[{"data":1,"prerenderedAt":550},["ShallowReactive",2],{"navigation_docs":3,"-licensing-revoke-and-recover":136,"-licensing-revoke-and-recover-surround":545},[4,26,47,68,89,110,123],{"title":5,"path":6,"stem":7,"children":8,"page":25},"Getting Started","\u002Fgetting-started","1.getting-started",[9,13,17,21],{"title":10,"path":11,"stem":12},"What you are running","\u002Fgetting-started\u002Fwhat-you-are-running","1.getting-started\u002F1.what-you-are-running",{"title":14,"path":15,"stem":16},"Architecture","\u002Fgetting-started\u002Farchitecture","1.getting-started\u002F2.architecture",{"title":18,"path":19,"stem":20},"Prerequisites","\u002Fgetting-started\u002Fprerequisites","1.getting-started\u002F3.prerequisites",{"title":22,"path":23,"stem":24},"Quickstart","\u002Fgetting-started\u002Fquickstart","1.getting-started\u002F4.quickstart",false,{"title":27,"path":28,"stem":29,"children":30,"page":25},"Install","\u002Finstall","2.install",[31,35,39,43],{"title":32,"path":33,"stem":34},"Install the chart","\u002Finstall\u002Finstall-the-chart","2.install\u002F1.install-the-chart",{"title":36,"path":37,"stem":38},"Activation","\u002Finstall\u002Factivation","2.install\u002F2.activation",{"title":40,"path":41,"stem":42},"DNS and TLS","\u002Finstall\u002Fdns-and-tls","2.install\u002F3.dns-and-tls",{"title":44,"path":45,"stem":46},"Verify your install","\u002Finstall\u002Fverify-your-install","2.install\u002F4.verify-your-install",{"title":48,"path":49,"stem":50,"children":51,"page":25},"Configure","\u002Fconfigure","3.configure",[52,56,60,64],{"title":53,"path":54,"stem":55},"Data services","\u002Fconfigure\u002Fdata-services","3.configure\u002F1.data-services",{"title":57,"path":58,"stem":59},"Secrets","\u002Fconfigure\u002Fsecrets","3.configure\u002F2.secrets",{"title":61,"path":62,"stem":63},"Registry and air-gapped installs","\u002Fconfigure\u002Fregistry-and-airgap","3.configure\u002F3.registry-and-airgap",{"title":65,"path":66,"stem":67},"Integrations","\u002Fconfigure\u002Fintegrations","3.configure\u002F4.integrations",{"title":69,"path":70,"stem":71,"children":72,"page":25},"Licensing","\u002Flicensing","4.licensing",[73,77,81,85],{"title":74,"path":75,"stem":76},"How licensing works","\u002Flicensing\u002Fhow-licensing-works","4.licensing\u002F1.how-licensing-works",{"title":78,"path":79,"stem":80},"Your key never leaves","\u002Flicensing\u002Fyour-key-never-leaves","4.licensing\u002F2.your-key-never-leaves",{"title":82,"path":83,"stem":84},"What phones home","\u002Flicensing\u002Fwhat-phones-home","4.licensing\u002F3.what-phones-home",{"title":86,"path":87,"stem":88},"Revoke and recover","\u002Flicensing\u002Frevoke-and-recover","4.licensing\u002F4.revoke-and-recover",{"title":90,"path":91,"stem":92,"children":93,"page":25},"Operate","\u002Foperate","5.operate",[94,98,102,106],{"title":95,"path":96,"stem":97},"Upgrade","\u002Foperate\u002Fupgrade","5.operate\u002F1.upgrade",{"title":99,"path":100,"stem":101},"Backup and restore","\u002Foperate\u002Fbackup-and-restore","5.operate\u002F2.backup-and-restore",{"title":103,"path":104,"stem":105},"Observability","\u002Foperate\u002Fobservability","5.operate\u002F3.observability",{"title":107,"path":108,"stem":109},"High availability","\u002Foperate\u002Fhigh-availability","5.operate\u002F4.high-availability",{"title":111,"path":112,"stem":113,"children":114,"page":25},"Troubleshooting","\u002Ftroubleshooting","6.troubleshooting",[115,119],{"title":116,"path":117,"stem":118},"Install failures","\u002Ftroubleshooting\u002Finstall-failures","6.troubleshooting\u002F1.install-failures",{"title":120,"path":121,"stem":122},"Licensing