Licensing

Kubernetes Search runs out of the box with no license key on a free tier for one person. A paid license is priced per user: it covers your team and unlocks the multi-user and multi-cluster features.

Free tier

With no license key configured, the app provides:

• One user.
• One registered cluster.
• A single, standalone search head.
• Shared cluster credentials, or tokens minted for a read-only service account (see Clusters - Minted tokens).

The first person to run a search becomes the free tier’s user; an administrator can set or change the user on the License tab. The free tier never expires. It is enough to evaluate the app and to run it for one person, one cluster and one search head.

Paid

A paid license unlocks:

• Every user holding run_k8s_search, up to the number of users in your license.
• Any number of clusters.
• Search head clustering - running the app across SHC members.
• Per-user credentials and impersonation (see Access control).

Licensed users

A license covers a number of users: the Splunk users holding the run_k8s_search capability, directly or through a role that imports a role holding it - the app’s k8s_search_user and k8s_search_admin roles both do. The app counts the users Splunk lists under Settings - Users, LDAP and SAML users it knows included. Splunk administrators - users holding admin_all_objects, such as admin, or sc_admin on Splunk Cloud - can run every search without the capability and are not counted, and neither is splunk-system-user, which runs scheduled searches owned by nobody.

Licenses are sold per user per year; see Pricing.

The health check counts the users every 5 minutes on each search head, and the License tab shows the users your license covers beside the users holding run_k8s_search. Going over is never an outage: searches keep running for everyone - an on-call team is not locked out because someone was added to a role - while the License tab and a bulletin message name both numbers until you extend the license or take the capability from users who no longer need it.

What happens at the limits

Enforcement is designed to be predictable and to preserve your configuration:

• More users than your license covers is a warning, never a refusal - see Licensed users.
• A second user on the free tier is refused when they run a search, with a message naming the free tier’s user. The License tab shows who it is.
• Registering a second cluster on the free tier is refused with a clear message. Clusters you already registered keep working. A paid license has no cluster limit.
• Running in a search head cluster requires a paid license.
• An expired paid license keeps searches running through a 14-day grace period, with a warning. After grace, searches stop until you renew - or clear the key to return to the free tier. Your registrations and credentials remain stored and reactivate when you restore a valid license.
• An invalid or mistyped key counts as no key: the app runs as the free tier until you replace it.
• The bell says so. Roles holding edit_k8s_search_clusters or admin_all_objects see a Splunk bulletin message while the key is invalid, expires within 30 days, is in its grace period, or has run past it, another while the free tier runs in a search head cluster or more clusters are registered than it allows, and a warning while more users hold run_k8s_search than the license covers. Each links to the Setup tab that fixes it and clears once the problem ends; see Troubleshooting.

Enter a license key

Open the Setup page on its License tab (/app/os_k8s_search/setup#license). Press Add license (Replace license once a key is stored), paste your key, and save. Line breaks and spaces an email client wrapped into the key are dropped on save. The page shows the current status: whether the key is valid, the license id, the users it covers beside the users holding run_k8s_search and when they were counted, the installations it allows, and the expiration date. On the free tier it shows the free tier’s user, with Set free-tier user or Change free-tier user to pick another. A key you enter or remove applies from the very next search; a key that expires is noticed within 30 seconds.

To clear a license and return to the free tier, press Remove license.

Evaluate

To try the paid features, contact sales@outcoldsolutions.com to request a 30-day evaluation license. The key arrives by email; paste it into the License tab as above.