Manage Confluent Platform License in Confluent for Kubernetes

You can use Confluent Platform for a 30-day trial period without a license key. After 30 days, Confluent components require license keys. See Confluent Platform Licenses for information about Confluent licenses, including types of licenses.

In Confluent for Kubernetes (CFK), the following methods are supported to configure or update the license for Confluent Platform components:

Use Confluent Control Center or Confluent Control Center (Legacy).

All Confluent Platform components that use same Kafka cluster as the Control Center will get the updated licence without needing to rolling restart.

The components not using the same Kafka cluster as the Control Center will not get the updated licence.

For using Control Center, see Apply a license in Confluent Control Center.

For using Confluent Control Center (Legacy), see Apply a license in Confluent Control Center (Legacy).
Use the CFK API.

When you declaratively configure Confluent Platform licenses with CFK API, you have two options to configure the license for Confluent Platform components. This method requires the rolling restart of Kafka and other affected components. See the sections below for more details.
- Configure at the global level
- Configure at the component level

Note

For Connect, Centralized Connect License does not work with the Docker image confluentinc/cp-kafka-connect-base. Use the confluentinc/cp-server-connect-base Docker image to leverage the Centralized License.

Update CFK global license

The CFK configures the global license key for Confluent components.

When using the global license, CFK creates the confluent-operator-licensing and internal-confluent-operator-licensing secrets. The secrets are used by Confluent Platform components and should not be deleted.

Add or update the global license key for CFK operator.
1. To find the version image tag you wish to update the license for, see CFK Image Tags. For example, to update the license for CFK 2.6.4, use the image tag, 0.771.62.
  
  If a tag is not specified (--set image.tag=XXXX is omitted in the next helm upgrade command), the latest version of CFK will be updated.
2. Run the helm upgrade command from the helm sub-directory under the directory that has the downloaded the CFK bundle.
```
helm upgrade --install confluent-operator \
  confluentinc/confluent-for-kubernetes \
  --namespace <namespace> \
  --set image.tag=XXXX \
  --set licenseKey=<CFK license key>
```
  When the above command runs, the confluent-operator-licensing secret is created or updated with the license.txt and publicKey.pem files.
  - license.txt contains the <CFK license key> you specified in the command.
  - publicKey.pem contains the public key used to validate the signed license. This key is only used by CFK and is not used by Confluent Platform components.
  At this point, only the license key secret for the CFK operator is updated.
If this is the first time you are setting the license, the CFK operator restarts automatically.

If you are replacing an existing license, you must restart the CFK operator manually.

The Confluent Platform components are still using the old license until the components are restarted as described in the next steps.
For Confluent Platform components to use the global license set in CFK, repeat the following steps for each component that you want to apply the license to:
1. Set the following in the component custom resource (CR):
```
spec:
  license:
    globalLicense: true
```
2. Apply the component CR change.
  
  If you have multiple component CRs defined in a single file, you only need to run the command once after setting spec.license.globalLicense properties in all the component CRs.
```
kubectl apply -f <component CR> --namespace <namespace>
```
3. Restart the updated components to use the global license.
  
  Caution
  
  Do not use the steps described in this section to restart Kafka clusters. It may result in data loss.
  
  To restart Kafka, follow the steps described in Restart Kafka.
  1. Find the name of the StatefulSet corresponding to the Confluent Platform cluster you want to restart:
    kubectl get statefulset --namespace <namespace>
  2. Using the StatefulSet name, <name-of-statefulset>, from the previous step, roll the cluster:
    kubectl rollout restart statefulset/<name-of-statefulset> \ --namespace <namespace>

Update component-level licenses

You can configure the license structure at the component-level which takes precedence over the license configured by CFK.

The component-level license can be provided using one of the following methods:

A Kubernetes secret
An external secret provider, such as Vault

The license.txt file is required to be present either in the secretRef or directoryPathInContainer path.

If both secretRef or directoryPathInContainer is configured, directoryPathInContainer takes precedence.

Component-level license configuration with Kubernetes secrets

To provide a component license key using a Kubernetes secret:

Create the license.txt file with license=<your license key>:

echo -n "license=<your license key>" > license.txt

Create a Kubernetes secret for the license.txt file. --from-file=license.txt= should be included in the command:

For example, with the license.txt file in the current directory:
```
kubectl create secret generic confluent-license \
  --from-file=license.txt=./license.txt \
  --namespace <namespace>
```
Set the secret name in the component CR. Using the previous example:
```
spec:
  license:
    secretRef: confluent-license
```

Apply the component CR change:

kubectl apply -f <component CR> --namespace <namespace>

Roll the component cluster to apply the license change.

Caution

Do not use the steps described in this section to restart Kafka clusters. It may result in data loss.

To restart Kafka, follow the steps described in Restart Kafka.
1. Find the name of the StatefulSet corresponding to the Confluent Platform cluster you want to restart:
```
kubectl get statefulset --namespace <namespace>
```
2. Using the StatefulSet name, <name-of-statefulset>, from the previous step, roll the cluster:
```
kubectl rollout restart statefulset/<name-of-statefulset> \
  --namespace <namespace>
```

Component-level license configuration with an external secret provider

To provide a component license key using an external secret provider, such as HashiCorp Vault:

Install and configure Vault.

Create the license.txt file with license=<your license key>:

echo -n "license=<your license key>" > license.txt

Write license.txt to Vault. For example:

cat ./license.txt | \
  vault kv put /secrets/license.txt license=-

Set the secret name in the component CR. Using the previous example:

spec:
  license:
    directoryPathInContainer: /vault/secrets

Apply the component CR change:

kubectl apply -f <component CR> --namespace <namespace>

Roll the component cluster to apply the license change.

Caution

Do not use the steps described in this section to restart Kafka clusters. It may result in data loss.

To restart Kafka, follow the steps described in Restart Kafka.
1. Find the name of the StatefulSet corresponding to the Confluent Platform cluster you want to restart:
```
kubectl get statefulset --namespace <namespace>
```
2. Using the StatefulSet name, <name-of-statefulset>, from the previous step, roll the cluster:
```
kubectl rollout restart statefulset/<name-of-statefulset> \
  --namespace <namespace>
```

View Confluent Platform License in CFK

To check the status or content of your Confluent license, install the confluent kubectl plugins, and use the kubectl confluent cluster license option as below:

kubectl confluent cluster license \
  --secret-name confluent-operator-licensing \
  --namespace <namespace>

confluent-operator-licensing is the default secret generated when you add the license in CFK.

To check the component-level license with a custom secret name, run:

kubectl confluent cluster license \
  --secret-name <custom secret name> \
  --namespace <namespace>

See Confluent Platform Licenses for information about Confluent licenses, including types of licenses.