failures","\u002Ftroubleshooting\u002Flicensing-failures","6.troubleshooting\u002F2.licensing-failures",{"title":124,"path":125,"stem":126,"children":127,"page":25},"Reference","\u002Freference","9.reference",[128,132],{"title":129,"path":130,"stem":131},"Helm values","\u002Freference\u002Fhelm-values","9.reference\u002F1.helm-values",{"title":133,"path":134,"stem":135},"Environment variables","\u002Freference\u002Fenvironment","9.reference\u002F2.environment",{"id":137,"title":86,"body":138,"description":538,"extension":539,"links":540,"meta":541,"navigation":542,"path":87,"seo":543,"stem":88,"__hash__":544},"docs\u002F4.licensing\u002F4.revoke-and-recover.md",{"type":139,"value":140,"toc":532},"minimark",[141,145,149,154,157,161,177,180,211,222,229,236,240,243,308,311,326,329,332,419,426,433,437,440,447,468,478,522,528],[142,143,86],"h1",{"id":144},"revoke-and-recover",[146,147,148],"p",{},"A license can be pulled. If you are an MVNE, you can pull one on an MVNO you provisioned. If you are an MVNO under the Hub, this is what would happen to you, and what would undo it.",[150,151,153],"h2",{"id":152},"what-revocation-is","What revocation is",[146,155,156],{},"Revocation is a change to a row on the parent's side, and nothing else. The parent marks the deployment revoked and revokes the license id it stamped. That is the entire action. It does not touch your cluster, because it cannot: there is no connection into it.",[150,158,160],{"id":159},"what-the-deployment-does-about-it","What the deployment does about it",[146,162,163,164,168,169,172,173,176],{},"It finds out on its own next check-in. Either the heartbeat comes back with ",[165,166,167],"code",{},"lease_status: \"revoked\"",", or the next renewal gets a ",[165,170,171],{},"410 Gone",". Worst case that takes one ",[165,174,175],{},"PHONEHOME_INTERVAL"," (15 minutes by default).",[146,178,179],{},"Then it parks:",[181,182,183,199,205,208],"ul",{},[184,185,186,187,190,191,194,195,198],"li",{},"The serving license is cleared from memory, and every gated business route answers ",[165,188,189],{},"424 Failed Dependency"," with ",[165,192,193],{},"parent lease revoked",". Requests that fail authentication still get their ",[165,196,197],{},"401"," first, because the license gate sits behind auth.",[184,200,201,204],{},[165,202,203],{},"\u002Fhealth"," stays up. The process does not exit, does not crash, and does not restart-loop. Kubernetes sees a healthy pod, and it is: it is quiesced, not broken.",[184,206,207],{},"Your data is untouched. The database is yours and it is still there, intact, with every row in it. Revocation stops the deployment serving. It deletes nothing.",[184,209,210],{},"The heartbeat keeps running. A parked deployment keeps checking in, which is deliberate: the parent needs to see it parked rather than watch it go dark.",[146,212,213,217,218,221],{},[214,215,216],"strong",{},"Restarting does not escape it."," The park is in-memory, so a pod restart clears the flag, but the deployment comes straight back up holding a license the parent still considers revoked. It checks in, it is told ",[165,219,220],{},"revoked"," again, and it re-parks within seconds. The enforcement boundary is the parent, not any flag inside your cluster. There is nothing local to delete, reset, or edit that changes the answer.",[146,223,224,225,228],{},"The license agent behaves the same way. It writes ",[165,226,227],{},"LEASE_STATUS=revoked"," into the platform Secret, stops renewing, and starts polling that Secret every 30 seconds for one thing: a fresh activation code.",[146,230,231,232,235],{},"Deprovisioning is a separate, deliberate act. Revoking does not delete anything in your cluster. A full teardown is a revoke on the parent's side plus you running ",[165,233,234],{},"helm uninstall",".",[150,237,239],{"id":238},"recovering","Recovering",[146,241,242],{},"Get