[{"data":1,"prerenderedAt":659},["ShallowReactive",2],{"navigation_docs":3,"-install-verify-your-install":136,"-install-verify-your-install-surround":654},[4,26,47,68,89,110,123],{"title":5,"path":6,"stem":7,"children":8,"page":25},"Getting Started","\u002Fgetting-started","1.getting-started",[9,13,17,21],{"title":10,"path":11,"stem":12},"What you are running","\u002Fgetting-started\u002Fwhat-you-are-running","1.getting-started\u002F1.what-you-are-running",{"title":14,"path":15,"stem":16},"Architecture","\u002Fgetting-started\u002Farchitecture","1.getting-started\u002F2.architecture",{"title":18,"path":19,"stem":20},"Prerequisites","\u002Fgetting-started\u002Fprerequisites","1.getting-started\u002F3.prerequisites",{"title":22,"path":23,"stem":24},"Quickstart","\u002Fgetting-started\u002Fquickstart","1.getting-started\u002F4.quickstart",false,{"title":27,"path":28,"stem":29,"children":30,"page":25},"Install","\u002Finstall","2.install",[31,35,39,43],{"title":32,"path":33,"stem":34},"Install the chart","\u002Finstall\u002Finstall-the-chart","2.install\u002F1.install-the-chart",{"title":36,"path":37,"stem":38},"Activation","\u002Finstall\u002Factivation","2.install\u002F2.activation",{"title":40,"path":41,"stem":42},"DNS and TLS","\u002Finstall\u002Fdns-and-tls","2.install\u002F3.dns-and-tls",{"title":44,"path":45,"stem":46},"Verify your install","\u002Finstall\u002Fverify-your-install","2.install\u002F4.verify-your-install",{"title":48,"path":49,"stem":50,"children":51,"page":25},"Configure","\u002Fconfigure","3.configure",[52,56,60,64],{"title":53,"path":54,"stem":55},"Data services","\u002Fconfigure\u002Fdata-services","3.configure\u002F1.data-services",{"title":57,"path":58,"stem":59},"Secrets","\u002Fconfigure\u002Fsecrets","3.configure\u002F2.secrets",{"title":61,"path":62,"stem":63},"Registry and air-gapped installs","\u002Fconfigure\u002Fregistry-and-airgap","3.configure\u002F3.registry-and-airgap",{"title":65,"path":66,"stem":67},"Integrations","\u002Fconfigure\u002Fintegrations","3.configure\u002F4.integrations",{"title":69,"path":70,"stem":71,"children":72,"page":25},"Licensing","\u002Flicensing","4.licensing",[73,77,81,85],{"title":74,"path":75,"stem":76},"How licensing works","\u002Flicensing\u002Fhow-licensing-works","4.licensing\u002F1.how-licensing-works",{"title":78,"path":79,"stem":80},"Your key never leaves","\u002Flicensing\u002Fyour-key-never-leaves","4.licensing\u002F2.your-key-never-leaves",{"title":82,"path":83,"stem":84},"What phones home","\u002Flicensing\u002Fwhat-phones-home","4.licensing\u002F3.what-phones-home",{"title":86,"path":87,"stem":88},"Revoke and recover","\u002Flicensing\u002Frevoke-and-recover","4.licensing\u002F4.revoke-and-recover",{"title":90,"path":91,"stem":92,"children":93,"page":25},"Operate","\u002Foperate","5.operate",[94,98,102,106],{"title":95,"path":96,"stem":97},"Upgrade","\u002Foperate\u002Fupgrade","5.operate\u002F1.upgrade",{"title":99,"path":100,"stem":101},"Backup and restore","\u002Foperate\u002Fbackup-and-restore","5.operate\u002F2.backup-and-restore",{"title":103,"path":104,"stem":105},"Observability","\u002Foperate\u002Fobservability","5.operate\u002F3.observability",{"title":107,"path":108,"stem":109},"High availability","\u002Foperate\u002Fhigh-availability","5.operate\u002F4.high-availability",{"title":111,"path":112,"stem":113,"children":114,"page":25},"Troubleshooting","\u002Ftroubleshooting","6.troubleshooting",[115,119],{"title":116,"path":117,"stem":118},"Install