Check if the running Gateway is licensed before fetching Consumer Groups

cmd/common.go

@@ -228,7 +228,14 @@ func syncMain(ctx context.Context, filenames []string, dry bool, parallelism,
 		return fmt.Errorf("parsing Kong version: %w", err)
 	}
 
-	isKongEnterprise := v.IsKongGatewayEnterprise()
+	// Check if there's an active license for Consumer Group checks
+	isLicensedKongEnterprise := false
+	if v.IsKongGatewayEnterprise() {
+		isLicensedKongEnterprise, err = isLicensed(ctx, wsConfig)
+		if err != nil {
+			return fmt.Errorf("checking if Kong is licensed: %w", err)
+		}
+	}
 
 	if parsedKongVersion.GTE(reconcilerUtils.Kong300Version) &&
 		targetContent.FormatVersion != utils.FormatVersion30 {
@@ -264,7 +271,7 @@ func syncMain(ctx context.Context, filenames []string, dry bool, parallelism,
 	}
 
 	// Consumer groups are an enterprise 3.4+ feature
-	if parsedKongVersion.GTE(reconcilerUtils.Kong340Version) && isKongEnterprise {
+	if parsedKongVersion.GTE(reconcilerUtils.Kong340Version) && isLicensedKongEnterprise {
 		dumpConfig.LookUpSelectorTagsConsumerGroups, err = determineLookUpSelectorTagsConsumerGroups(*targetContent)
 		if err != nil {
 			return fmt.Errorf("error determining lookup selector tags for consumer groups: %w", err)
@@ -561,6 +568,28 @@ func performDiff(ctx context.Context, currentState, targetState *state.KongState
 	return int(totalOps), nil
 }
 
+func isLicensed(ctx context.Context, config reconcilerUtils.KongClientConfig) (bool, error) {
+	client, err := reconcilerUtils.GetKongClient(config)
+
+	req, err := http.NewRequest("GET",
+		reconcilerUtils.CleanAddress(config.Address)+"/",
+		nil)
+	if err != nil {
+		return false, err
+	}
+	var resp map[string]interface{}
+	_, err = client.Do(ctx, req, &resp)
+	if err != nil {
+		return false, err
+	}
+	_, ok := resp["license"]
+	if !ok {
+		return false, nil
+	}
+
+	return true, nil
+}
+
 func fetchKongVersion(ctx context.Context, config reconcilerUtils.KongClientConfig) (string, error) {
 	var version string