Paths and Names
A lookup table. Most rows link to the page that explains them.
Configuration you write
| Path | Contents |
|---|---|
/etc/stratum/config.yaml | the declarative ClusterConfig; see Configuration |
/etc/stratum/stratum.env | optional environment for the unit, such as S3 credentials; you create it, root-owned, mode 0600; see Environment for the unit |
/etc/stratum/registries.yaml | registry mirrors, in the RKE2/k3s format; you create it, root-owned, mode 0600; see Registry mirrors |
/etc/stratum/snapshot.conf | snapshot retention and S3 target, written by stratum snapshot schedule; created with mode 0600 and may hold S3 credentials, so keep an existing file root-owned and 0600; see Where retention and the upload target come from |
/var/lib/stratum/manifests/ | manifests the operator applies; see Deploying manifests |
Node state
| Path | Contents |
|---|---|
/var/lib/stratum/ | all state: PKI, kubeconfigs, binaries, images, node state |
/var/lib/stratum/bin/ | the payload's binaries, including the ones stratum kubectl and stratum etcdctl run |
/var/lib/stratum/images/ | the payload's image archives |
/var/lib/stratum/pki/ | certificates and keys, and encryption-config.yaml under the CIS profile |
/var/lib/stratum/config/node.yaml | the persisted NodeState |
/var/lib/stratum/config/manifests/*.yaml | the rendered control-plane static pod manifests; see Hardening |
/var/lib/stratum/kubeconfig/admin.conf | the admin kubeconfig, on control planes; revocable, see admin.conf and super-admin.conf |
/var/lib/stratum/kubeconfig/super-admin.conf | the system:masters kubeconfig Stratum itself uses, on control planes |
/var/lib/stratum/upgrade/in-progress.json | present from an upgrade's first change until its health gate passes; see What an upgrade leaves behind |
<file>.bak-<stamp> | the file an upgrade replaced; see What an upgrade leaves behind |
/var/backups/etcd/ | local etcd snapshots, unless spec.snapshots.dir sets another directory; pre-upgrade snapshots always go here. Local retention prunes only etcd-snapshot-<host>-*.db, and snapshot list shows only local files ending in .db; see Where snapshots go |
/var/lib/stratum/log/<component>.log | logs of the supervised components; see Logs |
/var/log/stratum/audit.log | the API server audit log, under the CIS profile. Records who made each request, not Secret values; see What the audit log records |
/run/stratum/stratum.sock | the control socket (root only) |
/run/stratum/containerd/containerd.sock | the CRI endpoint |
Files Stratum writes outside its own directories
| Path | Written | See |
|---|---|---|
/etc/systemd/system/stratum.service | on systemd hosts | Reboot persistence |
/etc/sysctl.d/99-stratum.conf | on every start | Host settings |
/etc/sysctl.d/99-stratum-cis.conf | under the CIS profile | Hardening |
/etc/modules-load.d/k8s.conf | on every start | Host settings |
/etc/containerd/certs.d/<registry>/hosts.toml | when registries.yaml has mirrors | Registry mirrors |
/etc/containerd/conf.d/stratum-registry.toml | when registries.yaml has mirrors | Registry mirrors |
Configuration keys
Under spec in /etc/stratum/config.yaml:
| Key | Default | See |
|---|---|---|
certRenew | true | Certificates |
dashboard.enabled | true while the operator runs | The dashboard |
dashboard.nodePort | 30443; 0 for a ClusterIP only | The dashboard |
dashboard.publicURL | none | The dashboard |
dashboard.tlsSecretName | none: a certificate from the dashboard CA | The dashboard |
dashboard.enableNodeShell | true; false under cis: true | The dashboard |
dashboard.tokenSecrets | true | The dashboard |
snapshots.intervalHours | 12 | Schedule settings |
snapshots.disabled | false | Schedule settings |
snapshots.dir | /var/backups/etcd; a relative path or one with a .. element is ignored | Schedule settings |
snapshots.retain | 5 | Where retention and the upload target come from |
snapshots.s3 | none | Where retention and the upload target come from |
Kubernetes objects and labels
| Name | Kind | See |
|---|---|---|
stratum.ciq.com/control-plane=true | Node label | What a cluster upgrade creates |
stratum.ciq.com/k8s-version | Node annotation | What a cluster upgrade creates |
stratum.ciq.com/version | Node annotation | What a cluster upgrade creates |
stratum.ciq.com/upgrade-in-progress | Node annotation | What a cluster upgrade creates |
kube-system/stratum-cluster-upgrade | Lease | What a cluster upgrade creates |
stratum-upgrade-<node> | Job, in kube-system | What a cluster upgrade creates |
stratum.ciq.com/upgrade=<node> | Job label | What a cluster upgrade creates |
stratum.ciq.com/stack=<stack> | label on objects applied from a manifest stack | Deploying manifests |
stratum-dashboard | Namespace, Deployment and Service | The dashboard |
stratum-dashboard/stratum-dashboard-tls | Secret | The dashboard |
stratum-dashboard/stratum-dashboard-session | Secret | The dashboard |
kube-system/stratum-dashboard-ca | Secret, the dashboard's own CA | The dashboard |
stratum-dashboard/stratum-dashboard-admin-token, stratum-dashboard-viewer-token | Secret, sign-in tokens | The dashboard |
stratum-dashboard-admin, stratum-dashboard-viewer | ServiceAccount and ClusterRoleBinding (cluster-admin, view) | The dashboard |
Timings and defaults
| What | Value | See |
|---|---|---|
| Leaf certificate lifetime | 365 days | Certificates |
| Automatic leaf rotation | daily check, rotates within 45 days of expiry | Certificates |
| Scheduled snapshot interval | 12 hours | Schedule settings |
| Snapshots kept per control plane | 5 | Where retention and the upload target come from |
| Manifest deployer pass | every 20 seconds; unchanged files re-applied every 5 minutes | Deploying manifests |
| Cluster-upgrade lease | 60 seconds, renewed every 20 | What a cluster upgrade creates |
| Rollback wait before the health gate | 15 seconds (--soak) | Restoring etcd with a rollback |