Licensing options?

[keylooper]

I'm trying to understand what my licensing options are.  I installed ZenArmor, currently on the free edition.  I would like to buy a subscription but it seems my home is too big for a home license.  In my ZenArmor settings it shows I have 232 active devices.  So is my only option to buy a Business plan at $225 a month?  I do need to better understand what all my devices are (is it registering every container on my k8s cluster as a device?) but I'm certain I have over 100 devices so understanding what my options are would be good and there's no way I'm paying that for my home.  :)

[deuch]

What kind of network driver (CNI) are you using with your k8s cluster ? Is it flannel or cilium or something else ?
Does your pods take an ip your VLAN/subnet ?

[sy]

Hi,

Zenarmor has an Exempted VLAN / Network / IP option for the licensed users. You can exclude some items from inspection and they won't count for the licence as well.

[keylooper]

Hi,

Zenarmor has an Exempted VLAN / Network / IP option for the licensed users. You can exclude some items from inspection and they won't count for the licence as well.

I saw that, but then I'm loosing out on the value ZanArmor brings, monitoring my network.  If I have to filter out more than half of it. 

What kind of network driver (CNI) are you using with your k8s cluster ? Is it flannel or cilium or something else ?
Does your pods take an ip your VLAN/subnet ?

flannel, my pods have private ips (a subnet not on one of my vlan subnets) but the services all have an ip from one of my vlan subnets.

[deuch]

How do you create your service ? With a ClusterIP or not ? Even with a nodePort it does not take any IP on your subnet.

In fact you can use a k8s cluster with full overlay network (pods and services) and only nodes have a ip of your subnet.

So normally, only your node IP will count for zenarmor licence and not the pods id or service. With ip tables or IPVS it's the case so i do not know how your cluster is configurer, or something with netmap see the overlay ip as a « real » one.
But if it's the case, choose 2 different subnet for pods and services during installation and set them as exempted network in zenamor. Can you try ?

[keylooper]

services are using clusterIP, the pods use private non-routable IPs.  I've added the network of my pods to the exempt list.

[almodovaris]

If you hide your pods behind a NAT and don't use IPv6, Zenarmor does not see them as different devices.