---
layout: docs
page_title: Deploy Consul Enterprise on Kubernetes
description: >-
  Consul Enterprise features are available when running Consul on Kubernetes. Learn how to apply your license in the Helm chart and return the license information with the `consul license get` command.
---

# Deploy Consul Enterprise on Kubernetes

This topic describes how to install Consul Enterprise on Kubernetes using the Helm chart. It assumes you are storing your license as a Kubernetes Secret. If you would like to store the enterprise license in Vault, reference [Store Enterprise license in Vault](/consul/docs/deploy/server/k8s/vault/data/enterprise-license).

## Requirements

Find the license file that you received in your welcome email. It should have a `.hclic` extension. You will use the contents of this file to create a Kubernetes secret before installing the Helm chart.

<Note>
  
If you cannot find your `.hclic` file, please contact your sales team or Technical Account Manager.

</Note>
  

## Create Kubernetes secret

Export an environment variable named `secret` with the contents of your Enterprise license file.

```shell-session
$ secret=$(cat 1931d1f4-bdfd-6881-f3f5-19349374841f.hclic)
```

Create a Kubernetes secret named `consul-ent-license` and key `key` with the value of the license file.

```shell-session
$ kubectl create secret generic consul-ent-license --from-literal="key=${secret}"
```

## Configure Helm chart

In your `values.yaml`, change the value of `global.image` to one of the enterprise [release tags](https://hub.docker.com/r/hashicorp/consul-enterprise/tags). Enterprise images end with `-ent`.

<CodeBlockConfig filename="values.yaml" highlight="2">

```yaml
global:
  image: 'hashicorp/consul-enterprise:1.20.0-ent'
```

</CodeBlockConfig>

Define your Consul Enterprise secret.

<Tabs>

<Tab heading="Consul v1.10+">

If you are using Consul v1.10+, add the name and key of the secret you just created to `server.enterpriseLicense`.

<CodeBlockConfig filename="values.yaml" highlight="3-6">

```yaml
global:
  image: 'hashicorp/consul-enterprise:1.20.0-ent'
  enterpriseLicense:
    secretName: 'consul-ent-license'
    secretKey: 'key'
```

</CodeBlockConfig>

</Tab>
<Tab heading="Consul older than v1.10">

If you are using a Consul version older than 1.10, use the following configuration with the name and key of the secret you just created. These values are required on top of your normal configuration.

You must set `server.enterpriseLicense.enableLicenseAutoload` to `false`. 

<CodeBlockConfig filename="values.yaml" highlight="3-6">

```yaml
global:
  image: 'hashicorp/consul-enterprise:1.8.3-ent'
  enterpriseLicense:
    secretName: 'consul-ent-license'
    secretKey: 'key'
    enableLicenseAutoload: false
```

</CodeBlockConfig>

</Tab>

</Tabs>

## Install Consul Enterprise

Now, install Consul Enterprise on your Kubernetes cluster using the updated Helm chart.

```shell-session
$ helm install --wait hashicorp hashicorp/consul --values values.yaml
```

@include 'alerts/k8s-namespace.mdx'

## Verify installation

Once the cluster is up, you can verify the nodes are running Consul Enterprise by using the `consul license get` command.

First, forward your local port 8500 to the Consul servers so you can run `consul` commands locally against the Consul servers in Kubernetes.

```shell-session
$ kubectl port-forward service/hashicorp-consul-server 8500:8500
```

In a separate tab, run the `consul license get` command.

```shell-session
$ consul license get
License is valid
License ID: 1931d1f4-bdfd-6881-f3f5-19349374841f
Customer ID: b2025a4a-8fdd-f268-95ce-1704723b9996
Expires At: 2020-03-09 03:59:59.999 +0000 UTC
Datacenter: *
Package: premium
Licensed Features:
        Automated Backups
        Automated Upgrades
        Enhanced Read Scalability
        Network Segments
        Redundancy Zone
        Advanced Network Federation
```

List the Consul servers. Notice the `+ent` in the `Build` column, indicating that the servers are running Consul Enterprise.

```shell-session
$ consul members
Node                                       Address           Status  Type    Build      Protocol  DC   Segment
hashicorp-consul-server-0                  10.60.0.187:8301  alive   server  1.10.0+ent  2         dc1  <all>
hashicorp-consul-server-1                  10.60.1.229:8301  alive   server  1.10.0+ent  2         dc1  <all>
hashicorp-consul-server-2                  10.60.2.197:8301  alive   server  1.10.0+ent  2         dc1  <all>
```

### ACLs enabled

If the commands return the following error message, your Consul deployment likely has ACLs enabled.

```bash
Error getting license: invalid character 'r' looking for beginning of value
```

You need to specify your ACL token when running the `license get` command. First, assign the ACL token to the `CONSUL_HTTP_TOKEN` environment variable:

```shell-session
$ export CONSUL_HTTP_TOKEN=$(kubectl get secrets/hashicorp-consul-bootstrap-acl-token --template='{{.data.token | base64decode }}')
```

Now, the token will be used when running Consul commands.

```shell-session
$ consul license get
License is valid
License ID: 1931d1f4-bdfd-6881-f3f5-19349374841f
Customer ID: b2025a4a-8fdd-f268-95ce-1704723b9996
Expires At: 2020-03-09 03:59:59.999 +0000 UTC
Datacenter: *
Package: premium
Licensed Features:
        Automated Backups
        Automated Upgrades
        Enhanced Read Scalability
        Network Segments
        Redundancy Zone
        Advanced Network Federation
```
