License server

Collectord can pull its license from a remote URL, so you update the key in one place and every cluster picks it up on its next refresh. Use it once you run more than a handful of clusters, where rotating a key in every ConfigMap gets old fast.

A few things to know before you wire this up:

• It distributes, it doesn’t verify. A local license server only distributes the license to your clusters and nodes. It doesn’t replace the license verification that Outcold Solutions runs. If your license requires internet verification, the license clients still talk to the License Server hosted by Outcold Solutions for that step.
• The first start needs the URL. Collectord must reach the URL on first start. If it can’t load a license, it won’t start.
• Later restarts can use a cached copy. After that, Collectord caches the license internally. If the URL is unreachable on a later restart, it falls back to the cached copy.
• New licenses arrive on the next poll. Collectord polls the URL every 30 minutes for a new license. A new license takes effect immediately, with no restart.

Configure the remote license URL

Serve the license from your own HTTP server

Collectord doesn’t care how the license is served: anything that returns the file over HTTP works. The simplest approach is to drop the key into a file named license and start a quick HTTP server:

1python3 -m http.server 9199

Confirm the file is reachable:

1curl http://license-server.example.local:9199/license

Run Collectord as the license server

You can also run Collectord itself as the license server: a separate, optional Collectord instance started with the license-server subcommand, not part of the addon or the DaemonSet. Its advantage is that it tracks license usage for you and reports it on a schedule.

Run it like this, replacing ... with your license key. For the basicAuth line:

• To run without authentication, drop the line.
• To require it, set a credential pair in username:password form. The example below leaves the username blank and uses password as the password.

 1docker run -d \
 2  --name collectordlicenseserver \
 3  --cpus=0.5 \
 4  --cpu-shares=102 \
 5  --memory=64M \
 6  --restart=always \
 7  --publish 9199:9199 \
 8  --env "COLLECTOR__ACCEPTLICENSE=general__acceptLicense=true" \
 9  --env "COLLECTOR__HTTP_BINDING=general__httpServerBinding=0.0.0.0:9199" \
10  --env "COLLECTOR__LICENSE_KEY=general__license=..." \
11  --env "COLLECTOR__LICENSESERVER_BASICAUTH=license.server__basicAuth=:password" \
12  --entrypoint /collectord \
13  registry.outcold.solutions/outcoldsolutions/collectorfordocker:26.10.1 license-server

Verify with curl:

1curl -u :password http://license-server.example.local:9199/license

The license server prints usage reports to stdout every hour:

1INFO 2021/10/15 18:36:32.205219 outcoldsolutions.com/collectord/license_server.go:71: LicenseID: C5KBS5R69NH9G, Expiration: 1642116759, Limit: 200, Count: 54

Point collectorforopenshift at the remote URL

Instead of putting the license key directly in the ConfigMap, point the [license.client] section at your license URL. The example below also uses basic authentication (:password), matching the license server setup above:

 1[license.client]
 2# point to the license located on the HTTP web server, or a hosted by the Collectord running as license server
 3url = http://license-server.example.local:9199/license
 4# Basic authentication for the HTTP server
 5basicAuth = :password
 6# If SSL, ignore the certificate verification
 7insecure = false
 8# CA path for the server certificate
 9capath =
10# CA name for the server certificate
11caname =

Update the license fleet-wide

To roll out a new license to every Collectord that reads from the remote URL, replace it in one place: on the License Server. Restart the license server with the new key, and every cluster picks it up on its next 30-minute poll.