a fresh activation code from the parent, then upgrade with it.",[244,245,250],"pre",{"className":246,"code":247,"language":248,"meta":249,"style":249},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","helm upgrade my-mvno solvegio\u002Fplatform \\\n  -f my-values.yaml \\\n  --set activation.code=\u003Cnew-code>\n","bash","",[165,251,252,275,286],{"__ignoreMap":249},[253,254,257,261,265,268,271],"span",{"class":255,"line":256},"line",1,[253,258,260],{"class":259},"sBMFI","helm",[253,262,264],{"class":263},"sfazB"," upgrade",[253,266,267],{"class":263}," my-mvno",[253,269,270],{"class":263}," solvegio\u002Fplatform",[253,272,274],{"class":273},"sTEyZ"," \\\n",[253,276,278,281,284],{"class":255,"line":277},2,[253,279,280],{"class":263},"  -f",[253,282,283],{"class":263}," my-values.yaml",[253,285,274],{"class":273},[253,287,289,292,295,299,302,305],{"class":255,"line":288},3,[253,290,291],{"class":263},"  --set",[253,293,294],{"class":263}," activation.code=",[253,296,298],{"class":297},"sMK4o","\u003C",[253,300,301],{"class":263},"new-cod",[253,303,304],{"class":273},"e",[253,306,307],{"class":297},">\n",[146,309,310],{},"That is the whole runbook. There is no flag to set, no Job to delete, and no pod to restart.",[146,312,313,314,317,318,321,322,325],{},"Here is why it works. The ",[165,315,316],{},"helm upgrade"," changes the contents of the platform Secret, which is the object the license agent is already polling. The agent notices a code it has not consumed before, re-enrolls over the stale revoked license, clears ",[165,319,320],{},"LEASE_STATUS",", and writes the fresh license back into the Secret. The API is watching ",[165,323,324],{},"\u002Fetc\u002Fplatform\u002Flease",", so it picks the new license up in place and starts serving again. No rollout. Typically seconds.",[146,327,328],{},"Your signing key survives all of this. Recovery re-mints the license, and the deployment keeps its identity.",[146,330,331],{},"Confirm it landed:",[244,333,335],{"className":246,"code":334,"language":248,"meta":249,"style":249},"kubectl -n my-mvno logs deploy\u002Fmy-mvno-platform-license-agent --since=2m\nkubectl -n my-mvno get secret my-mvno-platform-env \\\n  -o jsonpath='{.data.PARENT_LEASE_TOKEN}' | base64 -d | head -c 20; echo\n",[165,336,337,356,375],{"__ignoreMap":249},[253,338,339,342,345,347,350,353],{"class":255,"line":256},[253,340,341],{"class":259},"kubectl",[253,343,344],{"class":263}," -n",[253,346,267],{"class":263},[253,348,349],{"class":263}," logs",[253,351,352],{"class":263}," deploy\u002Fmy-mvno-platform-license-agent",[253,354,355],{"class":263}," --since=2m\n",[253,357,358,360,362,364,367,370,373],{"class":255,"line":277},[253,359,341],{"class":259},[253,361,344],{"class":263},[253,363,267],{"class":263},[253,365,366],{"class":263}," get",[253,368,369],{"class":263}," secret",[253,371,372],{"class":263}," my-mvno-platform-env",[253,374,274],{"class":273},[253,376,377,380,383,386,389,391,394,397,400,402,405,408,412,415],{"class":255,"line":288},[253,378,379],{"class":263},"  -o",[253,381,382],{"class":263}," jsonpath=",[253,384,385],{"class":297},"'",[253,387,388],{"class":263},"{.data.PARENT_LEASE_TOKEN}",[253,390,385],{"class":297},[253,392,393],{"class":297}," |",[253,395,396],{"class":259}," base64",[253,398,399],{"class":263}," -d",[253,401,393],{"class":297},[253,403,404],{"class":259}," head",[253,406,407],{"class":263}," -c",[253,409,411],{"class":410},"sbssI"," 20",[253,413,414],{"class":297},";",[253,416,418],{"class":417},"s2Zo4"," echo\n",[146,420,421,422,425],{},"The agent's log shows the re-enrollment. A non-empty token confirms the Secret was patched. Then hit a gated route and check the ",[165,423,424],{},"424"," is