The cluster's formation and networks.
curl --request GET \ --url https://stratum.example.com/v1/admin/cluster/networks \ --header 'Authorization: Bearer <token>'. What the founder chose about the
cluster as a whole in the stage-2 installer: its name, the planned
control-plane size, the networks per purpose (CIDR, VLAN, MTU), the
provider VLAN, and the six VIPs. Recorded once, at the founder’s first
start. A node that joins takes its addresses from these networks. The
MTU of storage and overlay can change later
(PUT /v1/admin/cluster/networks/{purpose}/mtu).
On a single node, and on a cluster installed before the formation was
recorded, networks is empty and the planned size is the default, 3.
Install-scope; gates on cluster:DescribeMembers.
Authorizations
Section titled “Authorizations”Responses
Section titled “Responses”The formation.
A cluster’s formation: what its founder chose for the cluster as a whole.
object
The cluster’s name (node.yaml cluster.name). Absent when none was given.
The planned number of control-plane members (node.yaml
cluster.planned_size). It drives the formation findings; nothing is
rendered from it. It is the install-time plan, not a cap: a cluster
takes joiners up to 5 control-plane nodes.
The networks per purpose, in the order mgmt, storage, overlay. A purpose with no network rides mgmt.
One purpose’s network.
object
The 802.1Q tag; 0 is untagged.
The least MTU a link carrying it must have. Absent for the default.
The VLAN the VM uplink trunks (node.yaml provider.vlan); 0 is untagged.
How VM traffic leaves the cluster (node.yaml provider.topology,
). bridged: a NIC, or a VLAN on a trunk, carries the
floating-IP network on every node, and the switch and router serve the
floating range on it. routed-host: no provider VLAN; the nodes route
the floating IPs and the LAN router needs a static route for each
floating range via floatingIpNextHop.
Every joiner inherits it. Inferred as bridged from a non-zero
providerVlan on a formation recorded before it; absent when the
cluster records no provider at all.
The founder’s provider NIC by name (node.yaml
provider.upstream_interface): the trunk the VLAN rides, or the
untagged NIC. Absent when the founder did not name one. A joiner’s
uplink follows providerUpstreamPurpose; the name is used only when
that is absent.
What the founder’s uplink is: mgmt, its management NIC, or
provider, a link it maps provider to. NIC names differ per machine, so
a joiner’s uplink defaults to its own NIC of that purpose: its mgmt NIC,
or the link its approval maps provider to. Absent when unknown (a
formation recorded before it): the joiner’s NIC of the founder’s name.
Where each VPC router’s provider-side address comes from (node.yaml
network.transit_cidr), the same on every member: a joiner is
installed with the founder’s. On a bridged cluster it is the
floating-IP range unless the founder named another, so the VPC routers
sit beside the floating IPs behind the one router address the operator
serves there. Absent on a formation recorded before until the
founder’s control plane fills it.
The VPC routers’ next hop on the provider network (node.yaml
network.provider_gateway_ip). Absent: the first address of
transitCidr.
Routed-host only: the address the LAN
router routes every floating-IP range to, the provider gateway VIP
(vips.providerGw). It follows the node whose chassis holds the VPC
gateways, so the floating IPs survive the loss of any one node. Absent
on a bridged cluster, a single node, and a routed cluster formed
without the VIP (its floating IPs route to the founder’s address).
The service VIPs, on the mgmt network. Absent on a single node.
object
The routed-host floating-IP next hop (node.yaml
cluster.vips.provider_gw,). Absent on a bridged cluster
and on a routed cluster formed without it.
When the founder’s control plane recorded the formation. Absent when it never did.
Example
{ "name": "lab", "plannedControlPlaneSize": 3, "networks": [ { "purpose": "mgmt", "cidr": "192.0.2.0/24", "mtu": 9000 } ], "providerTopology": "bridged", "providerUpstreamInterface": "enp1s0", "providerUpstreamPurpose": "mgmt", "transitCidr": "192.0.2.0/24", "floatingIpNextHop": "192.0.2.246"}Authenticated but not authorized.
object
The findings of a rejected IAM policy document (custom and resource policies).
One finding of a rejected IAM policy document. A rejection lists every finding, so the author fixes the document in one round trip.
object
The finding, e.g. INVALID_DOCUMENT, UNKNOWN_ACTION, ACTION_NOT_APPLICABLE.
Index of the statement at fault; -1 for the document as a whole.
The offending action, where one is at fault (ACTION_NOT_APPLICABLE).
Field errors, for codes that carry them: each problem at its field
(see FieldError). Documented on the responses that set it, e.g.
approveNodeJoin’s INVALID_INPUT and JOIN_APPROVAL_REFUSED.
Absent otherwise.
One field’s problem, the stage-2 installer API’s shape.
field is the field’s path, message what is wrong with it.
object
The field’s path, e.g. links[0].interface, disks[1].confirm,
mgmt.address or role; empty for the whole request.
Structured facts about the refusal, for codes that carry them. The
shape is fixed per code and documented on the response that answers
it, e.g. IMAGE_POOL_MISMATCH (see ImagePoolMismatchDetails) and
IMAGE_IN_USE. Absent for codes that carry none.
object
Example
{ "issues": [ { "code": "ACTION_NOT_APPLICABLE", "action": "compute:CreateVpc" } ]}