Skip to content
This version of the documentation is currently under development. Select the stable version from the version drop down.

For the complete documentation index, see llms.txt. Markdown versions of all docs pages are available by appending .md to any docs URL.

Licensing

Page as Markdown
Get a Solo Enterprise for Istio license and manage its lifecycle in your environment.
Features by license level

When you use the Solo distribution of Istio to deploy ambient or sidecar service meshes, you can also provide your Solo Enterprise for Istio license.
The Solo distribution of Istio includes numerous features that you can unlock with three levels of Solo licenses. If you provide a -solo tagged image of Istio version 1.25 or later and your Solo license in your Istio installation values, your Istio installation is automatically enabled with the features provided by your license.
  • Basic features are unlocked with a Basic license. These standard features provide you with long-term and FIPS support for Istio on top of the open source offerings of Istio.
  • Premium features are unlocked with a Premium license. In addition to all Basic features, a Premium license unlocks increased Solo support.
  • Enterprise features are unlocked with an Enterprise license. In addition to all Basic and Premium features, a Premium license unlocks the most comprehensive enterprise-level features to help you build out your ideal, customized mesh setup.
If you do not already have a Basic, Premium, or Enterprise license, you can contact an account representative to obtain one. Note that if you use a Premium or Enterprise license to install a Solo distribution of Istio, you can also use the same license to install the Solo UI for better visibility into your environment.
To review the features that each license level supports, see the Istio support plans comparison on Solo.io. To learn more about select features that are enabled by an Enterprise license, see Enterprise features.
Get a license key

To get a Solo Enterprise for Istio license, contact an account representative.
Provide your license key during Solo UI installation

When you install the Solo UI in a cluster, you provide your license keys either as an environment variable in your Helm values file, or in a secret that you pass into the Helm command or values file. Note that you must have an Enterprise or trial license to install the Solo UI, and cannot use a Basic or Premium license.
Trial license

  1. Save your trial license key as an environment variable.
    export SOLO_TRIAL_LICENSE_KEY=<solo-trial-license-key>
  2. Decide how you want to provide your trial key during installation.
    When you install the Solo UI management Helm chart in a cluster, you can provide your trial license key in the licensing.licenseKey: $SOLO_TRIAL_LICENSE_KEY setting of your Helm values file.
    You can specify your trial license key by creating a secret before you install the Solo UI.
    1. Create the solo-enterprise namespace.
      kubectl create ns solo-enterprise --context ${context1}
    2. Create a secret with your trial key in the solo-enterprise namespace.
      cat << EOF | kubectl apply --context ${context1} -f -
apiVersion: v1
kind: Secret
type: Opaque
metadata:
  name: license-secret
  namespace: solo-enterprise
stringData:
  gloo-trial-license-key: "${SOLO_TRIAL_LICENSE_KEY}"
EOF
    3. When you install the Solo UI management Helm chart in the cluster, provide your secret in the licensing.secretName: license-secret setting of your Helm values file.
Solo Enterprise for Istio license

Provide your enterprise-level license for Solo Enterprise for Istio.
  1. Save your license key as an environment variables.
    export SOLO_ISTIO_LICENSE_KEY=<license-key>
  2. Decide how you want to provide your license key during installation.
    When you install the Solo UI management Helm chart in a cluster, you can provide your license key in the licensing.licenseKey: $SOLO_ISTIO_LICENSE_KEY setting of your Helm values file.
    You can specify your license key by creating a secret before you install the Solo UI.
    1. Create the solo-enterprise namespace.
      kubectl create ns solo-enterprise --context ${context1}
    2. Create a secret with your license key in the solo-enterprise namespace.
      cat << EOF | kubectl apply --context ${context1} -f -
apiVersion: v1
kind: Secret
type: Opaque
metadata:
  name: license-secret
  namespace: solo-enterprise
stringData:
  solo-enterprise-license-key: "$SOLO_ISTIO_LICENSE_KEY"
EOF
    3. When you install the Solo UI management Helm chart in the cluster, provide your secret in the licensing.secretName: license-secret setting of your Helm values file.
Provide your license key during Istio installation

When you install an ambient or sidecar service mesh in your workload clusters, you can provide your license by following one of the Istio installation guides in this documentation set. These guides include steps for how to provide your license in your service mesh installation values, depending on the method of installation.
Use a license secret with istiod

