Create a VPC.
curl --request POST \ --url https://stratum.example.com/v1/projects/example/network/vpcs \ --header 'Authorization: Bearer <token>' \ --header 'Content-Type: application/json' \ --data '{ "name": "example", "displayName": "example", "description": "example", "cidrBlock": "10.0.0.0/16", "region": "example", "internetGateway": true, "dnsHostnames": true, "dnsResolution": true, "tags": { "additionalProperty": "example" } }'Returns 202 Accepted with the VPC in state creating. The
async lifecycle worker transitions the VPC to available
(success) or error (driver failure) typically within a
second. CIDR is immutable.
Authorizations
Section titled “Authorizations”Parameters
Section titled “Parameters”Path Parameters
Section titled “Path Parameters”Request Bodyrequired
Section titled “Request Bodyrequired”object
RFC 1918 CIDR block, /16 to /28. Immutable after create. When omitted the next free /16 of 10.0.0.0/8 for this project is
assigned and recorded as if chosen — free means overlapping none of
the reserved infrastructure ranges nor this project’s own VPCs,
subnets and floating-IP pools (GET.../network/reserved-cidrs
shows the set). A block that overlaps a reserved range is refused
with 400 RESERVED_CIDR; one that overlaps another VPC of the SAME
project with 409 CIDR_OVERLAP (the detail names the sibling and the
next free block). The same block in another project is allowed, as
in AWS. 409 NO_FREE_CIDR when 10.0.0.0/8 has no free /16 left for
the project.
Example
10.0.0.0/16When omitted, the install’s default region is used.
Defaults to true: the common case is a VPC that wants
public in/out, and a floating IP cannot be associated without an
IGW. Pass internetGateway: false to create a private (IGW-off)
VPC explicitly. When enabled, the VPC gets an external LRP, a
default route to the upstream, and a transit IP. Stratum at v1 also
installs an implicit SNAT so every VM in the VPC reaches the
internet without holding a floating IP — this differs from AWS
(where a NAT Gateway is required for non-EIP outbound). See
docs/operator/09-reference/aws-semantic-deltas.md.
AWS-shape resource tags. Freeform UTF-8 keys (1-128 bytes, no
leading/trailing whitespace) mapped to freeform UTF-8 values
(0-256 bytes). Max 50 tags per resource. Reserved prefixes
(stratum.dev/, stratum.platform_health., stratum:,
aws:) return 400 RESERVED_NAMESPACE on customer input.
PATCH replaces the whole map..
object
Responses
Section titled “Responses”Accepted.
object
Set on a platform-owned row; absent on a tenant’s own.
object
The owner: the Auto Scaling group id, or for platform the component (front-door, pack:platform-health, default-network, operator-recipe).
Canonical Stratum ARN for this VPC, for resource-policy targeting.
RFC 1918 CIDR block; /16 to /28; immutable.
Additional IPv4 CIDR blocks associated with the VPC. Subnets may carve from the primary or any
secondary block. Managed via the
/actions/associate-cidr-block +
/actions/disassociate-cidr-block endpoints.
Associated DHCP option set; empty means the
built-in defaults. Managed via
/actions/associate-dhcp-options.
When true, the VPC’s logical router gets an external port + default
0.0.0.0/0 route to the upstream and a transit IP allocated from the
FIP pool. Inbound reachability requires a floating IP attached to a
NIC. Outbound differs from AWS. Stratum at v1 also installs an
implicit-SNAT rule on the LR (source = the VPC CIDR, snat-to = the
transit IP), so every VM in the VPC reaches the internet whether
or not it has a floating IP — AWS would require a NAT Gateway for
that. documents the delta + the 2.0 plan to
restore AWS-strict semantics via the explicit NATGateway
resource. Operators building isolation on “no FIP = no internet”
must keep this flag false.
Per-VPC transit-network IP allocated by the lifecycle worker when the OVN external LRP is wired. Empty means the LRP isn’t wired yet (desired but not yet converged) or the VPC has no IGW.
AWS-shape resource tags. Freeform UTF-8 keys (1-128 bytes, no
leading/trailing whitespace) mapped to freeform UTF-8 values
(0-256 bytes). Max 50 tags per resource. Reserved prefixes
(stratum.dev/, stratum.platform_health., stratum:,
aws:) return 400 RESERVED_NAMESPACE on customer input.
PATCH replaces the whole map..
object
The VPC resolver’s address on each available subnet, ordered by subnet id. Empty when no resolver answers in this VPC: DNS resolution is off, or the install runs no per-VPC resolver.
The VPC resolver’s address on one subnet: the subnet’s .3, which DHCP hands instances as their DNS server and which forwards to the VPC’s recursor.
object
The subnet’s .3.
Example
{ "ownedBy": { "kind": "auto-scaling-group" }, "cidrBlock": "10.0.0.0/16", "state": "creating", "resolverAddresses": [ { "address": "10.0.1.3" } ]}Bad request.
object
The findings of a rejected IAM policy document (custom and resource policies).
