Types of license
Comparison of versions and restrictions by license type.
Who is this page for?
The Shturval platform is available in versions: Community Edition (CE), Enterprise and Enterprise ML. This page contains a comparison table of features and limitations.
The CE license can be obtained through Telegram-bot or form on the website. Enterprise and Enterprise ML - under an agreement with the supplier.
Version comparison
Below is an expanded table of features and functionality of the versions. Details of changes by release are available in the release notes section of the platform. The “FSTEC Version” column reflects the availability of capabilities in the version that meets the FSTEC requirements: Yes - the capability is directly or functionally described in the requirements; ——there is no corresponding requirement.
| Parameter | CE | Enterprise | Enterprise ML | FSTEC version |
|---|---|---|---|---|
| Installation | ||||
| Open loop installation | Yes | Yes | Yes | No |
| Closed loop installation | No | Yes | Yes | Yes |
| Features | ||||
| User support | Community Telegram channel | According to SLA | According to SLA | According to SLA |
| Access to security fixes | Yes | Yes | Yes | — |
| Minimum fix release period (bugfix, security-fix) | When releasing a patch/minor version | From two hours | From two hours | — |
| Feature-request capability | No obligation | With the possibility of legal fixation | With the possibility of legal fixation | — |
| Register of Russian software | Not included | Included | Included | Included |
| Resources and Updates | ||||
| Resource limitation | 10 Worker nodes | According to license | According to license | According to license |
| Closed Loop Update | No | Yes | Yes | Yes |
| Scheduled update | Yes | Yes | Yes | Yes |
| Possibility of isolated update of each cluster k8s | Yes | Yes | Yes | Yes |
| Upgradeable | Available | Included in the support package | Included in the support package | Included in the support package |
| Interface and access | ||||
| GUI | Yes | Yes | Yes | Yes |
| Multilingual interface | Yes | Yes | Yes | Yes |
| Access Swagger | Yes | Yes | Yes | Yes |
| IAC approach | Yes | Yes | Yes | Yes |
| Platform Support | ||||
| Yandex Cloud | Yes | Yes | Yes | — |
| vCloud Director | Yes | Yes | Yes | — |
| VMware vSphere | Yes | Yes | Yes | — |
| zVirt, oVirt, HostVM, ED Virtualization, ROSA Virtualization | Yes | Yes | Yes | — |
| Basis Dynamix | Yes | Yes | Yes | — |
| OpenStack, VK Cloud, Selectel | Yes | Yes | Yes | — |
| Physical servers | Yes | Yes | Yes | Yes |
| Pre-built virtual servers | Yes | Yes | Yes | Yes |
| Hybrid Configurations for Clusters | Yes | Yes | Yes | Yes |
| Managing multiple clusters under one platform | Yes | Yes | Yes | Yes |
| Creating and managing clusters on different versions of k8s under the control of one management cluster | Yes | Yes | Yes | Yes |
| Disaster-proof solution | No | Yes | Yes | Yes |
| Support for geo-distributed clusters | Yes | Yes | Yes | Yes |
| Manage clusters and nodes | ||||
| Workload Clustering Interface | Yes | Yes | Yes | Yes |
| Managing Workload Cluster Nodes | Yes | Yes | Yes | Yes |
| Creating multiple groups of Worker nodes | Yes | Yes | Yes | Yes |
| Management of taints/tolerations | Yes | Yes | Yes | Yes |
| Vertical scaling of nodes | Yes | Yes | Yes | Yes |
| Horizontal scaling of nodes | Yes | Yes | Yes | Yes |
| Autoscaling nodes | Yes | Yes | Yes | Yes, if there are free hosts in the pool |
| Managing node configuration using the NodeConfigItem resource | Yes | Yes | Yes | Yes |
| Self-healing (machinehealthchecks) | Yes | Yes | Yes | Yes |
| Load Management | ||||
| Pod Vertical Scaling | Yes | Yes | Yes | Yes |
| Horizontal scaling of pods | Yes | Yes | Yes | Yes |
| Pod Autoscaling | Yes | Yes | Yes | Yes |
| Quota management | Yes | Yes | Yes | Yes |
| Managing limitranges | Yes | Yes | Yes | Yes |
| Authentication and Authorization | ||||