Instead of providing your license key inline, you can store it in a Kubernetes secret and reference the secret in your istiod Helm values. The istiod chart accepts exactly three data key names. Any other key name causes istiod to fail to start with the error no license found in secret.
The following data key names are checked in this order:
  1. license-key
  2. gloo-mesh-license-key
  3. gloo-trial-license-key
Note
These data key names differ from those used by the Solo UI management chart. Do not copy the solo-enterprise-license-key key name from the Solo UI installation examples in the previous sections.
  1. Create the secret in the namespace where you install istiod, typically istio-system.
    kubectl apply -f - <<EOF
apiVersion: v1
kind: Secret
type: Opaque
metadata:
  name: license-keys
  namespace: istio-system
stringData:
  license-key: "${SOLO_ISTIO_LICENSE_KEY}"
EOF
  2. Reference the secret in your istiod Helm values.
    license:
  secretRef:
    name: license-keys
    namespace: istio-system
Ambient mesh

To provide your license during an ambient mesh installation, follow one of these guides:
Sidecar mesh

To provide your license during a sidecar mesh installation, follow one of these guides:
Monitor your license

You can check the state of your Solo Enterprise for Istio license in the following ways.
Query the istiod debug endpoint

You can query the istiod monitoring port to get the current license state and product tier.
  1. Forward the istiod monitoring port to your local machine.
    kubectl port-forward -n istio-system deploy/istiod 15014:15014
  2. In a separate terminal, query the /debug/license endpoint.
    curl -s localhost:15014/debug/license
    The response includes the license State and detected Product, for example:
    {"State":"OK","Product":"istio-support-basic"}
    The State field returns one of the following values.
    StateDescription
    OKThe license is valid. Non-trial licenses that have expired also return OK and enter a grace period.
    EXPIREDThe license has expired. Applies to trial licenses only. Istiod does not start when a trial license is expired.
    INVALIDThe license key is malformed or not recognized.
Check istiod startup logs

Check the logs in the current istiod pod. At startup, istiod logs a VALID LICENSE line that includes the license expiry date.
kubectl logs -n istio-system deploy/istiod | grep "VALID LICENSE\|license state"
Example output:
VALID LICENSE: istio-support-basic Enterprise, issued at 2026-03-16 19:38:03 +0000 UTC, not valid before 2026-03-16 19:38:03 +0000 UTC, expires at 2027-03-16 19:38:03 +0000 UTC
For trial licenses, expiry is a hard failure. Istiod does not start when a trial license is expired. For non-trial licenses, expiry does not stop istiod immediately. Istiod enters a grace period and also prints the following warning 25 times at startup.
WARNING: found expired license key, temporarily allowing for a grace period
You can set up log-based alerting on this message to detect expiry before it causes an outage. When you see this warning, update your license.
Check license state with istioctl

The istioctl multicluster check command includes a license validity check. You can run it against a single cluster by omitting the --contexts flag to use the current kubeconfig context, or by passing one context explicitly.
Note
The license check in istioctl multicluster check validates whether the license supports Enterprise-tier multicluster capabilities. An Enterprise license passes. A Basic or Premium license returns a warning even if the license remains current and valid for single-cluster use.
istioctl multicluster check --contexts=<context>
The following example shows a passing license check.
✅ License Check: license is valid for multicluster
The following example shows a warning. The license does not support multicluster capabilities, which can mean the license tier is Basic or Premium, or that the license has expired.
⚠  License Check: found invalid license for multicluster
For more information about command options, see the istioctl multicluster check reference page.
Update your license

Before your Solo Enterprise for Istio license expires, update it by upgrading the Helm release with a new license key.
  1. Get a new license key by contacting your account representative.
  2. Save the new license key as an environment variable.
    export SOLO_ISTIO_LICENSE_KEY=<new-key-string>
  3. Upgrade the management Helm release with the new license key. Use --reuse-values to preserve your existing configuration.
    helm upgrade solo-management \
oci://us-docker.pkg.dev/solo-public/solo-enterprise-helm/charts/management \
-n solo-enterprise \
--reuse-values \
--set licensing.licenseKey=${SOLO_ISTIO_LICENSE_KEY}
Architecture