Switching Stronghold to Stronghold EE

The stronghold module is switched from base Stronghold to Stronghold EE by specifying a license key in the spec.settings.license parameter of the stronghold ModuleConfig resource. You do not need to reinstall the module or migrate data: secrets, policies, secrets engines, and configured auth methods are preserved.

Before switching

Before switching, check the following:

1. Make sure the cluster uses a commercial DP edition:

   d8 k -n d8-system get configmap d8-deckhouse-version-info -o jsonpath='{.data.data\.json}'

   The json object must contain an edition other than CE. Example output:

   { "channel":"Stable", "version":"v1.76.0", "edition":"EE" }
   

   You can also see the DP edition and version in the Deckhouse web interface on the main page of the cluster management console (https://console.<CLUSTER_DOMAIN>).

   If you need to change the DP edition, follow the instructions for switching the DP edition.

2. Make sure the stronghold module is enabled and working:

   d8 k get module stronghold
   d8 k get moduleconfig stronghold -o yaml

   Check that:

   • Enabled and Ready are True for the stronghold module;
   • the stronghold ModuleConfig object exists.

3. Save the unseal keys and the root token to a secure storage:

   d8 k -n d8-stronghold get secret stronghold-keys -o yaml > stronghold-keys.yaml
   chmod 600 stronghold-keys.yaml

4. Create a storage snapshot. The example below applies only to the Ingress inlet (it reads the host from the stronghold Ingress) and the Automatic mode (OIDC login through Dex); for other inlets and modes, set STRONGHOLD_ADDR yourself and log in with another method:

   export STRONGHOLD_ADDR=https://$(d8 k -n d8-stronghold get ing stronghold -o json | jq -r '.spec.rules[0].host')
   d8 stronghold login -method=oidc -path=oidc_deckhouse
   # Or using the root token:
   ## d8 stronghold login -method=token
   d8 stronghold operator raft snapshot save stronghold-$(date +%F_%H-%M).snap

   You can check the snapshot with the following command:

   ls -lh ./stronghold-*.snap

   Store the resulting files outside the DP cluster.

Specifying the license key

To specify the license key, do the following:

1. Get a Stronghold EE license key from the product vendor. The license parameter must be a string of at least 32 characters; otherwise, the configuration is rejected with the Invalid license format error.

2. Add the key to the spec.settings.license parameter of the stronghold ModuleConfig resource:

   d8 k patch moduleconfig stronghold --type merge --patch '{"spec":{"version":1,"settings":{"license":"<STRONGHOLD_EE_LICENSE_KEY>"}}}'

   You can get the same result by editing the ModuleConfig with d8 k edit mc stronghold. Example of the resulting manifest:

   apiVersion: deckhouse.io/v1alpha1
   kind: ModuleConfig
   metadata:
     name: stronghold
   spec:
     enabled: true
     version: 1
     settings:
       license: <STRONGHOLD_EE_LICENSE_KEY>
       management:
         mode: Automatic
         administrators:
         - type: Group
           name: admins

   The license key is stored in ModuleConfig in plain text. If necessary, restrict access to the resource using the role model.

3. Wait for the Stronghold pods to be recreated:

   d8 k -n d8-stronghold get po -w

Verifying the switch

After switching, check the result:

1. Make sure the key has been saved in the module configuration:

   d8 k get moduleconfig stronghold -o jsonpath='{.spec.settings.license}'

2. Check the stronghold pods:

   d8 k -n d8-stronghold get po

   Check that:

   • there are no ImagePullBackOff, ErrImagePull, or CrashLoopBackOff states;
   • the stronghold-* pods are in the Running state with 2/2 readiness.

3. Check the edition in the startup banner lines:

   d8 k -n d8-stronghold logs stronghold-0 | head -20

   The output must contain a version with the ee suffix. For example:

   Version: Stronghold v1.19.0+ee
   

4. Make sure the storage is unsealed (as above, the example applies to the Ingress inlet):

   export STRONGHOLD_ADDR=https://$(d8 k -n d8-stronghold get ing stronghold -o json | jq -r '.spec.rules[0].host')
   d8 stronghold status

   In the output, Sealed must be false.

After the switch, Stronghold EE features become available: the audit log, namespaces, replication between clusters, automated snapshots, Managed Keys, and management of roles and access policies via the web interface. For the full list of differences, see Editions.

Reverting to base Stronghold

You can return the module to base Stronghold by removing the license key.

1. Disable the audit log first: set enableAuditLog: false in the stronghold ModuleConfig. Setting enableAuditLog: true without a license is rejected, so do this before removing the license.

2. Remove the spec.settings.license parameter entirely:

   d8 k patch moduleconfig stronghold --type json --patch '[{"op":"remove","path":"/spec/settings/license"}]'

3. Wait for the pods to be recreated and make sure the banner shows a version without the ee suffix:

   d8 k -n d8-stronghold logs stronghold-0 | head -20

Additional resources

• Editions
• Stronghold configuration
• Switching Stronghold from EE to CSE
• Creating a snapshot