Upgrading KDBL Context Lake (K-Lake)

Version-specific upgrade steps. Newest first.

→ v0.1.2 — Licensing is now enforced (breaking)

K-Lake is now fail-closed: every K-Lake service container refuses to start without a valid licence. An existing v0.1.1 deployment that rolls the v0.1.2 images without a licence provisioned will fail to start (CrashLoop) with:

Error: no licence applied: set the kdbl-licence Secret (KDBL_LICENCE or
KDBL_LICENCE_FILE) — refusing to start

Before you upgrade

1. Obtain a licence. If you don't already have one, ask KDBL for a licence (evaluations get a 30-day one). It's a KDBLLIC1.… blob.

2. Provision the kdbl-licence Secret in the kdbl namespace:

kubectl -n kdbl create secret generic kdbl-licence \
  --from-literal=licence='KDBLLIC1.<...the blob...>'

Verify it first if you like — kdbl-control licence inspect <file> prints the terms and confirms ✓ signature valid.

1. Then roll the images. Each pod reads KDBL_LICENCE from that Secret at boot; the standard deployment manifests already wire it. Confirm each container logs that the licence was accepted at boot and stays Running.

The standard install scripts now require $KDBL_LICENCE and refuse to run without it, so fresh installs can't accidentally come up unlicensed.

What enforcement does (once running)

A running deployment is not killed when a licence lapses — it degrades gracefully per the licence's grace/lockdown windows: full use → (expired) grace → new-ingestion blocked (reads still work) → fully blocked. The API always stays up to serve /licence so you can apply a renewal live (kdbl-control licence apply) without a restart. See docs/licensing.md.

Notes

• The old KDBL_LICENCE_REQUIRED env flag is removed — enforcement is unconditional. Drop it from any manifests/overlays.
• Renewals: update the kdbl-licence Secret (newest licence wins) + restart, or apply live via POST /api/licence.