You'll need to use an 8-key leased activation license key for this to work reliably. That will require egress connectivity to licensing.inductiveautomation.com over 443/tcp (the requests are just standard https).
Application of the license key and activation token would then be done by creating a secret for at least the activation token (the "private" portion an 8-digit key) and mapping that into the service definition via the IGNITION_ACTIVATION_TOKEN_FILE (pointing to the path where the secret is mounted, e.g. /run/secrets/ignition-activation-token) and IGNITION_LICENSE_KEY (containing the 8-digit key string value, e.g. XXXX-XXXX) environment variables.