Skip to Content
Quick Start

Quick Start

A single schedulable node, from artifact to Ready, with no registry access.

Prerequisites

  • a Linux host with cgroup v2 (Stratum does not support cgroup v1)

  • root

  • ~2 GB free for the artifact and its unpacked payload

  • on an SELinux host, such as Rocky Linux, RHEL or RLC, the SELinux policy packages; without them stratum up refuses to start on an enforcing host (see SELinux):

    sudo dnf install container-selinux policycoreutils-python-utils libselinux-utils

Stratum checks the platform floor before it starts anything, and refuses with a specific message rather than failing later in an unclear way.

1. Put the binary on the node

The artifact is one file. Copy it to the node and make it executable:

sudo install -m 0755 stratum /usr/local/bin/stratum
stratum version

2. Start a node

sudo stratum up

That is the whole install. It stages the payload, generates the PKI, imports the container images from the payload, starts kubelet and containerd under the supervisor, brings up etcd and the control plane as static pods, and applies the CNI, DNS and storage manifests. The node registers schedulable: it is both control plane and workload host.

It also installs and enables stratum.service, so the node comes back on its own after a reboot. See Reboot persistence.

3. Use the cluster

sudo stratum kubectl get nodes
sudo stratum kubectl get pods -A

stratum kubectl is the bundled kubectl. On a controller it uses this cluster's /var/lib/stratum/kubeconfig/admin.conf unless you set KUBECONFIG yourself, in which case yours wins. For an external client, copy that file.

The node reaches Ready once Cilium is up. CoreDNS and the local-path StorageClass follow.

4. Open the dashboard

The cluster runs a dashboard on port 30443 of every node. Once the node has registered, stratum up prints the dashboard's address and the command for a sign-in token, as lines beginning stratum: dashboard. Print the token, then open https://<node address>:30443 and paste it:

sudo stratum kubectl -n stratum-dashboard get secret stratum-dashboard-admin-token \
  -o jsonpath='{.data.token}' | base64 -d; echo

The browser warns about the certificate until you trust the dashboard CA. See Connect to the dashboard for that, the firewall port, and the other ways in.

5. Add a worker

Mint a token on the controller:

sudo stratum token create

It prints a complete join command, including the CA pin. Run that on the new node:

sudo stratum up --worker --server https://<controller>:6443 \
  --token <token> \
  --discovery-token-ca-cert-hash sha256:<pin>

All three flags are required. On a cluster with a non-default pod CIDR, service CIDR or cluster domain, the printed command also carries --pod-cidr, --service-cidr or --cluster-domain; keep them. The pin is what lets the joining node verify it is talking to your cluster rather than something impersonating it.

The token expires in 24 hours by default and is then removed automatically, so it does not linger as a working join credential in a runbook, CI secret or terraform variable. Set a different lifetime with --ttl (for example --ttl 168h), or --ttl 0 for a non-expiring token you must delete by hand. List live tokens and their remaining lifetime with stratum token list. An expired token shows up as a failed kubelet bootstrap on the joining node (the node never becomes Ready); check stratum token list on the controller and mint a fresh one.

Tokens minted before this release have no expiration and do not gain one retroactively — stratum token list shows them as never. Delete any you no longer need: kubectl -n kube-system delete secret bootstrap-token-<id>.

Keep the certificate key out of your shell history

The HA certificate key is never printed to your terminal: stratum token create --control-plane writes it to a 0600 file and prints only the path. Copy that file to the joining controller and pass it with --certificate-key-file, then delete it from both nodes once the node is Ready.

Next

OverviewInstallation