The install's outcome.
curl --request GET \ --url https://192.0.2.10:9443/v1/installer/report \ --header 'Authorization: <Authorization>'The console and API URLs, the readiness verdict, the first admin’s
email and, while it still signs in, the install-time password
(see adminPasswordState), where the admin’s credential
file is, the log path, and on failure the step that failed and
whether a re-run is safe. Once the install has succeeded, where
OpenBao’s unseal key is kept (openbaoUnsealFrom) and, while the
install-time password is shown, OpenBao’s recovery key.
Before any install finished, outcome is none. Once the install has
succeeded, clientSetup says how to reach the cloud from the LAN:
the route for the floating IPs and the DNS forward for the parent
domain, with ready-to-paste commands per client OS.
Authorizations
Section titled “Authorizations”Responses
Section titled “Responses”The report.
object
configuring until an install starts; installing while one runs;
done after one succeeded; failed after the latest one failed.
Where the first admin’s generated password is on the node
(root-only). The report returns the password itself only while
adminPasswordState is initial.
Whether the report can show the first admin’s install-time
password, checked against the node’s control plane at
every request. Present once the install has succeeded.
initial: it is still the admin’s current, one-time password;
adminPassword carries it. changed: someone has set a new one,
so the install-time password no longer signs in and is not shown.
unknown: the installer could not tell (the control plane did not
answer, or the credential file is unreadable); the password is not
shown, and adminCredentialFile says where to read it on the node.
The first admin’s install-time password. Present only
when adminPasswordState is initial: the install succeeded
and this is still the admin’s current password. It is a
one-time password: the first sign-in (console or stratumctl login) must choose a new one before anything else works. Read at every request and never stored in the
report on disk, so it disappears as soon as it is changed.
Where OpenBao’s unseal key is kept on this node, read at every request. Present once the install has succeeded.
tpm: sealed to this node’s TPM; OpenBao unseals at boot through the
TPM and no plaintext copy is on disk. disk: in plaintext in
/var/lib/stratum/openbao-init.json, which OpenBao unseals from at
boot (a node with no TPM): anyone who can read this disk can read
every secret OpenBao holds; readiness warns OpenBaoUnsealKeyOnDisk.
unknown: the record could not be read.
OpenBao’s recovery key: its unseal key, the one way to
unseal OpenBao when this node’s TPM cannot give the key back (a
cleared or replaced TPM), or the node’s disk is lost. Shown with
the install-time password, so only while adminPasswordState is
initial: store it off the node before the first sign-in. Read
at every request and never stored in the report on disk. On the
node, root can print it again with stratum-bootstrap recover openbao-key.
object
The codes of the findings that block the CLUSTER (ready is false
while this is not empty), each once. A blocker of one service
(databases, Kubernetes, S3) is in serviceBlocking instead.
What keeps a service not ready, one entry per service and finding
code with its subjects, from the control plane’s
services.<name>.blocking. It does not hold the install up: on a
new cluster the databases and Kubernetes services wait for an
operator image to be built.
object
Why readiness could not be read.
The cloud’s first convergence after install. While phase is
settling, warnings are held by the control plane and warnings
is empty; a page shows “Starting: ready of total”.
object
The verdict’s failedStep. Present on failure.
What a person is told the failed step is, e.g. “Preparing storage”
for firstboot/storage. Set for every failedStep the
installer reports, including one a front end has never seen, so it
needs no table of step names. Absent on success.
On failure, the verdict’s rerunSafe: whether starting the
install again is safe after the step that failed. On
success, whether running firstboot again over this finished
install is known to be safe: true for a single node, false for a
cluster’s first node (not proven).
The verdict’s rerunReason. Present on failure.
The verdict’s recovery (CLI text; a browser front end shows
recoveryActions). Present on failure when a re-run is not safe.
What a person can do after a failure whose re-run is not safe, in
the order to offer it. recovery says the same in one
text for the CLI; a front end renders each action in its own
medium. Present exactly when recovery is.
The verdict’s recheckReadiness: POST /v1/installer/install/recheck-readiness is accepted.
How to reach the cloud from the LAN, from the installed node.yaml and the address the node’s DNS answers on. Present once the install has succeeded.
object
The floating-IP ranges (node.yaml network.floating_ip_cidrs, in network form), each to route via nextHop.
The node’s LAN address, the next hop of every route.
Conditional forwarding: send domain and every name under it to
server, port port. Absent when the node serves no DNS on the LAN
(no LAN address was named or detected).
object
The parent domain (node.yaml dns.parent_domain).
The node’s LAN address, where its authoritative DNS answers.
Always 53.
The hosts-file fallback, for a machine whose resolver cannot forward
a domain: the front-door names, all on one address. Load balancer
and instance names come and go, so they need the DNS forward.
Absent with dns.
object
Per client OS, in this order, linux, linux-networkmanager, macos, windows, then hosts when there is a hosts entry.
object
linux: ip route and a systemd-resolved drop-in.
linux-networkmanager: the route on the NetworkManager connection
that reaches the node, so it survives a reboot, and the same
drop-in. macos: route add and /etc/resolver/<domain>.
windows: route -p add and an NRPT rule
(Add-DnsClientNrptRule), in PowerShell as Administrator.
hosts: the line to add to the hosts file.
A short label, e.g. “macOS”.
Ready to paste: one command per line, with no comment lines (zsh,
the macOS shell, does not take comments typed at its prompt). For
hosts, the line to add to the hosts file.
What a person should know before pasting it, e.g. how long the route lasts.
The install registers no images. Present once the
install has succeeded: “No images are installed. Add images from
Platform > Global Images (Add base images) or upload a qcow2.” (POST /v1/images/upload on
the cloud’s API).
Example
{ "phase": "configuring", "outcome": "none", "adminPasswordState": "initial", "openbaoUnsealFrom": "tpm", "readiness": { "serviceBlocking": [ { "service": "db", "code": "OperatorRecipeNeverBuilt" } ], "settling": { "phase": "settling" } }, "recoveryActions": [ "download-diagnostics" ], "clientSetup": { "snippets": [ { "client": "linux" } ] }}No install code, or the wrong one.
RFC 7807 problem details, the control plane’s shape.
object
Field errors, for INVALID_CONFIG.
object
The structured field (network.floatingIpCidrs[1]); empty for the whole config. For a raw YAML draft, the node.yaml key.
Example generated
{ "type": "example", "title": "example", "status": 1, "detail": "example", "code": "example", "requestId": "example", "errors": [ { "field": "example", "message": "example" } ]}Too many wrong install codes; wait for Retry-After.
RFC 7807 problem details, the control plane’s shape.
object
Field errors, for INVALID_CONFIG.
object
The structured field (network.floatingIpCidrs[1]); empty for the whole config. For a raw YAML draft, the node.yaml key.
Example generated
{ "type": "example", "title": "example", "status": 1, "detail": "example", "code": "example", "requestId": "example", "errors": [ { "field": "example", "message": "example" } ]}Headers
Section titled “Headers”Seconds until the next attempt is considered.
The installer failed to answer.
RFC 7807 problem details, the control plane’s shape.
object
Field errors, for INVALID_CONFIG.
object
The structured field (network.floatingIpCidrs[1]); empty for the whole config. For a raw YAML draft, the node.yaml key.
Example generated
{ "type": "example", "title": "example", "status": 1, "detail": "example", "code": "example", "requestId": "example", "errors": [ { "field": "example", "message": "example" } ]}