Managed services

Some services can be switched off for the whole cloud and on again. A service that is off answers tenants with 503 SERVICE_DISABLED, its background work stops, and its alarms and readiness findings go quiet.

Key	Service	On a single node
client-vpn	Client VPN endpoints into VPCs	Offered
backup	Backup plans and vaults for volumes	Offered
secrets	Secrets Manager	Offered
security	Posture, software inventory and vulnerability findings	Offered
s3	Object storage	Needs a cluster
db	Managed PostgreSQL	Needs a cluster
k8s	Managed Kubernetes	Needs a cluster
asg	Auto Scaling	Needs a cluster; always on where offered

Load balancers, compute, networking, storage and DNS are always on.

A cluster offers the services marked “Needs a cluster”. Object storage waits for Ceph and its object gateway, and managed databases for object storage: see Set up storage.

stratumctl admin services list
stratumctl admin services get client-vpn
stratumctl admin services disable client-vpn
stratumctl admin services enable client-vpn

Console: Admin › Platform › Catalog › Managed Services. Stage 2 of the install sets the starting state.

Switching off is refused while tenants still have live resources of the service (409 SERVICE_IN_USE). Delete them, or let a teardown delete them and then switch the service off. It shows the plan and asks before deleting anything:

stratumctl admin services teardown client-vpn
stratumctl admin services teardown-status client-vpn
stratumctl admin services cancel-teardown client-vpn   # stop; the service stays on

Teardown covers Client VPN endpoints and backup plans (recovery points and vaults are kept). Secrets and security have no teardown: empty them through their own APIs first.