Licensing

KubeSentry uses fully offline licensing. Your license is a signed token that the collector verifies in-cluster using a built-in public key. There's no phone-home, no license server your cluster talks to, and no telemetry — activation works in air-gapped environments.

Trial

Every fresh install starts in a 7-day trial with full functionality. You'll see a yellow banner in the dashboard for the duration. The trial state is tracked inside the cluster on the collector's data volume, so restarts don't reset or extend it.

When the trial ends, activate a license to keep the banner off.

Plans

Plan	Price (one-time)	Licensed for	Best for
Solo	€99	1 cluster	Individuals / very small clusters
Team	€299	5 clusters	Small teams
Pro	€499	Unlimited	Larger deployments

All plans are one-time. Your license is perpetual and includes all future updates — no subscription, no renewals.

Cluster counts are licence terms, not technical limits

The collector does not enforce the cluster count. It's carried in the license as a clusters claim and printed in the startup log, but nothing checks it — a Solo license works in as many clusters as you paste it into.

This is deliberate. Enforcing a count means every install has to report back to a server we control, which is precisely the phone-home and telemetry KubeSentry promises never to do. We'd rather keep that promise and trust you to buy the tier that matches your usage. The collector is open to read if you want to confirm it.

Purchase from the KubeSentry site. Checkout is handled through Lemon Squeezy; your license is emailed to you automatically right after purchase.

Activate your license

Your license arrives by email as a token string. It goes in the top-level license value. Which command you run depends on whether KubeSentry is already in the cluster.

In both paths, read -rs takes the token without echoing it or leaving it in your shell history, and --set-string stops Helm from trying to interpret the token as anything other than a string.

First-time install

New to KubeSentry? This adds the chart repo and installs it with your license — no trial period, licensed from the first pod.

helm repo add kubesentry https://charts.kubesentry.io
helm repo update

read -rs KS_LICENSE

helm install kubesentry kubesentry/kubesentry \
  --namespace kubesentry --create-namespace \
  --set-string license="$KS_LICENSE" \
  --set cluster.name="prod-us-east"
unset KS_LICENSE

Replace prod-us-east with a name for this cluster — it's shown in the dashboard top bar, email subjects, and webhook payloads. Omitting it defaults to default. See Configuration for the rest of the values.

Upgrading an existing trial

Already ran the trial? This keeps your existing configuration and just activates your paid license:

read -rs KS_LICENSE
helm upgrade <release> kubesentry/kubesentry -n kubesentry --reuse-values \
  --set-string license="$KS_LICENSE"
unset KS_LICENSE

<release> is whatever you named the release — any name works. --reuse-values is what preserves the rest of your setup: notification channels, cluster.name, resource limits. Drop it and Helm resets every unspecified value to the chart default, which silently disables email and puts the trial banner back. For the same reason, don't re-pass --set cluster.name here — --reuse-values already carries the name you chose during the trial.

The chart stores the token in a Kubernetes Secret automatically and mounts it into the collector — it's never kept as a plain-text env value.

If you use --set-file, strip the trailing newline

--set-file license=./license.txt sends the file byte for byte, including the newline most editors add at the end. The collector doesn't trim whitespace, so that newline makes an otherwise valid token fail signature verification and silently drop you back to trial behaviour. Write the file without one:

printf '%s' "<your-license-token>" > license.txt
helm upgrade <release> kubesentry/kubesentry -n kubesentry --reuse-values \
  --set-file license=./license.txt

After the upgrade rolls, reload the dashboard — the trial banner disappears and your plan is shown. Any alerts collected during the trial are preserved.

How verification works

Licenses are signed with an Ed25519 key. The matching public key is compiled into the collector, so it can validate a license entirely offline — it checks the signature and the embedded plan without contacting anything. There is no date check: a validly-signed license never expires, on any version. Only the 7-day trial is time-bound. If a token is missing, malformed, or its signature doesn't verify, KubeSentry falls back to trial/expired-trial behavior rather than failing shut.

Lost your license?

Licenses are tied to your purchase email. Retrieve it from your Lemon Squeezy order confirmation, or contact support (see the KubeSentry site) with your order details.