failures","\u002Ftroubleshooting\u002Finstall-failures","6.troubleshooting\u002F1.install-failures",{"title":120,"path":121,"stem":122},"Licensing failures","\u002Ftroubleshooting\u002Flicensing-failures","6.troubleshooting\u002F2.licensing-failures",{"title":124,"path":125,"stem":126,"children":127,"page":25},"Reference","\u002Freference","9.reference",[128,132],{"title":129,"path":130,"stem":131},"Helm values","\u002Freference\u002Fhelm-values","9.reference\u002F1.helm-values",{"title":133,"path":134,"stem":135},"Environment variables","\u002Freference\u002Fenvironment","9.reference\u002F2.environment",{"id":137,"title":44,"body":138,"description":647,"extension":648,"links":649,"meta":650,"navigation":651,"path":45,"seo":652,"stem":46,"__hash__":653},"docs\u002F2.install\u002F4.verify-your-install.md",{"type":139,"value":140,"toc":638},"minimark",[141,145,154,168,173,207,218,222,241,244,252,262,265,336,342,346,382,388,410,416,420,423,472,475,481,495,505,510,518,572,601,615,621,625,634],[142,143,44],"h1",{"id":144},"verify-your-install",[146,147,148,149,153],"p",{},"A successful ",[150,151,152],"code",{},"helm install"," only means the objects were accepted. What you want to know is whether the license agent enrolled, whether the API came out of its gate, and whether the lease it is serving on is a live one. Four checks, in order.",[146,155,156,157,160,161,163,164,167],{},"The names below assume a release called ",[150,158,159],{},"my-mvno"," in a namespace called ",[150,162,159],{},". The chart names its objects ",[150,165,166],{},"\u003Crelease>-platform-\u003Ccomponent>",", so substitute your own release name throughout.",[169,170,172],"h2",{"id":171},"_1-watch-it-converge","1. Watch it converge",[174,175,180],"pre",{"className":176,"code":177,"language":178,"meta":179,"style":179},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","kubectl -n my-mvno get pods -w\n","bash","",[150,181,182],{"__ignoreMap":179},[183,184,187,191,195,198,201,204],"span",{"class":185,"line":186},"line",1,[183,188,190],{"class":189},"sBMFI","kubectl",[183,192,194],{"class":193},"sfazB"," -n",[183,196,197],{"class":193}," my-mvno",[183,199,200],{"class":193}," get",[183,202,203],{"class":193}," pods",[183,205,206],{"class":193}," -w\n",[146,208,209,210,213,214,217],{},"The license agent and the API start at the same time. The API sits in ",[150,211,212],{},"Init:0\u002F2"," for a while, and that is expected: an initContainer called ",[150,215,216],{},"wait-for-lease"," blocks the API container from starting until the agent has written a license into the platform Secret. An unlicensed platform never serves, so the gate is the whole design rather than a startup race.",[169,219,221],{"id":220},"_2-the-agent-says-it-licensed-the-deployment","2. The agent says it licensed the deployment",[174,223,225],{"className":176,"code":224,"language":178,"meta":179,"style":179},"kubectl -n my-mvno logs deploy\u002Fmy-mvno-platform-license-agent\n",[150,226,227],{"__ignoreMap":179},[183,228,229,231,233,235,238],{"class":185,"line":186},[183,230,190],{"class":189},[183,232,194],{"class":193},[183,234,197],{"class":193},[183,236,237],{"class":193}," logs",[183,239,240],{"class":193}," deploy\u002Fmy-mvno-platform-license-agent\n",[146,242,243],{},"The line to look for is this one:",[174,245,250],{"className":246,"code":248,"language":249},[247],"language-text","level=INFO msg=\"activate: deployment licensed\" kind=mvno