CLI and node.yaml

node.yaml is the file the install runs from. The web installer and the structured CLI config both produce it; it can also be written by hand and sent as it is. A hand-written file is validated by the same code, against the machine. A cluster’s first node uses mode: ha-init: see Unattended cluster install.

Keep it, and secrets

During the install, and for 5 minutes after it, stratum-installer config get --yaml prints the exact node.yaml the install wrote. Later, stratumctl admin nodes config <node-id> --out node.yaml downloads it with every secret replaced by <redacted> (the admin password, registry pull credentials, the operator webhook, the release-mirror token, a join token). The installer refuses a secret that still reads <redacted> and names the key: replace the value, or delete the key. The download also carries identity.node_id. To rebuild from files, see Rebuild the cluster from files.

Start from the node’s own draft

The install service starts with a draft built from the machine. Print it as node.yaml, edit, send it back:

stratum-installer config get --yaml > node.yaml
$EDITOR node.yaml
stratum-installer apply -f node.yaml

apply stores the file as the draft, prints the validation and, when it is valid, starts the install and follows it. --no-watch returns once the install has started. -f - reads the file from stdin.

A minimal single-node file

mode: single-node
identity:
  role: hybrid
  self_ip: 192.0.2.10                # the node's own address on its NIC
provider:
  topology: routed-host
  upstream_interface: enp1s0         # the NIC's name, from `stratum-installer hardware`
network:
  default_vpc_cidr: 172.31.0.0/16
  floating_ip_cidrs:
    - 198.51.100.0/24                # a free LAN range, routed to the node
storage:                             # optional: data disks
  compute_pools:
    - name: fast
      disk: /dev/disk/by-id/nvme-EXAMPLE_B
      storage_class: nvme            # optional; defaults to the pool's name
  force_wipe: true                   # only when a listed disk holds data
iam:
  admin_email: admin@example.com
cluster:
  region: local-1
dns:
  parent_domain: cloud.example.com
  upstream_servers: [192.0.2.53]     # optional
time:
  ntp_servers: [ntp.example.com]     # optional
services:                            # optional: services to start switched off
  disabled:
    - client-vpn
dev_mode: false                      # optional; a single node defaults to true
upgrades:                            # optional
  mirror_url: https://mirror.example.com   # "" switches the update check off
host_reservation:                    # optional; default is computed from the machine
  vcpus: 4
  memory_mib: 12288

self_ip must be one of the node’s addresses and upstream_interface one of its NICs. The install registers no images, and a file that lists images is refused: add them afterwards. dev_mode publishes the platform’s web UIs on the node’s loopback and shows root credentials to admins; set it to false outside a lab. On a node installed with the whole disk layout, add storage.os_disk_layout: whole-disk and at least one entry under storage.compute_pools.

MD arrays

storage:
  md_arrays:
    - name: md-data0
      level: 1                       # 1, 10 or 0
      members: [/dev/disk/by-id/nvme-EXAMPLE_D, /dev/disk/by-id/nvme-EXAMPLE_E]
  compute_pools:
    - name: fast
      disk: /dev/md/md-data0

Structured config and node.yaml keys

Structured config (config set)	node.yaml
mode	mode
region	cluster.region
admin.email	iam.admin_email
dns.parentDomain	dns.parent_domain
dns.lanAddress	identity.self_ip
dns.upstreamServers	dns.upstream_servers
dns.upstreamFallback	dns.upstream_fallback
network.uplinkInterface	provider.upstream_interface
network.floatingIpCidrs	network.floating_ip_cidrs
network.defaultVpcCidr	network.default_vpc_cidr
storage.disks[] (use: compute)	storage.compute_pools[]
storage.mdArrays[]	storage.md_arrays[]
storage.wipeConfirm	storage.force_wipe: true
time.ntpServers	time.ntp_servers
services (false entries)	services.disabled
advanced.devMode	dev_mode
advanced.upgradesMirrorUrl	upgrades.mirror_url
advanced.releaseToken	upgrades.release_token
hostReservation	host_reservation (vcpus, memory_mib)

Commands

Command	Does
status	The phase, whether the draft is valid, what blocks an install, and the next command.
hardware	The CPU, memory, disks (with by-id names and whether each can be a data disk), NICs and devices.
options	Install modes, limits, base images, the suggested floating IP range and NTP servers.
config get [--yaml]	The draft, its storage plan and validation; --yaml prints the node.yaml.
config set -f FILE	Replace the draft with a structured config (JSON).
validate [-f FILE]	Validate a structured config file, or the stored draft.
apply -f node.yaml	Send a whole node.yaml, then install and follow.
install [--no-watch] [--revision N] [--unsafe-rerun]	Install from the draft and follow. It sends the draft’s revision as If-Match, so a draft changed in between is refused.
recheck-readiness [--no-watch]	After an install that finished but was not READY in time, wait for READY again without installing.
diagnostics [-o FILE]	Download the support bundle: logs, events, report, the node.yaml with secrets removed, hardware and journal.
watch [--logs]	Follow the install, replaying what already happened.
report	The outcome: sign-in, images, readiness, next steps; or the failure.
client-setup	The LAN route and DNS forward, with commands for Linux, macOS and Windows.

Every command takes --target, --code and --fingerprint, or the STRATUM_INSTALLER_TARGET, STRATUM_INSTALLER_CODE and STRATUM_INSTALLER_FINGERPRINT variables: both are current, and a flag wins over its variable. --insecure skips the certificate check instead of pinning it. Every command also takes -o json or -o yaml. With -o json, install, apply and watch print the event stream, one JSON event per line.

Exit codes: 0 done or valid, 1 unreachable, refused or failed, 2 input refused (a missing flag, an unreadable file, an invalid config).

Install over plain HTTP calls

The API is under /v1/installer and every call carries Authorization: Install-Code <code>. curl cannot pin a fingerprint, but it can trust the certificate once it has been compared with the console:

NODE=192.0.2.10
openssl s_client -connect $NODE:9443 </dev/null 2>/dev/null | openssl x509 -out installer.pem
openssl x509 -in installer.pem -noout -fingerprint -sha256    # compare with the console
H="Authorization: Install-Code 7Q4M-2KXD"

curl -s --cacert installer.pem -H "$H" -X PUT -H 'Content-Type: application/yaml' \
  --data-binary @node.yaml https://$NODE:9443/v1/installer/config.yaml
curl -s --cacert installer.pem -H "$H" -X POST https://$NODE:9443/v1/installer/install
curl -sN --cacert installer.pem -H "$H" https://$NODE:9443/v1/installer/install/events