One finding of a rejected IAM policy document. A rejection lists every finding, so the author fixes the document in one round trip.
object
The finding, e.g. INVALID_DOCUMENT, UNKNOWN_ACTION, ACTION_NOT_APPLICABLE.
Index of the statement at fault; -1 for the document as a whole.
The offending action, where one is at fault (ACTION_NOT_APPLICABLE).
Field errors, for codes that carry them: each problem at its field
(see FieldError). Documented on the responses that set it, e.g.
approveNodeJoin’s INVALID_INPUT and JOIN_APPROVAL_REFUSED.
Absent otherwise.
One field’s problem, the stage-2 installer API’s shape.
field is the field’s path, message what is wrong with it.
object
The field’s path, e.g. links[0].interface, disks[1].confirm,
mgmt.address or role; empty for the whole request.
Structured facts about the refusal, for codes that carry them. The
shape is fixed per code and documented on the response that answers
it, e.g. IMAGE_POOL_MISMATCH (see ImagePoolMismatchDetails) and
IMAGE_IN_USE. Absent for codes that carry none.
object
Example
{ "issues": [ { "code": "ACTION_NOT_APPLICABLE", "action": "compute:CreateVpc" } ]}Authenticated but not authorized.
object
The findings of a rejected IAM policy document (custom and resource policies).
One finding of a rejected IAM policy document. A rejection lists every finding, so the author fixes the document in one round trip.
object
The finding, e.g. INVALID_DOCUMENT, UNKNOWN_ACTION, ACTION_NOT_APPLICABLE.
Index of the statement at fault; -1 for the document as a whole.
The offending action, where one is at fault (ACTION_NOT_APPLICABLE).
Field errors, for codes that carry them: each problem at its field
(see FieldError). Documented on the responses that set it, e.g.
approveNodeJoin’s INVALID_INPUT and JOIN_APPROVAL_REFUSED.
Absent otherwise.
One field’s problem, the stage-2 installer API’s shape.
field is the field’s path, message what is wrong with it.
object
The field’s path, e.g. links[0].interface, disks[1].confirm,
mgmt.address or role; empty for the whole request.
Structured facts about the refusal, for codes that carry them. The
shape is fixed per code and documented on the response that answers
it, e.g. IMAGE_POOL_MISMATCH (see ImagePoolMismatchDetails) and
IMAGE_IN_USE. Absent for codes that carry none.
object
Example
{ "issues": [ { "code": "ACTION_NOT_APPLICABLE", "action": "compute:CreateVpc" } ]}Conflicting state.
object
The findings of a rejected IAM policy document (custom and resource policies).
One finding of a rejected IAM policy document. A rejection lists every finding, so the author fixes the document in one round trip.
object
The finding, e.g. INVALID_DOCUMENT, UNKNOWN_ACTION, ACTION_NOT_APPLICABLE.
Index of the statement at fault; -1 for the document as a whole.
The offending action, where one is at fault (ACTION_NOT_APPLICABLE).
Field errors, for codes that carry them: each problem at its field
(see FieldError). Documented on the responses that set it, e.g.
approveNodeJoin’s INVALID_INPUT and JOIN_APPROVAL_REFUSED.
Absent otherwise.
One field’s problem, the stage-2 installer API’s shape.
field is the field’s path, message what is wrong with it.
object
The field’s path, e.g. links[0].interface, disks[1].confirm,
mgmt.address or role; empty for the whole request.
Structured facts about the refusal, for codes that carry them. The
shape is fixed per code and documented on the response that answers
it, e.g. IMAGE_POOL_MISMATCH (see ImagePoolMismatchDetails) and
IMAGE_IN_USE. Absent for codes that carry none.
object
Example
{ "issues": [ { "code": "ACTION_NOT_APPLICABLE", "action": "compute:CreateVpc" } ]}Per-project quota exceeded.
object
The findings of a rejected IAM policy document (custom and resource policies).
One finding of a rejected IAM policy document. A rejection lists every finding, so the author fixes the document in one round trip.
object
The finding, e.g. INVALID_DOCUMENT, UNKNOWN_ACTION, ACTION_NOT_APPLICABLE.
Index of the statement at fault; -1 for the document as a whole.
The offending action, where one is at fault (ACTION_NOT_APPLICABLE).
Field errors, for codes that carry them: each problem at its field
(see FieldError). Documented on the responses that set it, e.g.
approveNodeJoin’s INVALID_INPUT and JOIN_APPROVAL_REFUSED.
Absent otherwise.
One field’s problem, the stage-2 installer API’s shape.
field is the field’s path, message what is wrong with it.
object
The field’s path, e.g. links[0].interface, disks[1].confirm,
mgmt.address or role; empty for the whole request.
Structured facts about the refusal, for codes that carry them. The
shape is fixed per code and documented on the response that answers
it, e.g. IMAGE_POOL_MISMATCH (see ImagePoolMismatchDetails) and
IMAGE_IN_USE. Absent for codes that carry none.
object
Example
{ "issues": [ { "code": "ACTION_NOT_APPLICABLE", "action": "compute:CreateVpc" } ]}