jti=\u003Clease-id>\n","text",[150,251,248],{"__ignoreMap":179},[146,253,254,257,258,261],{},[150,255,256],{},"jti"," is the id of the lease the Hub just minted for you. Once you have that line, activation is done: the code was redeemed, the license came back bound to the key the agent generated in your cluster, and it has been written into your Secret. The agent then settles into its renew loop and logs its state as it goes (",[150,259,260],{},"agent: state state=licensed",").",[146,263,264],{},"You can confirm the license really landed in the Secret:",[174,266,268],{"className":176,"code":267,"language":178,"meta":179,"style":179},"kubectl -n my-mvno get secret my-mvno-platform-env \\\n  -o jsonpath='{.data.PARENT_LEASE_TOKEN}' | base64 -d | head -c 20; echo\n",[150,269,270,290],{"__ignoreMap":179},[183,271,272,274,276,278,280,283,286],{"class":185,"line":186},[183,273,190],{"class":189},[183,275,194],{"class":193},[183,277,197],{"class":193},[183,279,200],{"class":193},[183,281,282],{"class":193}," secret",[183,284,285],{"class":193}," my-mvno-platform-env",[183,287,289],{"class":288},"sTEyZ"," \\\n",[183,291,293,296,299,303,306,308,311,314,317,319,322,325,329,332],{"class":185,"line":292},2,[183,294,295],{"class":193},"  -o",[183,297,298],{"class":193}," jsonpath=",[183,300,302],{"class":301},"sMK4o","'",[183,304,305],{"class":193},"{.data.PARENT_LEASE_TOKEN}",[183,307,302],{"class":301},[183,309,310],{"class":301}," |",[183,312,313],{"class":189}," base64",[183,315,316],{"class":193}," -d",[183,318,310],{"class":301},[183,320,321],{"class":189}," head",[183,323,324],{"class":193}," -c",[183,326,328],{"class":327},"sbssI"," 20",[183,330,331],{"class":301},";",[183,333,335],{"class":334},"s2Zo4"," echo\n",[146,337,338,339,341],{},"Any non-empty output is the head of a signed JWT. That is the value ",[150,340,216],{}," is waiting for.",[169,343,345],{"id":344},"_3-the-api-goes-ready","3. The API goes ready",[174,347,349],{"className":176,"code":348,"language":178,"meta":179,"style":179},"kubectl -n my-mvno rollout status deploy\u002Fmy-mvno-platform-api --timeout=180s\ncurl -sf https:\u002F\u002Fesim.acme.com\u002Fhealth\n",[150,350,351,371],{"__ignoreMap":179},[183,352,353,355,357,359,362,365,368],{"class":185,"line":186},[183,354,190],{"class":189},[183,356,194],{"class":193},[183,358,197],{"class":193},[183,360,361],{"class":193}," rollout",[183,363,364],{"class":193}," status",[183,366,367],{"class":193}," deploy\u002Fmy-mvno-platform-api",[183,369,370],{"class":193}," --timeout=180s\n",[183,372,373,376,379],{"class":185,"line":292},[183,374,375],{"class":189},"curl",[183,377,378],{"class":193}," -sf",[183,380,381],{"class":193}," https:\u002F\u002Fesim.acme.com\u002Fhealth\n",[146,383,384,387],{},[150,385,386],{},"rollout status"," returning cleanly means the gate opened and the API's own readiness probe passed. If it hangs instead, check the initContainer's log to see which gate it is stuck behind:",[174,389,391],{"className":176,"code":390,"language":178,"meta":179,"style":179},"kubectl -n my-mvno logs deploy\u002Fmy-mvno-platform-api -c wait-for-lease\n",[150,392,393],{"__ignoreMap":179},[183,394,395,397,399,401,403,405,407],{"class":185,"line":186},[183,396,190],{"class":189},[183,398,194],{"class":193},[183,400,197],{"class":193},[183,402,237],{"class":193},[183,404,367],{"class":193},[183,406,324],{"class":193},[183,408,409],{"class":193}," wait-for-lease\n",[146,411,412,415],{},[150,413,414],{},"waiting for PARENT_LEASE_TOKEN in the platform