Licensing

5.1 How licensing works

The license is an offline, ed25519-signed file. stepscale signs a small JSON payload; the operator verifies it in-cluster against a baked-in public key. There is no phone-home, so licensing works fully air-gapped.

The license payload contains: customer, plan (trial / team / enterprise), issued_at, expires_at, max_clusters (omitted = unlimited), and a list of features.

The operator resolves one of three states each tick:

State	Meaning	Effect
Licensed	Valid signature, not expired.	Approved recommendations are applied; proactive schedules run. (LLM-backed analysis runs in every state - it is not licensed.)
Grace	Expired, but within the grace window.	Still applies; logs/Events warn that the license has expired and how many grace days remain.
Unlicensed	No license, bad signature, no public key, or past grace.	Recommend-only: the operator keeps watching and produces the full analysis - rule engine plus the LLM when a provider key is configured - but does not apply it (approved recommendations are marked blocked).

LLM-backed analysis is not gated by the license: it runs in every state whenever an LLM provider key is configured (llm.provider = openai / anthropic), so an unlicensed (Community) install gets the same analysis quality as a paid one. With llm.provider=none the analysis falls back to the deterministic rule engine. The llm entry in features is retained for forward compatibility but no longer changes behavior. An unlicensed recommendation notes in its summary that applying it automatically requires a license.

The public key that verifies the license is baked into the chart (license.publicKey defaults to stepscale’s key), so the shipped operator trusts stepscale-signed licenses out of the box - you do not configure a key. A valid public key is required to apply anything; without one the operator is always analysis-only.

5.2 Installing the license

stepscale sends you two artifacts from licensegen issue: a license-secret.yaml (a ready kubectl apply-able Secret) and the two base64 values license.payload: and license.signature: (for the Helm path). Use either path - the baked public key means you do not pass a key.

Path A - apply the Secret, point Helm at it (simplest):

kubectl apply -f license-secret.yaml                    # creates the Secret in its namespace

helm upgrade <release> oci://ghcr.io/stepscale/charts/stepscale-autoscaler \
  --version <version> --namespace <namespace> --reuse-values \
  --set license.existingSecret=stepscale-autoscaler-license

Path B - let the chart create the Secret from the base64 values:

helm upgrade <release> oci://ghcr.io/stepscale/charts/stepscale-autoscaler \
  --version <version> --namespace <namespace> --reuse-values \
  --set license.payload=<base64-payload> \
  --set license.signature=<base64-signature>

Both values are base64 as emitted by licensegen - not the raw license.json.

Confirm the resolved state in the operator logs:

kubectl logs -n <namespace> deploy/stepscale-autoscaler | grep -i license

5.3 Plans

Plan	Shape
Community	No license. Full analysis - rule engine plus LLM judgement (your key) - in recommend-only mode, forever. Applying changes automatically is not included.
Trial	Full features (apply + schedules), time-boxed (14-30 days). The taste of automation before Team.
Team	Annual subscription, priced per cluster: apply, probation + auto-rollback, driven predictive schedules, support.
Enterprise	Custom: SSO/SAML, data-residency, support SLA, volume terms.

The Community tier is permanent and self-serve - no license file involved. Paid plans gate the automation (the operator acting on its recommendations), not the intelligence.

5.4 Expiry and renewal

• Grace, then graceful degrade. On expiry the operator continues to apply during the grace window (license.gracePeriodDays, default 14), with warnings, then degrades to analysis-only. An expired license never bricks the cluster - the read-only watch keeps running and the rollback safety net continues to function on changes the operator itself made.
• Renewal (air-gapped). Renewal is by swapping in a new signed license file: update the Secret (or re-run the helm upgrade … --set license.payload/signature from §5.2). No restart of your workloads is involved.
• Renewal (connected, optional). Connected customers may opt into an auto-renewing short-lived license; this is never required.