Skip to content
StratumStratum Docs

Decommission a node — this REVOKES its transport access.

POST
/v1/admin/cluster/members/{nodeId}/decommission
Code sample: Shell / cURL
curl --request POST \
  --url https://stratum.example.com/v1/admin/cluster/members/example/decommission \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{ "reason": "returned to vendor" }'

. This is the revocation mechanism. The node-transport listener (cold migration, console relay, session relay) refuses a decommissioned node even though its certificate remains valid and cluster-signed, which is what closes the exposure of a removed node keeping a working credential for the remaining life of its leaf — up to a year, with no CRL and no OCSP.

The record is kept, not deleted: a refusal can then say who revoked the node, when, and why.

Refused (409) when it would break the cluster, because a wrong call here partitions it: it will not leave fewer than two active members on a multi-node cluster, since losing quorum is not a state you recover from by waiting. A single-node install is exempt, or its only node could never be retired. There is no “a node cannot decommission itself” guard: requests arrive through the HA VIP, so which node serves a call is arbitrary, and a guard keyed on it made the same request succeed or fail depending on routing. Decommissioning the node you are talking to is allowed, and is undone by readmit from any node.

A reason is required. An unexplained revocation is nearly useless six months later, when the only record is a node id that stopped working.

What this does, and what it does not. Decommissioning changes the member’s state to decommissioned, which (a) makes the node-transport listener refuse it and (b) takes it out of the peer set (only joining and active members are rendered into peer lists). Enforcement is the node transport only: Postgres/Patroni, OpenBao and OVN authenticate on the same leaf and do not consult membership. It does NOT remove the node from the Postgres, OpenBao or OVN rafts. The cluster takes a node out of those rafts automatically only for a FAILED JOIN (a join that did not finish); a decommissioned member, and a dead or removed node, are not cleaned up automatically. Remove a dead node’s raft membership separately (see the raft recovery guide), and wipe or power off a node you retire. See.

Gates on cluster:DecommissionMember.

Authorizations

Section titled “Authorizations”

Parameters

Section titled “Parameters”

Path Parameters

Section titled “Path Parameters”
nodeId
required
string

Request Bodyrequired

Section titled “Request Bodyrequired”
Media typeapplication/json
object
reason
required

Why this node is being removed. Recorded and audited.

string

Example 

returned to vendor

Responses

Section titled “Responses”

200

Section titled “200”

The node is decommissioned and will be refused at the transport.

Media typeapplication/json

A node’s cluster membership.

Membership is the cluster’s topology: every peer list a node renders (Patroni, OpenBao and OVN raft peers, keepalived priorities, vmstorage nodes, Alertmanager peers) is derived from the members in joining or active, by a per-node reconciler, and every change bumps the membership generation.

Membership also decides transport access: the node-transport listener refuses a peer that is not a member, even when its certificate is valid and cluster-signed. Decommissioning a node IS how you revoke it — there is no CRL.

Records are never deleted, only moved to decommissioned, so a refusal can say who revoked the node, when, and why.

object
nodeId
required
string
state
required

joining: admitted and installing (already in every peer list); active; failed: a join that did not finish (out of every peer list, taken back out of every raft it reached); removing; decommissioned.

string
Allowed values: joining active failed removing decommissioned
name
string
role

The node role.

string
mgmtIp

The management address every peer list names.

string
networks

Optional storage/overlay bindings, keyed by traffic class.

object
key
additional properties
object
ip
required
string
interface
string
labels

Declared labels; topology.rack is the rack.

object
key
additional properties
string
rack

The declared rack (labels["topology.rack"]).

string
az
string
joinOrder

Orders every peer list and the keepalived priorities (1 = the founder).

integer
appliedGeneration

The membership generation this node reports it has rendered and applied (its own report). A member below the cluster’s generation is lagging.

integer format: int64
appliedAt
string format: date-time
nullable
failedStep

The join step a failed member stopped in.

string
failedError

The last error line of that step.

string
raftCleanupAt

When a failed member was taken back out of every raft it reached.

string format: date-time
nullable
reason

Why the node was decommissioned. Required when decommissioning.

string
decommissionedBy

Who decommissioned it — a user id, or stratum-installer for membership the install declared.

string
decommissionedAt
string format: date-time
nullable
createdAt
string format: date-time
updatedAt
string format: date-time

Example 

{
  "nodeId": "n-msst0002",
  "state": "joining",
  "role": "hybrid",
  "mgmtIp": "192.0.2.12"
}

400

Section titled “400”

Bad request.

Media typeapplication/problem+json
object
type
required
string format: uri
title
required
string
status
required
integer
>= 400 <= 599
detail
string
instance
string format: uri-reference
requestId
required
string
code
required
string
issues

The findings of a rejected IAM policy document (custom and resource policies).

Array<object>

One finding of a rejected IAM policy document. A rejection lists every finding, so the author fixes the document in one round trip.

object
code
required

The finding, e.g. INVALID_DOCUMENT, UNKNOWN_ACTION, ACTION_NOT_APPLICABLE.

string
statement
required

Index of the statement at fault; -1 for the document as a whole.

integer
>= -1
detail
required
string
action

The offending action, where one is at fault (ACTION_NOT_APPLICABLE).

string
errors

Field errors, for codes that carry them: each problem at its field (see FieldError). Documented on the responses that set it, e.g. approveNodeJoin’s INVALID_INPUT and JOIN_APPROVAL_REFUSED. Absent otherwise.

