Managing a License

A license is a signed JWT verified offline against a public key compiled into the operator. You apply it as a Secret referenced by the cluster-scoped License resource. This page covers applying, inspecting, renewing, and (for development) minting tokens.

Get a license

Licenses are claimed from the Navique customer portal at portal.navique.dev. There you can:

• start a trial — a time-limited license to evaluate the licensed features;
• purchase a license for the edition and add-ons you need;
• download your license token (license.lic) — including renewed ones — at any time.

The token is a file you apply to the cluster yourself (below): the operator never contacts the portal, so air-gapped clusters work the same way.

Apply a license

1. Download your signed token (a license.lic file) from the customer portal.

2. Create the Secret in the operator's system namespace:

   kubectl -n navique-system create secret generic navique-license \
     --from-file=license=./license.lic

3. Create the License resource (it is a singleton and must be named cluster):

   apiVersion: core.navique.com/v1alpha1
   kind: License
   metadata:
     name: cluster
   spec:
     secretRef:
       name: navique-license
       key: license
       namespace: navique-system

The License controller verifies the token, writes the entitlements to status, and publishes them to every workload controller. Feature gating and instance caps take effect on the next reconcile.

Prefer a browser? Activate from the console

The management plane console can activate a license for you: paste or upload the token, preview the decoded entitlements, and confirm — it creates the License resource and its Secret. This is the console's only write action.

Inspect the active license

# Full status: validity, licensee, tier, expiry, features, limits.
kubectl get license cluster -o jsonpath='{.status}' | jq

# Just the features and limits in effect.
kubectl get license cluster -o jsonpath='{.status.enabledFeatures}'; echo
kubectl get license cluster -o jsonpath='{.status.limits}'; echo

If status.valid is false, status.reason explains why (bad signature, expired, missing Secret, alg: none, …). The operator falls back to Community defaults in that case — the base platform stays up.

Renew

Renewal is simply re-issuing the signed token with a new expiry: download the renewed token from the customer portal, replace the Secret contents, and the controller picks it up:

kubectl -n navique-system create secret generic navique-license \
  --from-file=license=./renewed-license.lic \
  --dry-run=client -o yaml | kubectl apply -f -

The controller requeues near expiry, so gating flips on time; re-applying a valid token restores any downgraded entitlements immediately. See Expiry → graceful downgrade.

Environments

The license carries an environment claim (prod / nonprod), which lets Navique issue cheaper or free non-production / NFR licenses for staging and internal clusters distinct from production licenses.

Support hours

The license states an includedSupportHours figure for reference. Because the operator is air-gapped and cannot phone home, this balance is tracked off-cluster by Navique — the value in the license is informational only.

How tokens are issued

Licenses are signed and issued by Navique with an offline signing tool, then delivered to you as a .lic token. The matching public key is compiled into the operator (and the management console), so verification is fully offline — the signing private key never leaves Navique and is never part of your deployment. To obtain, change, or renew a license, use the customer portal; see Editions & Licensing for the tiers and add-ons.

Revocation

A license can be revoked before its expiry — for example if its token leaks or was issued in error. The operator carries a revocation list compiled into the binary, so revocation is enforced fully offline, with no online check. A revoked license is rejected even though its signature is valid, and the operator falls back to Community defaults — the same graceful downgrade as expiry, so the base platform keeps running.

# Is the active license revoked, and why?
kubectl get license cluster -o jsonpath='{.status.revoked}'; echo
kubectl get license cluster -o jsonpath='{.status.revokedReason}'; echo

When revoked, status.revoked is true, status.revokedReason holds the category (compromised / superseded / non-compliance / issued-in-error / unspecified), and the Ready condition reports LicenseRevoked. Because the list is part of the operator binary, keeping the operator up to date is how you pick up revocations (and the security fixes shipped alongside them). If a license of yours is shown revoked unexpectedly, contact Navique.

Troubleshooting

If features don't unlock after applying a license, check:

• kubectl get license cluster -o jsonpath='{.status.reason}' — the verification failure reason.
• kubectl get license cluster -o jsonpath='{.status.revoked}' — whether the token was revoked (see Revocation).
• That the Secret name/key/namespace in spec.secretRef match the created Secret.
• That the resource is named exactly cluster (other names are rejected).
• The operator logs: kubectl -n navique-system logs deploy/navique-ai-core-operator.

See also Troubleshooting.