Thyris CLS License Modes
Thyris products support three deployment patterns. Product behavior remains fail-closed in every mode: a missing, invalid, expired, revoked, or incompatible license does not enable product functionality.
Online
online is the default and recommended mode. An administrator activates the
installation once, after which the local licensing component periodically
renews signed licensing state with Thyris CLS (Centralized License Service).
Choose this mode when the product can make outbound HTTPS connections to the approved Thyris CLS hostname. Application requests do not need to contact Thyris CLS individually.
Secret bootstrap
secret-bootstrap automates the initial activation of a connected Kubernetes
installation. A one-time activation key is mounted from an existing read-only
Kubernetes Secret. After successful activation, the installation operates like
online mode and the bootstrap Secret should be deleted.
Use this mode for automated installation pipelines. Keep the key out of Helm values and Helm release history; prefer External Secrets, Vault, CyberArk, or an equivalent approved secret manager.
Offline Secret
offline-secret is intended for installations that cannot reach Thyris CLS.
Thyris supplies an installation-bound, signed, time-bounded bundle,
which is mounted from a read-only Secret. The bundle must be renewed before its
approved deadline.
Offline mode requires prior commercial and operational approval. It is not an automatic fallback when an online installation loses connectivity, and an online installation cannot be converted by editing a mode value alone.
Comparison
| Mode | Remote connectivity | Initial material | Renewal |
|---|---|---|---|
online | Required periodically | Activation through product setup | Automatic |
secret-bootstrap | Required periodically | One-time key in a mounted Secret | Automatic |
offline-secret | Not required | Signed bundle in a mounted Secret | Controlled bundle replacement |
For all modes, restrict access to the local licensing Secret and service, enable Kubernetes encryption at rest, use least-privilege RBAC, and avoid logging license material.
The activation key, offline bundle, local state-encryption key, and local Agent credentials are secrets. The signing public keys used for verification are not secret credentials; they are integrity material pinned into supported product images and cannot be replaced by adding a value to a Kubernetes Secret.