Glossary

Terms this documentation uses in a specific way.

Artifact — the single stratum executable with its appended payload. Not an installer that fetches things; the thing itself.

Payload — the ZIP appended to the executable, holding the component binaries and the OCI image archive. Unpacked by stratum stage.

Supervisor — the process model. Components run as child processes of the running stratum command, restarted with backoff, driven through the control socket. Stratum does not install a unit per component. Its one systemd unit, stratum.service, restarts the supervisor after a reboot.

Control socket — /run/stratum/stratum.sock, root-only, speaking restart/stop/start/status. How certificate rotation, snapshot restore and upgrades act on individual components.

Rendered manifests — the control-plane static pod manifests, generated from configuration on every start and written to /var/lib/stratum/config/manifests/<name>.yaml. What hardening check audits.

ClusterConfig — the declarative configuration at /etc/stratum/config.yaml. Strictly parsed.

NodeState — the persisted per-node facts at /var/lib/stratum/config/node.yaml: role, addresses, etcd membership.

Node — the stratum up default: one machine that is both control plane (run as kubelet-managed static pods) and workload host, registered and schedulable.

Dedicated control plane — a node the operator has tainted (node-role.kubernetes.io/control-plane:NoSchedule) so it runs the control plane but no workloads.

Worker — stratum up --worker. A workload-only node with no control plane.

VIP — the virtual IP served by kube-vip on the controllers. One address used by workers and by kubectl alike. Not the address of a LoadBalancer Service, which Cilium's LB-IPAM assigns and a Cilium agent announces (see LoadBalancer Services).

CA pin — the sha256: hash printed in a join command. A joining node checks the authority it is offered against this, so it can tell your cluster from something impersonating it.

Certificate key — the additional secret token create --control-plane writes to a 0600 file (printing its path, not the key). Lets a joining controller decrypt the shared CA material; pass it via --certificate-key-file.

Trust bundle — the set of certificate authorities currently trusted, as distinct from the single authority currently signing. Rotation widens the bundle, moves the signer, then narrows it.

etcd CA — etcd's own certificate authority, separate from the Kubernetes root, so that a certificate issued for the cluster is not automatically a valid etcd client.

CIS profile — --cis. The hardening controls that are off by default because they change cluster behaviour.

EXCEPTION — in hardening check output, a deliberate documented deviation rather than an unimplemented check.

Airgap — installing with no registry reachable. Not a mode in Stratum; the normal artifact carries its images.