| Built-in authentication provider | Yes | Yes | Yes | Yes |
| Support for external authentication providers (Blitz, Keycloak) | Yes | Yes | Yes | Yes |
| Possibility of simultaneous launch of internal and external authentication services | Yes | Yes | Yes | Yes |
| Authentication to external services via SSO | Yes | Yes | Yes | Yes |
| Getting cluster kubeconfig from the GUI | Yes | Yes | Yes | Yes |
| Ability to connect to all available clusters from the CLI | Yes | Yes | Yes | Yes |
| Built-in authorization module | Yes | Yes | Yes | Yes |
| Ability to connect LDAP directory (LDAP, LDAPS) | Yes | Yes | Yes | Yes |
| Active Directory support | Yes | Yes | Yes | Yes |
| OpenLDAP support | Yes | Yes | Yes | Yes |
| FreeIPA support | Yes | Yes | Yes | Yes |
| SambaDC support | Yes | Yes | Yes | Yes |
| ALDPro support | Yes | Yes | Yes | Yes |
| Centralizedleft-field model (RBAC) | Yes | Yes | Yes | Yes |
| Multitenancy | Yes | Yes | Yes | Yes |
| Network Management | ||||
| Network Management (Cilium CNI) | Yes | Yes | Yes | Yes |
| Graphical network policy editor | Yes | Yes | Yes | Yes |
| Network List Management | Yes | Yes | Yes | Yes |
| Managing incoming and outgoing traffic from namespace | Yes | Yes | Yes | Yes |
| HAProxy backend dynamic detection module (CoreHA) | Yes | Yes | Yes | No |
| Built-in load balancer (Nginx Ingress) | Yes | Yes | Yes | — |
| Built-in CoreDNS module (NodeLocalDNS) | Yes | Yes | Yes | Yes |
| Built-in virtual IP management module (KubeVIP) | Yes | Yes | Yes | Yes |
| Pod multi-homing support | No | Yes | Yes | No |
| Support for external load balancers | Yes | Yes | Yes | Yes |
| Certificate Management | ||||
| Certificate management | Yes | Yes | Yes | Yes |
| ACME certification support | Yes | Yes | Yes | Yes |
| Vault certificate support | Yes | Yes | Yes | Yes |
| Support for corporate certificates (including step-ca) | Yes | Yes | Yes | Yes |
| Let’s Encrypt support | Yes | Yes | Yes | — |
| Support for self-signed certificates | Yes | Yes | Yes | Yes |
| Root Certificate Delivery Module (Trust Manager) | Yes | Yes | Yes | Yes |
| Rotation of system certificates | Yes | Yes | Yes | Yes |
| Backup and Restore | ||||
| Backup and Restore (Velero) | Yes | Yes | Yes | Yes |
| Ability to restore a deleted cluster | Yes | Yes | Yes | Yes |
| Logs and monitoring | ||||
| Local log collection | Yes | Yes | Yes | Yes |
| Centralized log storage | Yes | Yes | Yes | Yes |
| SIEM integration support | Yes | Yes | Yes | Yes |
| Graphic display of logs | Yes | Yes | Yes | Yes |
| Possibility of obtaining cluster logs from the cluster GUI | Yes | Yes | Yes | Yes |
| Container logs in the pod GUI | Yes | Yes | Yes | Yes |
| Possibility of filtering and uploading logs | Yes | Yes | Yes | Yes |
| Local metrics collection | Yes | Yes | Yes | Yes |
| Centralized storage of metrics | Yes | Yes | Yes | Yes |
| Graphical display of metrics | Yes | Yes | Yes | No |
| Built-in graphic panels (dashboards) | Yes | Yes | Yes | No |
| Ability to upload your own graphic panels (dashboards) | Yes | Yes | Yes | — |
| Obtaining resource utilization schedules in the GUI of namespaces and loads | Yes | Yes | Yes | Yes |
| Namespace metering | Yes | Yes | Yes | Yes |
| Continuous Application Delivery | ||||
| Built-in Continuous Application Delivery (Argo CD) | Yes | Yes | Yes | Yes |
| Built-in role model for Argo CD | Yes | Yes | Yes | Yes |
| Ability to create projects in Argo CD from the GUI of the cluster namespace | Yes | Yes | Yes | No |
| ArgoRollout module | Yes | Yes | Yes | No |
| Load redistribution module (Descheduler) | Yes | Yes | Yes | Yes |
| Connecting repositories using http, https, oci protocols | Yes | Yes | Yes | Yes |
| Managing system services (Helm charts) | Yes | Yes | Yes | Yes |
| Data storage | ||||
| Local Storage Module (RawFile Provisioner) | Yes | Yes | Yes | Yes |
| Ceph FS support | Yes | Yes | Yes | Yes |
