Appendices
- Glossary — the terms this documentation uses in a specific way
- Paths and Names — where Stratum keeps things on a node, the Kubernetes objects it creates, and its default timings
Command reference
Every subcommand of the single binary:
| Command | What it does |
|---|---|
stratum up | run a node: control plane + workloads by default, --join to add a control plane to an existing cluster, --worker for a workload-only node |
stratum token create | mint a join token (default 24h lifetime, --ttl to change, --ttl 0 for non-expiring); --control-plane mints a control-plane join token instead (it can read the encrypted shared certs, so use a separate token for workers), uploads shared certs and writes a certificate key to a 0600 file, printing its path |
stratum token list | list join tokens and their remaining lifetime |
stratum certs | check, rotate (--rekey-shared), rotate-ca |
stratum snapshot | save, list, schedule, restore, rejoin |
stratum upgrade | per-node binary swap, or --cluster for a rolling upgrade |
stratum rollback | restore the previous binaries |
stratum hardening | check, encrypt-existing |
stratum ha-repoint | move a node's clients onto the cluster VIP |
stratum registry | inspect registry and mirror configuration |
stratum dash | serve the cluster dashboard; users sign in with a Kubernetes ServiceAccount token and act under their own RBAC. --enable-node-shell (default on) allows the privileged host shell; --enable-node-shell=false withholds it; --session-key-file keeps sessions across restarts. The cluster also runs it for itself (The dashboard) |
stratum stage | unpack the payload without starting anything |
stratum which | report what a staged tree contains |
stratum operator | run the operator (normally a supervised child of controller) |
stratum kubectl / stratum etcdctl | the bundled clients; on a controller they configure themselves, and anything you set in the environment wins (see Talking to the cluster) |
stratum mcp | serve Stratum's tools over the Model Context Protocol; read-only unless --allow-write or --allow-destructive |
stratum uninstall | stop everything, tear down Cilium's datapath and the kubepods cgroups, and remove stratum.service and the state directory (and /var/lib/kubelet if it is empty) |
stratum version | version of this artifact; --components lists the bundled component versions, and warns when the containerd serving the CRI socket is not the one installed |
Run any of them with --help for flags. The binary's help is generated from the
same code that dispatches the commands, so it cannot describe a command that does
not exist.
Paths
Files, directories, Kubernetes object names and default timings are listed in Paths and Names.