Apply an Enterprise license with Kong Ingress Controller

This page explains how to apply an enterprise license to Kong Ingress Controller managed Kong Gateway instances.

Kong Ingress Controller v3.1 introduced a KongLicense CRD that applies a license to Kong Gateway using the Admin API.

1. Create a file named license.json containing your Kong Gateway license.

2. Create a KongLicense object with the rawLicenseString field set to your license:

   echo "
   apiVersion: configuration.konghq.com/v1alpha1
   kind: KongLicense
   metadata:
     name: kong-license
   rawLicenseString: '$(cat ./license.json)'
   " | kubectl apply -f -
   

3. Verify that Kong Ingress Controller is using the license:

   kubectl describe konglicense kong-license
   

   The results should look like this, including the Programmed condition with True status:

   Name:         kong-license
   Namespace:
   Labels:       <none>
   Annotations:  <none>
   API Version:  configuration.konghq.com/v1alpha1
   Enabled:      true
   Kind:         KongLicense
   Metadata:
    Creation Timestamp:  2024-02-06T15:37:58Z
    Generation:          1
    Resource Version:    2888
   Raw License String:   <your-license-string>   
   Status:
    Controllers:
     Conditions:
      Last Transition Time:  2024-02-06T15:37:58Z
      Message:
      Reason:                PickedAsLatest
      Status:                True
      Type:                  Programmed
     Controller Name:        konghq.com/kong-ingress-controller/5b374a9e.konghq.com
   

All Kong Gateway instances that are configured by the Kong Ingress Controller will have the license provided in KongLicense applied to them. To update your license, update the KongLicense resource and Kong Ingress Controller will dynamically propagate across all Kong Gateway instances with no downtime. There is no need to restart your Pods when updating a license.

An alternative option is to use a static license Secret that will be used to populate Kong Gateway’s KONG_LICENSE_DATA environment variable. This option allows you to store the license in Kubernetes secrets, but requires a Pod restart when the value of the secret changes.

1. Create a file named license.json containing your Kong Gateway license and store it in a Kubernetes secret:

    kubectl create namespace kong
    kubectl create secret generic kong-enterprise-license --from-file=license=./license.json -n kong
   

2. Create a values.yaml file:

    gateway:
      image:
        repository: kong/kong-gateway
      env:
        LICENSE_DATA:
          valueFrom:
            secretKeyRef:
              name: kong-enterprise-license
              key: license
   

3. Install Kong Ingress Controller and Kong Gateway with Helm:

    helm upgrade --install kong kong/ingress -n kong --create-namespace --values ./values.yaml