plane proxy will always be able to join the service mesh, even if you go above the allowed limit to prevent service disruptions. If the number of DPPs does go above the limit, you will see a warning in the GUI and in the control plane logs.

With the pre-bundled license, if you go over the maximum allowed number of DPPs, the system will automatically refuse their connections.

License API

You can inspect the license using the GUI or the API /license endpoint on the control plane. For example:

$ curl <IP of the control plane>:5681/license
{
 "allowedDataplaneProxies": 20,
 "activeDataplaneProxies": 2,
 "expirationDate": "2032-11-09T00:00:00Z",
 "demo": false
}

Configure the license

A valid license file can be passed to Kong Mesh in a variety of ways.

Kubernetes (kumactl)

When installing the Kong Mesh control plane with kumactl install control-plane, provide a --license-path argument with a full path to a valid license file. For example:

$ kumactl install control-plane --license-path=/path/to/license.json

Kubernetes (Helm)

To install a valid license via Helm:

  1. Create a secret named kong-mesh-license in the same namespace where Kong Mesh is being installed. For example:

    $ kubectl create namespace kong-mesh-system
    $ kubectl create secret generic kong-mesh-license -n kong-mesh-system --from-file=/path/to/license.json
    

    Where:

    • kong-mesh-system is the namespace where Kong Mesh control plane is installed
    • /path/to/license.json is the path to a valid license file. The filename should be license.json unless otherwise specified in values.yaml.
  2. Modify the values.yaml file to point to the secret. For example:

    kuma:
      controlPlane:
        secrets:
          - Env: "KMESH_LICENSE_INLINE"
            Secret: "kong-mesh-license"
            Key: "license.json"
    

Universal

In Universal mode, configure a valid license by using the following environment variables:

  • KMESH_LICENSE_PATH - value with the path to a valid license file.
  • KMESH_LICENSE_INLINE - value with the actual contents of the license file.

Update a license

Kubernetes

  1. Update the kong-mesh-license Secret in kong-mesh-system namespace with a new license:
      kubectl edit secrets -n kong-mesh-system kong-mesh-license
    
  2. Restart the control plane:
      kubectl rollout restart -n kong-mesh-system deployment kong-mesh-control-plane
    

Universal

  1. Update the license by doing one of the following:
    • If you used KMESH_LICENSE_PATH, update the content of the file.
    • If you used KMESH_LICENSE_INLINE, update the value of the environment variable.
  2. Restart the control plane.

Multi-zone

In a multi-zone deployment of Kong Mesh, only the global control plane should be configured with a valid license. The global control plane automatically synchronizes the license to any remote control plane that is part of the cluster.

In a multi-zone deployment, the DPPs count includes the total aggregate of every data plane proxy in every zone. For example, with a limit of 5 DPPs and 2 zones, you can connect 3 DPPs in one zone and 2 in another, but not 5 DPPs for each zone.

Thank you for your feedback.
Was this page useful?
Too much on your plate? close cta icon
More features, less infrastructure with Kong Konnect. 1M requests per month for free.
Try it for Free
  • Kong
    Powering the API world

    Increase developer productivity, security, and performance at scale with the unified platform for API management, service mesh, and ingress controller.

    • Products
      • Kong Konnect
      • Kong Gateway Enterprise
      • Kong Gateway
      • Kong Mesh
      • Kong Ingress Controller
      • Kong Insomnia
      • Product Updates
      • Get Started
    • Documentation
      • Kong Konnect Docs
      • Kong Gateway Docs
      • Kong Mesh Docs
      • Kong Insomnia Docs
      • Kong Konnect Plugin Hub
    • Open Source
      • Kong Gateway
      • Kuma
      • Insomnia
      • Kong Community
    • Company
      • About Kong
      • Customers
      • Careers
      • Press
      • Events
      • Contact
  • Terms• Privacy• Trust and Compliance
© Kong Inc. 2025