| Ceph RBD support | Yes | Yes | Yes | Yes |
| NFS support | Yes | Yes | Yes | Yes |
| oVirt CSI support | Yes | Yes | Yes | Yes |
| vSphere CSI Support | Yes | Yes | Yes | Yes |
| Security | ||||
| Module for scanning containers for vulnerabilities (Trivy Operator) | Yes | Yes | Yes | Yes |
| Scanning by BDU FSTEC | Yes | Yes | Yes | Yes |
| Scanning images built on Astra Linux | Yes | Yes | Yes | Yes |
| Scanning images collected on RED OS | Yes | Yes | Yes | Yes |
| Displaying reports on vulnerabilities at levels: cluster, namespace, namespace loads | Yes | Yes | Yes | Yes |
| Analysis of k8s cluster components for compliance with CIS Benchmark | Yes | Yes | Yes | Yes |
| Application Configuration Analysis Module (Kyverno) | Yes | Yes | Yes | Yes |
| Advanced Security Policies | No | Provided in Service Desk Knowledge Base | Provided in Service Desk Knowledge Base | Provided in Service Desk Knowledge Base |
| Graphical audit policy editor | Yes | Yes | Yes | Yes |
| KESL Compatible | Yes | Yes | Yes | Yes |
| KCS Compatible | Yes | Yes | Yes | Yes |
| Luntry Compatible | Yes | Yes | Yes | Yes |
| ML | ||||
| Kubeflow Platform | No | No | Yes | No |
| Managing Kubeflow Permissions via Permission Sets | No | No | Yes | No |
| Switching to Kubeflow from the namespace GUI | No | No | Yes | No |
| Lifecycle Management with MLflow | No | No | Yes | No |
Enterprise/FSTEK licensing types
In the Enterprise edition, the platform can be licensed according to different metrics:
- by vCPU — the total number of virtual cores of all Worker nodes in all client clusters is calculated;
- by Worker nodes — the number of Workers is calculatednodes in all client clusters;
- by physical hosts—the number of physical servers hosting Worker nodes is counted;
- unlimited - license without resource restrictions (by agreement).
Each Enterprise license entitles you to one version of the platform (minor release branch).
Updating the platform to new versions is carried out as part of the support package (see the “Upgradeability” line in the table).
When calculating resources for these license types:
- not taken into account nodes and resources of the management cluster - limits apply only to client clusters (Worker nodes and their resources);
- only resources related to licensed metrics (vCPU, Worker nodes or physical hosts) are taken into account.
Community (CE) license features
For Community Edition restrictions are considered for the entire platform:
- both the management cluster and client clusters are taken into account;
- limit - 10 Worker nodes in total on all platform clusters.
Exceeding the CE limit leads to warnings being displayed in the GUI and the need to switch to Enterprise licensing.
Where to see the current license
Information about the license, number of nodes and Open-Source components used is displayed on the “About the system” page (start page of the GUI). There you can also go to the Service Desk (Enterprise) or to the Telegram channel (CE).
If the license expiration date is more than 15 years after the current date, Validity period displays Perpetual. An expiration date exactly 15 years away or sooner is displayed as a date.
A license valid for more than 15 years is treated as perpetual. In this case, the license Validity period is shown as Perpetual. If the license is valid for 15 years or less, the exact expiration date is shown.
What happens when the limits are exceeded and the license expires
Limit exceeded (Worker nodes or vCPU)
The license package specifies a limit on the number of Worker nodes and vCPUs. If the limit is exceeded a notification is displayed on all screens of the platform GUI asking you to contact the vendor to change the license package.
License expiration
It is recommended to renew your license before it expires. When the deadline expires, notifications are displayed on the platform; To continue working, you must obtain and apply a new license (see How to update a license).