Skip to main content
Calico Enterprise 3.23 (latest) documentation

License metrics

Big picture​

Use the Prometheus monitoring and alerting tool to get Calico Enterprise license metrics.

Value​

Platform engineering teams need to report licensing usage on third-party software (like Calico Enterprise) for their CaaS/Kubernetes platforms. This is often driven by compliance, but also to mitigate risks from license expiration or usage that may impact operations. For teams to easily access these vital metrics, Calico Enterprise provides license metrics using the Prometheus monitoring and alerting tool.

Concepts​

About Prometheus​

The Prometheus monitoring tool scrapes metrics from instrumented jobs and displays time series data in a visualizer (such as Grafana). For Calico Enterprise, the “jobs” that Prometheus can harvest metrics from the License Agent component.

About License Agent​

The License Agent is a containerized application that monitors the following Calico Enterprise licensing information from the Kubernetes cluster, and exports the metrics through the Prometheus server:

  • Days till expiration

How to​

Add license agent in your Kubernetes cluster​

To add the license-agent component in a Kubernetes cluster for license metrics, install the pull secret and apply the license-agent manifest.

  1. Create a namespace for the license-agent. 
     kubectl create namespace tigera-license-agent
  2. Install your pull secret. 
     kubectl create secret generic tigera-pull-secret \
       --type=kubernetes.io/dockerconfigjson -n tigera-license-agent \
       --from-file=.dockerconfigjson=<path/to/pull/secret>
  3. Apply the manifest. 
     kubectl apply -f https://downloads.tigera.io/ee/v3.23.1/manifests/licenseagent.yaml

Upgrade the license agent​

The license agent is installed from a manifest and is not managed by the Calico Enterprise operator. Upgrading Calico Enterprise leaves the license agent running the image from the manifest you last applied, so you must upgrade the license agent yourself after every Calico Enterprise upgrade. Until you do, license metrics come from the old version of the agent.

  1. Apply the manifest for the version of Calico Enterprise you upgraded to. 
     kubectl apply -f https://downloads.tigera.io/ee/v3.23.1/manifests/licenseagent.yaml
  2. If you upgraded from a version earlier than Calico Enterprise v3.23, delete the license agent's network policy from the allow-tigera tier. From v3.23 the manifest creates this policy in the calico-system tier instead, and because the name of a policy includes the name of its tier, applying the new manifest adds a second policy rather than replacing the first: the same rule ends up in both tiers. 
     kubectl delete networkpolicies.projectcalico.org allow-tigera.tigera-license-agent-access -n tigera-license-agent
  3. Check whether any policy is left in the allow-tigera tier. 
     kubectl get networkpolicies.projectcalico.org,globalnetworkpolicies.projectcalico.org -A | grep allow-tigera
    The operator removes the deprecated allow-tigera tier once no policy is left in it. While any policy remains, the tier stays and the operator logs Cannot delete a non-empty tier on every reconcile. So deleting the license agent's policy is enough only if nothing else is left: if the command above still lists policies, expect the tier to remain until those are removed as well. Contact Support if you are unsure what created a policy that is still listed.

Create alerts using Prometheus metrics​

In the following example, an alert is configured when the license expiry is fewer than 15 days.

apiVersion: monitoring.coreos.com/v1
kind: PrometheusRule
metadata:
  name: calico-prometheus-license
  namespace: tigera-prometheus
  labels:
    role: tigera-prometheus-rules
    prometheus: calico-node-prometheus
spec:
  groups:
    - name: tigera-license.rules
      rules:
        - alert: CriticalLicenseExpiry
          expr: license_number_of_days < 15
          labels:
            severity: Warning
          annotations:
            summary: 'Calico Enterprise License expires in less than 15 days'
            description: 'Calico Enterprise License expires in less than 15 days'
note

If the Kubernetes api-server serves on any port other than 6443 or 443, add that port in the Egress policy of the license agent manifest.

Additional resources​