gone.",[146,427,428,429,432],{},"Leaving the now-consumed code sitting in ",[165,430,431],{},"activation.code"," for your next ordinary upgrade is harmless. The agent has recorded it as consumed and will not replay it.",[150,434,436],{"id":435},"if-recovery-does-not-take","If recovery does not take",[146,438,439],{},"Two things to check before you reach for anything else.",[146,441,442,443,446],{},"The agent has to be running. It is a single-replica Deployment with a ",[165,444,445],{},"Recreate"," strategy, and that is a requirement, not a default worth tuning. Do not scale it up.",[244,448,450],{"className":246,"code":449,"language":248,"meta":249,"style":249},"kubectl -n my-mvno get deploy my-mvno-platform-license-agent\n",[165,451,452],{"__ignoreMap":249},[253,453,454,456,458,460,462,465],{"class":255,"line":256},[253,455,341],{"class":259},[253,457,344],{"class":263},[253,459,267],{"class":263},[253,461,366],{"class":263},[253,463,464],{"class":263}," deploy",[253,466,467],{"class":263}," my-mvno-platform-license-agent\n",[146,469,470,471,473,474,477],{},"And the code has to have actually reached the Secret. A ",[165,472,316],{}," that did not include ",[165,475,476],{},"--set activation.code=\u003Cnew-code>"," renders the same Secret contents as before, and the agent correctly does nothing with a code it has already consumed.",[244,479,481],{"className":246,"code":480,"language":248,"meta":249,"style":249},"kubectl -n my-mvno get secret my-mvno-platform-env \\\n  -o jsonpath='{.data.ACTIVATION_CODE}' | base64 -d; echo\n",[165,482,483,499],{"__ignoreMap":249},[253,484,485,487,489,491,493,495,497],{"class":255,"line":256},[253,486,341],{"class":259},[253,488,344],{"class":263},[253,490,267],{"class":263},[253,492,366],{"class":263},[253,494,369],{"class":263},[253,496,372],{"class":263},[253,498,274],{"class":273},[253,500,501,503,505,507,510,512,514,516,518,520],{"class":255,"line":277},[253,502,379],{"class":263},[253,504,382],{"class":263},[253,506,385],{"class":297},[253,508,509],{"class":263},"{.data.ACTIVATION_CODE}",[253,511,385],{"class":297},[253,513,393],{"class":297},[253,515,396],{"class":259},[253,517,399],{"class":263},[253,519,414],{"class":297},[253,521,418],{"class":417},[146,523,524,525,235],{},"Anything beyond that belongs in ",[526,527,120],"a",{"href":121},[529,530,531],"style",{},"html pre.shiki code .sBMFI, html code.shiki .sBMFI{--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B}html pre.shiki code .sfazB, html code.shiki .sfazB{--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D}html pre.shiki code .sTEyZ, html code.shiki .sTEyZ{--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8}html pre.shiki code .sMK4o, html code.shiki .sMK4o{--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .sbssI, html code.shiki .sbssI{--shiki-light:#F76D47;--shiki-default:#F78C6C;--shiki-dark:#F78C6C}html pre.shiki code .s2Zo4, html code.shiki .s2Zo4{--shiki-light:#6182B8;--shiki-default:#82AAFF;--shiki-dark:#82AAFF}",{"title":249,"searchDepth":256,"depth":277,"links":533},[534,535,536,537],{"id":152,"depth":277,"text":153},{"id":159,"depth":277,"text":160},{"id":238,"depth":277,"text":239},{"id":435,"depth":277,"text":436},"What happens to a deployment whose license is revoked, and the single command that brings it back.","md",null,{},true,{"title":86,"description":538},"lJnLR5Cqqvg1RaRsIWxyVp5THeDoC_KEcl_w4Gv2LjU",[546,548],{"title":82,"path":83,"stem":84,"description":547,"children":-1},"Every field your deployment sends to the Hub, why it sends it, and what it never sends.",{"title":95,"path":96,"stem":97,"description":549,"children":-1},"Bump the chart version, run helm upgrade, and check that the platform came back licensed and serving.",1783967741116]