Tenon Licensing Server

---

The Tenon licensing server is a small, stateless service that manages Tenon seat leases for customers running in an air-gapped Kubernetes enclave (Mode 2). It allows the tenon CLI to check out, heartbeat, and return short-lived, cryptographically-signed seat leases without any route to Tangram Flex's cloud at runtime.

Licensing modes

The same underlying trust model applies across all three Flex CLI licensing modes. Only where the authority lives changes:

Mode	Authority	Deployment
1 — online	Tangram Flex's GovCloud API	no on-prem server required
2 — air-gapped enclave	the licensed server running on the customer's Kubernetes cluster	this guide
3 — fully disconnected	a KMS-signed license file, verified by the CLI with no server	contact Tangram Flex

This guide covers Mode 2 — deploying the Tenon licensing server Helm chart on your Kubernetes cluster.

How it works

KMS org key (root; public key pinned in the tenon binary)
  └─ signs → delegation cert { delegate_pubkey, max_seats, valid_until T }   ← out-of-band
               └─ authorizes → in-enclave key (private key never leaves the enclave)   ← keygen Job
                                 └─ signs → short-lived seat lease { jti, exp, features }

The server signs leases with an in-enclave keypair generated by a Helm pre-install hook. Because that keypair never leaves your cluster, the only material Tangram Flex ever touches is the public key. Tangram uses KMS to sign a delegation over it (binding the scope: seat count, expiration date T, and optional node-lock allowlist) and returns two public files that you apply as a Kubernetes Secret. Once that trust Secret is in place, licensed starts automatically.

The valid_until: T field in the delegation is the expiration time-bomb, enforced offline by both the server and the client — no network connectivity is required to enforce it. Before T lapses, you renew by requesting a fresh delegation from Tangram Flex (same in-enclave key, new T) and swapping the Secret.

Components

The chart deploys the following components:

Component	Description
licensed	Stateless seat arbitrator. Clients check out, heartbeat, and return seats against this service.
valkey	Redis-compatible seat-state store. Persists floating pool and node-locked seat assignments across restarts.
activityd	Durable activity event store (SQLite). Records what Flex CLI commands each seat was used for.
dashboard	Operator web UI for viewing seat status and activity events.
keygen (hook)	Pre-install Helm hook that generates the in-enclave delegate keypair. Idempotent: never rotates an existing key.