Set a child cluster license

Warning

You must have a valid license to lawfully run MKE 4. For more information, refer to Mirantis Agreements and Terms.

You configure child clusters through an MkeChildConfig resource. To license a child cluster, the recommended approach is to reference a Kubernetes Secret from spec.license.secretRef, as this assures that the license token is kept out of the MkeChildConfig spec. You can continue to set the token inline with spec.license.token, however this functionality is deprecated for child clusters.

The following prerequsites must be met to set the license for a child cluster:

• A valid MKE 4 license.
• Access to a management cluster on which the MkeChildConfig is applied.

• Referenced Secret requirements:

  Requirement	Detail
  Namespace	Same namespace as the MkeChildConfig
  Type	mke.mirantis.com/license
  optional	Not supported. The license Secret must exist; secretRef.optional: true is rejected.

To set the child cluster license:

1. Create a Secret in the same namespace as the MkeChildConfig. The Secret type must be mke.mirantis.com/license:

   apiVersion: v1
   kind: Secret
   metadata:
     name: mke-license
     namespace: <namespace>
   type: mke.mirantis.com/license
   data:
     token: <base64-encoded-license-token>
   

2. Reference the Secret from the MkeChildConfig through the spec.license.secretRef parameter:

   apiVersion: mke.mirantis.com/v1alpha1
   kind: MkeChildConfig
   metadata:
     name: <child-cluster>
     namespace: <namespace>
   spec:
     license:
       secretRef:
         name: mke-license
         key: token
   

3. Apply both resources:

   kubectl apply -f mke-license-secret.yaml
   kubectl apply -f mkechildconfig.yaml
   

4. Verify the license status once the MkeChildConfig has reconciled:

   kubectl -n k0rdent get mkechildconfig <child-cluster> -ojsonpath="{.status.licenseStatus}" | jq
   

The following messages are reported against spec.license.secretRef, unless noted otherwise.

Message	Cause
optional is not supported for the license secret reference	secretRef.optional is set to true; reported against spec.license.secretRef.optional.
specified secret <namespace>/<name> doesn't exist	No Secret by that name exists in the MkeChildConfig's namespace.
secret type must be mke.mirantis.com/license	The Secret is of another type, for example Opaque.
license secret key missing or empty: <namespace>/<name>[<key>]	The key named by secretRef.key is absent or empty in the Secret.

Notes

• secretRef takes precedence over an inline spec.license.token. If both are set, the inline token is ignored.
• The inline spec.license.token is deprecated for child clusters, though it remains available for backward compatibility purposes.