Licensing

Gloo product licenses link

Before you install Gloo Gateway, decide which Gloo product licenses you need for your environment. Gloo offers separate licenses for each product, Gloo Mesh and Gloo Gateway. These product licenses unlock certain capabilities in your Gloo environment, and can be used with the other in the same environment.

Gloo Gateway link

Gloo Gateway is a feature-rich, fast, and flexible Kubernetes-native ingress controller and next-generation API gateway that is built on top of Envoy proxy. An API Gateway is a reverse proxy that serves as a security barrier between your clients and the microservices that make up your app. In order to access a microservice, all clients must send a request to the API Gateway. The API Gateway then verifies and routes the request to the microservice.

To set up advanced routing, traffic management, security, resiliency, and integration capabilities, the Gloo Gateway proxy uses the Kubernetes Gateway API with custom Gloo Gateway extensions.

Features by license level

The capabilities that you can leverage in your API Gateway, such as applying the following features in the following tables to a host or route, depend on the Gloo Gateway edition that you install.

• Open source (OSS) features are included by default in your Gloo Gateway installation with the Kubernetes Gateway API. No license is required for these features.
• Enterprise Edition features are unlocked with a Gloo Gateway Enterprise license. In addition to all open soure features, an Enterprise license unlocks the most comprehensive enterprise-level features to help you build out your ideal, customized API gateway setup. If you do not already have an Enterprise license for Gloo Gateway, you can contact an account representative to obtain one.

Review the following features and the levels that each feature is supported in. Note that these lists provides a general overview of major features, and are not exhaustive.

✅ Supported
🟡 Limited support
❌ Unsupported
* Additional fees apply
† Multicluster mesh support requires an Enteprise level license for both Gloo Gateway and Gloo Mesh.

In addition, several features that were previously introduced in the Gloo Edge API were improved. Examples include the developer portal that now comes with more flexible APIs and built-in Backstage support, and an improved Istio integration that allows for easier injection of Istio sidecars.

Gloo Mesh link

Gloo Mesh deploys alongside your Istio environment in single or multicluster environments, and can discover existing Istio installations across clusters and infrastructure providers. The Gloo Mesh management plane provides visibility into your Istio environment in one or multiple clusters, such as built-in advanced observability tools, and a Gloo UI that gives you an at-a-glance view of the configuration, health, and compliance status of your Gloo Mesh setup and the workloads in your cluster. Gloo Mesh also comes with an insights engine that automatically analyzes your Istio setup for health, security, and resiliency issues. Then, Gloo shares these issues along with recommendations to harden your Istio and setup in a custom dashboard. The insights give you a checklist to address issues that might otherwise be hard to detect across your environment.

If you use Gloo Mesh along with Gloo Gateway, you can then leverage Gloo Gateway routing features in your service mesh environment, such as by using Gloo Gateway as the ingress gateway for your ambient mesh, or using Gloo Gateway as a waypoint proxy.

For more information about Gloo Mesh features, see the Gloo Mesh overview.

Get a license key link

To get a Gloo Gateway Enterprise license key, contact an account representative.

You can also request a trial license key instead. Note that each trial license key is typically valid for 30 days. When the license key expires, you can request a new license key by contacting your account representative or filling out this form.

License add-ons link

You can optionally include the following add-ons in your Gloo Gateway Enterprise license for extra features and capabilities.

• AI Gateway: Gloo AI Gateway unleashes developer productivity and accelerates AI innovation by providing a unified API interface that developers can use to access and consume AI services from multiple LLM providers. Because the API is part of the gateway proxy, you can leverage and apply additional traffic management, security, and resiliency policies to the requests to your LLM provider. To learn more, check out About Gloo AI Gateway.

Provide the license key during installation link

To use Gloo Gateway Enterprise, you must provide a license key during the installation process.

Provide key directly link

When you install Gloo Gateway Enterprise in your management cluster, you can provide your license key string directly in either of the following ways:

• Helm: In your Helm values file, provide the license string in the license_key: $GLOO_GATEWAY_LICENSE_KEY setting.
• glooctl: In your glooctl install command, include the --license-key=$GLOO_GATEWAY_LICENSE_KEY flag.

After installation completes, a Kubernetes secret is created for you to store the license key.

Provide key in a secret link

You can specify your license key by creating a secret before you install Gloo Gateway.

1. Create a secret with your license key in the gloo-system namespace of your cluster.

     kubectl apply -n gloo-system -f - << EOF
   apiVersion: v1
   kind: Secret
   type: Opaque
   metadata:
     name: license-key
     namespace: gloo-system
   data:
     license-key: ""
   EOF
     

2. When you install Gloo Gateway, specify the secret name and disable default secret generation in your Helm values file or the glooctl install command.
   • Helm: In your Helm values file, provide the secret name as the value for the gloo.license_secret_name field, and set create_license_secret to false.
   • glooctl: In your glooctl install command, include the --set gloo.license_secret_name=<license> and --set create_license_secret=false flags.

Check the license values link

Get your license key value. The following command gets and decodes the license key value from the license secret in the gloo-system namespace by using jq.

  kubectl get secret license -n gloo-system -o jsonpath="{.data.license-key}" | base64 --decode | cut -d '.' -f1,2 | tr '.' '\n' | base64 --decode | jq
  

Example output: The following license was issued on March 1, 2025; expires March 1, 2026; includes enterprise features, and has no add-ons.

  {
  "addOns": [
    {
      "Addon": 0,
      "ExpiresAt": 1772323200,
      "LicenseType": "ent"
    }
  ],
  "exp": 1772323200,
  "iat": 1740787200,
  "k": "abcdefg",
  "lt": "ent",
  "product": "gloo"
}
  

Update the license link

Before your Gloo Gateway Enterprise license expires, you can update the license by patching the license key secret.

Confirm license expiration link

The license key is stored as a Kubernetes secret in the cluster. When the key expires, the pods that mount the secret might crash. For example, if you notice that your Gloo Gateway deployments have new warnings, your license might be expired. You can check the logs for one of the deployments, such as the gloo deployment, to look for an error message similar to the following:

  kubectl logs deploy/gloo -n gloo-system
  

  {"level":"warn","ts":"2024-03-23T18:36:16.282Z","caller":"setup/setup.go:85","msg":"LICENSE WARNING: License expired, please contact support to renew."}
  

You can confirm that the license key is expired by copying and pasting your current license key into the jwt.io debugger, and checking the expiration date indicated by the exp header.

Replace the expired license link

Trial license: If you’re a new user whose trial license has expired, contact your Solo.io account representative to get a new license key, or fill out this form.

Standard license: To update the license key, patch the secret and restart the Gloo Gateway deployments. During the upgrade, the data plane continues to run, but you might not be able to modify the configurations for Gloo custom resources through the management plane.

1. Save the new license key in an environment variable.

     export GLOO_GATEWAY_LICENSE_KEY=<new-enterprise-key-string>
     

2. Update the license secret with the new key.

     kubectl create secret generic --save-config -n gloo-system license --from-literal=license-key=$GLOO_GATEWAY_LICENSE_KEY --dry-run=client -o yaml | kubectl apply -f - 
     

3. Restart the Gloo Gateway deployment to pick up the license secret changes.

     kubectl -n gloo-system rollout restart deploy/gloo
     

4. Verify that the deployment is restarted and no longer in a crashed state.

     kubectl logs deploy/gloo -n gloo-system