---
title: "License metrics"
description: "Monitor Calico Enterprise license metrics such as how many days until license expires."
product: "Calico Enterprise"
version: "3.23 (latest)"
section: "Operations"
canonical_url: "https://docs.tigera.io/calico-enterprise/latest/operations/monitor/metrics/license-agent"
---

# License metrics

## Big picture

Use the Prometheus monitoring and alerting tool to get Calico Enterprise license metrics.

## Value

Platform engineering teams need to report licensing usage on third-party software (like Calico Enterprise) for their CaaS/Kubernetes platforms. This is often driven by compliance, but also to mitigate risks from license expiration or usage that may impact operations. For teams to easily access these vital metrics, Calico Enterprise provides license metrics using the Prometheus monitoring and alerting tool.

## Concepts

### About Prometheus

The Prometheus monitoring tool scrapes metrics from instrumented jobs and displays time series data in a visualizer (such as Grafana). For Calico Enterprise, the “jobs” that Prometheus can harvest metrics from the License Agent component.

### About License Agent

The **License Agent** is a containerized application that monitors the following Calico Enterprise licensing information from the Kubernetes cluster, and exports the metrics through the Prometheus server:

- Days till expiration

## How to

- [Add license agent in your Kubernetes cluster](#add-license-agent-in-your-kubernetes-cluster)
- [Upgrade the license agent](#upgrade-the-license-agent)
- [Create alerts using Prometheus metrics](#create-alerts-using-prometheus-metrics)

### Add license agent in your Kubernetes cluster

To add the license-agent component in a Kubernetes cluster for license metrics, install the pull secret and apply the license-agent manifest.

1. Create a namespace for the license-agent.
   ```text
    kubectl create namespace tigera-license-agent
   ```
2. Install your pull secret.
   ```text
    kubectl create secret generic tigera-pull-secret \
      --type=kubernetes.io/dockerconfigjson -n tigera-license-agent \
      --from-file=.dockerconfigjson=<path/to/pull/secret>
   ```
3. Apply the manifest.
   ```text
    kubectl apply -f https://downloads.tigera.io/ee/v3.23.2/manifests/licenseagent.yaml
   ```

### Upgrade the license agent

The license agent is installed from a manifest and is not managed by the Calico Enterprise operator. Upgrading Calico Enterprise leaves the license agent running the image from the manifest you last applied, so you must upgrade the license agent yourself after every Calico Enterprise upgrade. Until you do, license metrics come from the old version of the agent.

1. Apply the manifest for the version of Calico Enterprise you upgraded to.
   ```text
    kubectl apply -f https://downloads.tigera.io/ee/v3.23.2/manifests/licenseagent.yaml
   ```
2. If you upgraded from a version earlier than Calico Enterprise v3.23, delete the license agent's network policy from the `allow-tigera` tier. From v3.23 the manifest creates this policy in the `calico-system` tier instead, and because the name of a policy includes the name of its tier, applying the new manifest adds a second policy rather than replacing the first: the same rule ends up in both tiers.
   ```text
    kubectl delete networkpolicies.projectcalico.org allow-tigera.tigera-license-agent-access -n tigera-license-agent
   ```
3. Check whether any policy is left in the `allow-tigera` tier.
   ```text
    kubectl get networkpolicies.projectcalico.org,globalnetworkpolicies.projectcalico.org -A | grep allow-tigera
   ```
   The operator removes the deprecated `allow-tigera` tier once no policy is left in it. While any policy remains, the tier stays and the operator logs `Cannot delete a non-empty tier` on every reconcile. So deleting the license agent's policy is enough only if nothing else is left: if the command above still lists policies, expect the tier to remain until those are removed as well. Contact Support if you are unsure what created a policy that is still listed.

### Create alerts using Prometheus metrics

In the following example, an alert is configured when the license expiry is fewer than 15 days.

```yaml
apiVersion: monitoring.coreos.com/v1
kind: PrometheusRule
metadata:
  name: calico-prometheus-license
  namespace: tigera-prometheus
  labels:
    role: tigera-prometheus-rules
    prometheus: calico-node-prometheus
spec:
  groups:
    - name: tigera-license.rules
      rules:
        - alert: CriticalLicenseExpiry
          expr: license_number_of_days < 15
          labels:
            severity: Warning
          annotations:
            summary: 'Calico Enterprise License expires in less than 15 days'
            description: 'Calico Enterprise License expires in less than 15 days'
```

> **SECONDARY:** If the Kubernetes api-server serves on any port other than 6443 or 443, add that port in the Egress policy of the license agent manifest.

## Additional resources

- [LicenseKey resource](https://docs.tigera.io/calico-enterprise/latest/reference/resources/licensekey.md)
- [Configure Alertmanager](https://docs.tigera.io/calico-enterprise/latest/operations/monitor/prometheus/alertmanager.md)