Secret"," still printing means the agent has not enrolled yet, so go back to check 2 and read its logs.",[169,417,419],{"id":418},"_4-the-lease-has-time-left-on-it","4. The lease has time left on it",[146,421,422],{},"Checks 1 to 3 tell you the platform booted. They do not tell you it is still licensed, because the API boots off whatever lease was in the Secret and only the agent knows whether that lease is current. Ask the agent. It publishes the remaining life of the lease it holds on its metrics port:",[174,424,426],{"className":176,"code":425,"language":178,"meta":179,"style":179},"kubectl -n my-mvno port-forward deploy\u002Fmy-mvno-platform-license-agent 9090:9090 &\ncurl -s localhost:9090\u002Fmetrics | grep '^license_'\n",[150,427,428,448],{"__ignoreMap":179},[183,429,430,432,434,436,439,442,445],{"class":185,"line":186},[183,431,190],{"class":189},[183,433,194],{"class":193},[183,435,197],{"class":193},[183,437,438],{"class":193}," port-forward",[183,440,441],{"class":193}," deploy\u002Fmy-mvno-platform-license-agent",[183,443,444],{"class":193}," 9090:9090",[183,446,447],{"class":301}," &\n",[183,449,450,452,455,458,460,463,466,469],{"class":185,"line":292},[183,451,375],{"class":189},[183,453,454],{"class":193}," -s",[183,456,457],{"class":193}," localhost:9090\u002Fmetrics",[183,459,310],{"class":301},[183,461,462],{"class":189}," grep",[183,464,465],{"class":301}," '",[183,467,468],{"class":193},"^license_",[183,470,471],{"class":301},"'\n",[146,473,474],{},"A healthy platform looks like this:",[174,476,479],{"className":477,"code":478,"language":249},[247],"license_expiry_seconds 1.2089e+06\nlicense_renew_failures_total 0\nlicense_rotations_total 0\nlicense_renew_last_success_timestamp_seconds 0\nlicense_revoked 0\n",[150,480,478],{"__ignoreMap":179},[146,482,483,486,487,490,491,494],{},[150,484,485],{},"license_expiry_seconds"," is the check. Any positive number is the seconds left on the lease the platform is serving on, and the agent only ever puts a number there after it has read a lease out of the Secret and found a future expiry in it. A platform that never enrolled reports ",[150,488,489],{},"0",". So does one whose license the Hub revoked, and ",[150,492,493],{},"license_revoked 1"," is what tells those two apart. The counters sit at zero on a fresh install and start moving at the first renewal.",[146,496,497,500,501,504],{},[150,498,499],{},"\u002Fhealth"," cannot answer this question for you. It is deliberately ungated and returns ",[150,502,503],{},"200"," whether or not this platform holds a license.",[506,507,509],"h3",{"id":508},"confirming-it-from-the-apis-side","Confirming it from the API's side",[146,511,512,513,517],{},"If you want the same answer from the API rather than the agent, send an ",[514,515,516],"strong",{},"authenticated"," request to a gated route:",[174,519,521],{"className":176,"code":520,"language":178,"meta":179,"style":179},"curl -s -o \u002Fdev\u002Fnull -w '%{http_code}\\n' \\\n  -H \"Authorization: Bearer $TOKEN\" \\\n  https:\u002F\u002Fesim.acme.com\u002Fv1\u002Faccounts\n",[150,522,523,547,566],{"__ignoreMap":179},[183,524,525,527,529,532,535,538,540,543,545],{"class":185,"line":186},[183,526,375],{"class":189},[183,528,454],{"class":193},[183,530,531],{"class":193}," -o",[183,533,534],{"class":193}," \u002Fdev\u002Fnull",[183,536,537],{"class":193}," -w",[183,539,465],{"class":301},[183,541,542],{"class":193},"%{http_code}\\n",[183,544,302],{"class":301},[183,546,289],{"class":288},[183,548,549,552,555,558,561,564],{"class":185,"line":292},[183,550,551],{"class":193},"  -H",[183,553,554],{"class":301}," \"",[183,556,557],{"class":193},"Authorization: Bearer ",[183,559,560],{"class":288},"$TOKEN",[183,562,563],{"class":301},"\"",[183,565,289],{"class":288},[183,567,569],{"class":185,"line":568},3,[183,570,571],{"class":193},"  https:\u002F\u002Fesim.acme.com\u002Fv1\u002Faccounts\n",[146,573,574,575,577,578,581,582,585,586,589,590,577,593,596,597,600],{},"A licensed platform answers whatever that route normally answers for that token: ",[150,576,503],{},", or ",[150,579,580],{},"403"," if the token does not carry the permission. An unlicensed one answers ",[150,583,584],{},"424 Failed Dependency",", and the body names the reason: ",[150,587,588],{},"parent lease not loaded",", ",[150,591,592],{},"parent lease expired",[150,594,595],{},"parent lease revoked",". On an MVNE, use ",[150,598,599],{},"https:\u002F\u002F\u003Cplatform.host>\u002Fv1\u002Fsupport\u002Ftickets"," for the same check.",[146,602,603,604,607,608,610,611,614],{},"Do not run this one without a token. Authentication runs first and the license gate sits behind it, so an anonymous request gets ",[150,605,606],{},"401"," on a licensed platform and ",[150,609,606],{}," on an unlicensed one. The status code carries no licensing signal at all until you have authenticated. That is the same ordering described in ",[612,613,74],"a",{"href":75},".",[146,616,617,618,620],{},"If the lease turns out to be missing or expired, ",[612,619,120],{"href":121}," covers what to do about it.",[169,622,624],{"id":623},"after-that","After that",[146,626,627,628,630,631,633],{},"The agent keeps renewing and rotating the license for as long as the release runs, without a restart and without you doing anything. ",[612,629,74],{"href":75}," explains what it sends and when. If any of the four checks above went sideways, ",[612,632,116],{"href":117}," is the place to start.",[635,636,637],"style",{},"html pre.shiki code .sBMFI, html code.shiki .sBMFI{--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B}html pre.shiki code .sfazB, html code.shiki .sfazB{--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .sTEyZ, html code.shiki .sTEyZ{--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8}html pre.shiki code .sMK4o, html code.shiki .sMK4o{--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF}html pre.shiki code .sbssI, html code.shiki .sbssI{--shiki-light:#F76D47;--shiki-default:#F78C6C;--shiki-dark:#F78C6C}html pre.shiki code .s2Zo4, html code.shiki .s2Zo4{--shiki-light:#6182B8;--shiki-default:#82AAFF;--shiki-dark:#82AAFF}",{"title":179,"searchDepth":186,"depth":292,"links":639},[640,641,642,643,646],{"id":171,"depth":292,"text":172},{"id":220,"depth":292,"text":221},{"id":344,"depth":292,"text":345},{"id":418,"depth":292,"text":419,"children":644},[645],{"id":508,"depth":568,"text":509},{"id":623,"depth":292,"text":624},"Four checks that tell you the release came up licensed and serving.","md",null,{},true,{"title":44,"description":647},"xxkNBWWsDcGrYFiJqBAajTtmSDza0GaKfB82113jjcs",[655,657],{"title":40,"path":41,"stem":42,"description":656,"children":-1},"Point a hostname at the ingress and let cert-manager issue the certificate.",{"title":53,"path":54,"stem":55,"description":658,"children":-1},"Postgres and Kafka run under an operator by default, or point them at a managed service. Redis is the one service the chart still runs itself.",1783967741116]