מה תרצה/י לחפש?
< All Topics
Print

License Manager Changes

Posted
Updated
ByArtur
License Manager Changes

Table of Contents

License Manager Changes

ℹ️
Overview: The License Manager has been redesigned to support both the existing On-Premise deployment model and the new Private Kubernetes deployment model.

The new implementation keeps backward compatibility for standard On-Premise installations, while adding support for Kubernetes environments where a stable machine MAC address is not available for licensing.

2. Main Changes

2.1 LicenseManagerRunner Removed

LicenseManagerRunner.exe has been removed.

LicenseManager.exe can now be started directly without using the runner.

This is possible because the License Manager now runs only on the customer's computer and no longer connects directly to the database. Therefore, there is no longer a need for the runner to additionally protect Encryption:Key.

✅
Result: The License Manager startup flow is now simpler. Run LicenseManager.exe directly.

2.2 Two Operating Modes

The License Manager now supports two operating modes:

  • On-Premise
  • Private Kubernetes

The required mode is selected in the License Manager UI using the Private K8s checkbox.

Private K8s Checkbox Selected Mode
Unchecked On-Premise mode
Checked Private Kubernetes mode

3. On-Premise Mode

In On-Premise mode, the behavior remains unchanged from previous versions.

The generated License.lic file contains all required license information, including:

  • License parameters
  • MAC address of the target machine
✅
Backward Compatibility: On-Premise mode should be fully backward compatible with the previous License Manager implementation.

4. Private Kubernetes Mode

Private Kubernetes deployments work differently because Kubernetes does not provide a stable machine MAC address that can be reliably used for licensing.

💡
Important: In Private Kubernetes mode, the generated license does not use a MAC address. Instead, it includes a signed Token property.

4.1 Prerequisites

Before generating a license for a Private Kubernetes environment, the following prerequisites must be completed on the computer running the License Manager:

  1. Install the ConsistNagixSigningCert certificate.
  2. Configure Encryption:Key in appsettings.json.

The Encryption:Key value should be stored as plain text. 

{
  "Encryption": {
    "Key": "PLAIN_TEXT_ENCRYPTION_KEY_VALUE"
  }
}
💡
Note: No additional encryption is required for Encryption:Key because the License Manager runs only on the customer's computer.

4.2 Security Note

⚠️
Security Warning: The ConsistNagixSigningCert certificate and the Encryption:Key value are sensitive secrets. They must not be stored in public repositories, shared folders, unsecured documentation, or any other public/shared location.

For the current implementation, both the certificate and the encryption key can be obtained from Nik.

4.3 Generated License

In Private Kubernetes mode, the generated License.lic file contains:

  • All standard license information
  • No MAC address
  • An additional Token property

The Token is a digitally signed string.

4.4 Token Content

The Token contains:

  • Encryption key as a string
  • License expiration date as a datetime value

The Token is digitally signed using the ConsistNagixSigningCert certificate. This prevents manual modification of the token content.

ℹ️
Validation: If the token is changed manually, the digital signature validation should fail.

5. License Content Comparison

Item On-Premise Mode Private Kubernetes Mode
License parameters Included Included
MAC address Included Not included
Token Not required Included
Encryption key Handled by existing On-Premise flow Stored inside the signed token
Expiration date Stored in the standard license information Stored in the signed token
Backward compatibility Expected to remain compatible New deployment-specific behavior

6. Runtime Behavior

When a Private Kubernetes license is applied, NAGIX performs the following actions:

  1. Validates the Token signature.
  2. Stores the Token in the database.
  3. Uses the Token later to obtain the encryption key.
  4. Uses the Token later to verify the license expiration date.
✅
Expected Behavior: NAGIX should only accept a Private Kubernetes license if the token signature is valid.

7. Summary

Area Change
Runner LicenseManagerRunner.exe was removed.
Startup LicenseManager.exe can be started directly.
Modes The License Manager supports On-Premise and Private Kubernetes modes.
On-Premise Existing behavior remains unchanged.
Private Kubernetes The license does not contain a MAC address and includes a signed token instead.
Security The signing certificate and encryption key must be protected as sensitive secrets.
תוכן עיניינים