News Automating License Validity Checks with KrakenD

Enterprise Documentation

Recent changes

You are viewing a previous version of KrakenD Enterprise Edition (v2.5) , go to the latest version

Managing the LICENSE file

Document updated on Nov 18, 2023

To run the Enterprise software, you must provide a valid license. The license file comes in an email containing the download link. The file is named LICENSE (no extension), and you need to copy it or mount it where KrakenD expects.

When the license file is expired, incorrect, or missing, KrakenD won’t start.

You can run krakend license to see if the installed LICENSE file is valid.

License file requirements

To start KrakenD Enterprise without seeing an error, make sure that:

  • The file /etc/krakend/LICENSE exists (if you are in a different working directory, the license must be there)
  • The LICENSE file is a plain text file with no extension
  • It contains the certificate we gave you (it looks like a PEM file)
  • You have not edited the file, and includes the surrounding -----BEGIN CERTIFICATE----- and -----END CERTIFICATE-----.

Checking the license

The command krakend license and several of its subcommands help you validate the installed LICENSE file. Use krakend license --help for all the list of available subcommands and help.

The krakend license command exits either with a:

  • non-zero status code and an KO: message string when the license is not valid or
  • zero status code and a OK: string when the file is valid in the requested time.

All license files start and end on the agreed dates at 00:00 UTC.

For example, to check the expiration date of your license you can do:

License is valid until... 
$krakend license valid-until
OK: License is valid until 2024-02-01 00:00:00 +0000 UTC

Or to find out the relative time_

License is valid for... 
$krakend license valid-for
OK: License is valid for the next 71 days, 6 hours, and 1 minutes

The following additional commands help you check the license.

Is the LICENSE valid right now?

Execute the following command to know if your license is valid right now (although it could be invalid in the next second):

Is the license valid? 
$krakend license
OK: License is still valid

When the license is invalid, you’ll see the reason:

Example of invalid license 
$krakend license
KO: x509: certificate has expired or is not yet valid: current time 2023-11-16T15:24:48+01:00 is after 2023-08-31T00:00:00Z

KrakenD Licensee

For a valid license, you can retrieve who is the licensee:

Licensee information 
$krakend license licensee

For an invalid license, you won’t have any information.

Days left

Similarly, you can get the remaining days of a license as follows:

License days left 
$krakend license days-left
OK: License has 71 days remaining

Automated license expiration checking

Because the command uses exit codes, you can include the license command in your automation and abort a pipeline when the license is expired or about to expire.

The command can check a license now or at a time in the future. Use the subcommand valid-for to determine if the license will remain valid after many hours or days. Use a numeric followed by h or d and no spaces. For instance:

License invalid in 3 months 
$krakend license valid-for 90d
KO: License will be invalid in 71 days, 5 hours, and 49 minutes

Checking a relative date is probably the most convenient way to set this up quickly in a pipeline, but you can also check an absolute date using valid-until. For instance:

Will the license be valid on a specific date? 
$krakend license valid-until 2024-11-10
KO: License will be invalid before 2024-11-10

Notice that the date format is yyyy-mm-dd.

The LICENSE file is a certificate

Because our LICENSE file is a regular certificate, you can use openssl to play with it.

For instance, you can execute openssl x509 -in LICENSE -text -noout to get all the information.

Change the location of the LICENSE

The LICENSE file must be in /etc/krakend/LICENSE by default, but KrakenD internally looks for ./LICENSE. It means that the file is inside the working directory. If you want to store the license in a different location, you can change the WORKDIR in which KrakenD executes. For instance, let’s load the license from /vault/LICENSE instead.

We can have a custom Dockerfile like this one:

FROM krakend/krakend-ee:2.5

WORKDIR /vault

When you change the working directory, all relative paths move to the new base directory. When you start KrakenD, the configuration file path needs to consider this.

Storing the LICENSE in the Docker image

See Generating a Docker artifact

Storing the LICENSE in Secret managers

You can store your LICENSE in any secret manager of your choice if you want to. However, ensure the line breaks are respected when retrieving them again.

AWS Secrets Manager

One of the particularities of AWS Secrets Manager is that it might have problems when storing multiline contents. Therefore, we recommend keeping the LICENSE content in base64 format when working with AWS in plain text.

You can create an AWS secret with your license with this command:

$aws secretsmanager create-secret --name krakend-valid_trough-2023_05_22 --secret-string "$(base64 LICENSE)"
    "Name": "krakend-valid_trough-2026_05_22",
    "ARN": "arn:aws:secretsmanager:eu-west-1:052351007912:secret:krakend-valid_trough-2026_05_22-OISgD6",
    "VersionId": "59f7c317-989a-4219-bdd2-b79bead69dd4"

Notice that we have added the license’s expiration date to the secret name. A practice like this will help you quickly realize the expiration date of any license without testing.

You can later retrieve the license file in your pipeline file with:

$aws secretsmanager get-secret-value --secret-id krakend-valid_trough-2026_05_22 --query 'SecretString' --output text | base64 -d > LICENSE

Note: Depending on your computer’s operative system, the decoding of base64 might be base64 -D instead of base64 -d

What happens when the license expires?

Any running processes will shut down when the KrakenD Enterprise license expires.

The KrakenD sales team is always in touch before this happens to work on the next renewal.

Suppose you no longer want to be an Enterprise customer. In that case, you can downgrade to KrakenD Community very quickly and run in the open-source mode without the Enterprise functionalities.

Updating your license

When your license renewal comes, you must replace the /etc/krakend/LICENSE with the new content in your servers running KrakenD and restart KrakenD. That’s all!


Unresolved issues?

The documentation is only a piece of the help you can get! Whether you are looking for Open Source or Enterprise support, see more support channels that can help you.