Array<object>

One field’s problem, the stage-2 installer API’s shape. field is the field’s path, message what is wrong with it.

object
field
required

The field’s path, e.g. links[0].interface, disks[1].confirm, mgmt.address or role; empty for the whole request.

string
message
required
string
details

Structured facts about the refusal, for codes that carry them. The shape is fixed per code and documented on the response that answers it, e.g. IMAGE_POOL_MISMATCH (see ImagePoolMismatchDetails) and IMAGE_IN_USE. Absent for codes that carry none.

object
key
additional properties
any

Example 

{
  "issues": [
    {
      "code": "ACTION_NOT_APPLICABLE",
      "action": "compute:CreateVpc"
    }
  ]
}

403

Section titled “403”

Authenticated but not authorized.

Media typeapplication/problem+json
object
type
required
string format: uri
title
required
string
status
required
integer
>= 400 <= 599
detail
string
instance
string format: uri-reference
requestId
required
string
code
required
string
issues

The findings of a rejected IAM policy document (custom and resource policies).

Array<object>

One finding of a rejected IAM policy document. A rejection lists every finding, so the author fixes the document in one round trip.

object
code
required

The finding, e.g. INVALID_DOCUMENT, UNKNOWN_ACTION, ACTION_NOT_APPLICABLE.

string
statement
required

Index of the statement at fault; -1 for the document as a whole.

integer
>= -1
detail
required
string
action

The offending action, where one is at fault (ACTION_NOT_APPLICABLE).

string
errors

Field errors, for codes that carry them: each problem at its field (see FieldError). Documented on the responses that set it, e.g. approveNodeJoin’s INVALID_INPUT and JOIN_APPROVAL_REFUSED. Absent otherwise.

Array<object>

One field’s problem, the stage-2 installer API’s shape. field is the field’s path, message what is wrong with it.

object
field
required

The field’s path, e.g. links[0].interface, disks[1].confirm, mgmt.address or role; empty for the whole request.

string
message
required
string
details

Structured facts about the refusal, for codes that carry them. The shape is fixed per code and documented on the response that answers it, e.g. IMAGE_POOL_MISMATCH (see ImagePoolMismatchDetails) and IMAGE_IN_USE. Absent for codes that carry none.

object
key
additional properties
any

Example 

{
  "issues": [
    {
      "code": "ACTION_NOT_APPLICABLE",
      "action": "compute:CreateVpc"
    }
  ]
}

404

Section titled “404”

Resource not found.

Media typeapplication/problem+json
object
type
required
string format: uri
title
required
string
status
required
integer
>= 400 <= 599
detail
string
instance
string format: uri-reference
requestId
required
string
code
required
string
issues

The findings of a rejected IAM policy document (custom and resource policies).

Array<object>

One finding of a rejected IAM policy document. A rejection lists every finding, so the author fixes the document in one round trip.

object
code
required

The finding, e.g. INVALID_DOCUMENT, UNKNOWN_ACTION, ACTION_NOT_APPLICABLE.

string
statement
required

Index of the statement at fault; -1 for the document as a whole.

integer
>= -1
detail
required
string
action

The offending action, where one is at fault (ACTION_NOT_APPLICABLE).

string
errors

Field errors, for codes that carry them: each problem at its field (see FieldError). Documented on the responses that set it, e.g. approveNodeJoin’s INVALID_INPUT and JOIN_APPROVAL_REFUSED. Absent otherwise.

Array<object>

One field’s problem, the stage-2 installer API’s shape. field is the field’s path, message what is wrong with it.

object
field
required

The field’s path, e.g. links[0].interface, disks[1].confirm, mgmt.address or role; empty for the whole request.

string
message
required
string
details

Structured facts about the refusal, for codes that carry them. The shape is fixed per code and documented on the response that answers it, e.g. IMAGE_POOL_MISMATCH (see ImagePoolMismatchDetails) and IMAGE_IN_USE. Absent for codes that carry none.

object
key
additional properties
any

Example 

{
  "issues": [
    {
      "code": "ACTION_NOT_APPLICABLE",
      "action": "compute:CreateVpc"
    }
  ]
}

409

Section titled “409”

Conflicting state.

Media typeapplication/problem+json
object
type
required
string format: uri
title
required
string
status
required
integer
>= 400 <= 599
detail
string
instance
string format: uri-reference
requestId
required
string
code
required
string
issues

The findings of a rejected IAM policy document (custom and resource policies).

Array<object>

One finding of a rejected IAM policy document. A rejection lists every finding, so the author fixes the document in one round trip.

object
code
required

The finding, e.g. INVALID_DOCUMENT, UNKNOWN_ACTION, ACTION_NOT_APPLICABLE.

string
statement
required

Index of the statement at fault; -1 for the document as a whole.

integer
>= -1
detail
required
string
action

The offending action, where one is at fault (ACTION_NOT_APPLICABLE).

string
errors

Field errors, for codes that carry them: each problem at its field (see FieldError). Documented on the responses that set it, e.g. approveNodeJoin’s INVALID_INPUT and JOIN_APPROVAL_REFUSED. Absent otherwise.

Array<object>

One field’s problem, the stage-2 installer API’s shape. field is the field’s path, message what is wrong with it.

object
field
required

The field’s path, e.g. links[0].interface, disks[1].confirm, mgmt.address or role; empty for the whole request.

string
message
required
string
details

Structured facts about the refusal, for codes that carry them. The shape is fixed per code and documented on the response that answers it, e.g. IMAGE_POOL_MISMATCH (see ImagePoolMismatchDetails) and IMAGE_IN_USE. Absent for codes that carry none.

object
key
additional properties
any

Example 

{
  "issues": [
    {
      "code": "ACTION_NOT_APPLICABLE",
      "action": "compute:CreateVpc"
    }
  ]
}