Licensing

Before you install Gloo Gateway, decide which Gloo product licenses you need for your environment. Gloo offers separate licenses for each product, Gloo Mesh and Gloo Gateway. These product licenses unlock certain capabilities in your Gloo environment, and can be used with the other in the same environment.

License types link

Gloo Gateway supports Envoy-based and agentgateway data plane proxies. Each proxy type requires its own license. That way, you can get access to the functionality that you need for your workloads. To learn more about these proxy types, see Gateway proxies.

Operation modes link

Get a license key link

To get a Gloo Gateway license key, contact an account representative.

You can also request a trial license key instead. Note that each trial license key is typically valid for 30 days. When the license key expires, you can request a new license key by contacting your account representative or filling out this form.

Provide the license key during installation link

To use Gloo Gateway, you must provide a license key during the installation process.

Provide key directly link

When you install Gloo Gateway in your management cluster, you can provide your license keys as follows:

  helm upgrade -i gloo-gateway oci://us-docker.pkg.dev/solo-public/gloo-gateway/charts/gloo-gateway \
     -n gloo-system \
     --version 2.0.2 \
     --set licensing.glooGatewayLicenseKey=$GLOO_GATEWAY_LICENSE_KEY \
  

  helm upgrade -i gloo-gateway oci://us-docker.pkg.dev/solo-public/gloo-gateway/charts/gloo-gateway \
     -n gloo-system \
     --version 2.0.2 \
     --set agentgateway.enabled=true \
     --set licensing.agentgatewayLicenseKey=$AGENTGATEWAY_LICENSE_KEY 
  

  helm upgrade -i gloo-gateway oci://us-docker.pkg.dev/solo-public/gloo-gateway/charts/gloo-gateway \
     -n gloo-system \
     --version 2.0.2 \
     --set agentgateway.enabled=true \
     --set licensing.glooGatewayLicenseKey=$GLOO_GATEWAY_LICENSE_KEY \
     --set licensing.agentgatewayLicenseKey=$AGENTGATEWAY_LICENSE_KEY 
  

  helm upgrade -i gloo-gateway oci://us-docker.pkg.dev/solo-public/gloo-gateway/charts/gloo-gateway \
     -n gloo-system \
     --version 2.0.2 \
     --set licensing.glooGatewayLicenseKey=$TRIAL_LICENSE_KEY \
  

After installation completes, the Kubernetes secret gloo-gateway-license-keys is created for you to store the license keys.

Provide key in a secret link

You can specify your license key by creating a secret before you install Gloo Gateway.

1. Create a secret with your license key in the gloo-system namespace of your cluster. Note that the secret must be created in the same namespace as you plan to install Gloo Gateway

     cat << EOF | kubectl apply -f -
   apiVersion: v1
   kind: Secret
   type: Opaque
   metadata:
     name: license-key
     namespace: gloo-system
   stringData:
     gloo-gateway-license-key: "${GLOO_GATEWAY_LICENSE_KEY}"
   EOF
     

     cat << EOF | kubectl apply -f -
   apiVersion: v1
   kind: Secret
   type: Opaque
   metadata:
     name: license-key
     namespace: gloo-system
   stringData:
     agentgateway-license-key: "${AGENTGATEWAY_LICENSE_KEY}"
   EOF
     

     cat << EOF | kubectl apply -f -
   apiVersion: v1
   kind: Secret
   type: Opaque
   metadata:
     name: license-key
     namespace: gloo-system
   stringData:
     gloo-gateway-license-key: "${GLOO_GATEWAY_LICENSE_KEY}"
     agentgateway-license-key: "${AGENTGATEWAY_LICENSE_KEY}"
   EOF
     

     cat << EOF | kubectl apply -f -
   apiVersion: v1
   kind: Secret
   type: Opaque
   metadata:
     name: license-key
     namespace: gloo-system
   stringData:
     gloo-gateway-license-key: "${TRIAL_LICENSE_KEY}"
   EOF
     

2. When you install Gloo Gateway, specify the secret name and disable default secret generation in your Helm values file.

     
   licensing: 
     secretName: license-key
     createSecret: false
     

Check the license values link

Get your license key value. The following command gets and decodes the license key value from the license secret in the gloo-system namespace by using jq.

  kubectl get secret gloo-gateway-license-keys \
-n gloo-system \
-o jsonpath="{.data.gloo-gateway-license-key}" | base64 --decode | cut -d '.' -f1,2 | tr '.' '\n' | base64 --decode | jq
  

  {
  "addOns": [
    {
      "Addon": 0,
      "ExpiresAt": 1753969356,
      "LicenseType": "ent"
    }
  ],
  "exp": 1772323200,
  "iat": 1740787200,
  "k": "zsclAQ",
  "lt": "ent",
  "product": "gloo"
}
  

  kubectl get secret gloo-gateway-license-keys \
-n gloo-system \
-o jsonpath="{.data.agentgateway-license-key}" | base64 --decode | cut -d '.' -f1,2 | tr '.' '\n' | base64 --decode | jq
  

  {
  "addOns": [],
  "exp": 1790088330,
  "iat": 1758552330,
  "k": "JacoGg",
  "lt": "ent",
  "product": "agentgateway"
}
  

Update the license link

Before your Gloo Gateway or agentgateway license expires, you can update the license by patching the license key secret.

Confirm license expiration link

The license keys are stored as a Kubernetes secret in the cluster. When the keys expire, the pods that mount the secret might crash. For example, if you notice that your Gloo Gateway deployments have new warnings, your licenses might be expired. You can check the logs for one of the deployments, such as the gloo deployment, to look for an error message similar to the following:

  kubectl logs deploy/gloo-gateway -n gloo-system
  

  {"level":"warn","ts":"2024-03-23T18:36:16.282Z","caller":"setup/setup.go:85",
"msg":"LICENSE WARNING: License expired, please contact support to renew."}
  

You can confirm that the license key is expired by copying and pasting your current license key into the jwt.io debugger, and checking the expiration date indicated by the exp header.

Replace the expired license link

Trial license: If you’re a new user whose trial license has expired, contact your Solo.io account representative to get a new license key, or fill out this form.

Enterprise license: To update the license key, patch the secret and restart the Gloo Gateway deployments. During the upgrade, the data plane continues to run, but you might not be able to modify the configurations for Gloo custom resources through the management plane.

1. Save the new license key in an environment variable.

     export GLOO_GATEWAY_LICENSE_KEY=<new-gloo-gateway-key-string>
   export AGENTGATEWAY_LICENSE_KEY=<new-agentgateway-key-string>
     

2. Update the license secret with the new key.

     kubectl create secret generic --save-config \
   -n gloo-system gloo-gateway-license-keys \
   --from-literal=gloo-gateway-license-key=$GLOO_GATEWAY_LICENSE_KEY \
   --from-literal=agentgateway-license-key=$AGENTGATEWAY_LICENSE_KEY \
   --dry-run=client -o yaml | kubectl apply -f - 
     

3. Restart the Gloo Gateway deployment to pick up the license secret changes.

     kubectl -n gloo-system rollout restart deploy/gloo-gateway
     

4. Verify that the deployment is restarted and no longer in a crashed state.

     kubectl logs deploy/gloo-gateway -n gloo-system