What every node runs, and where the nodes differ.
curl --request GET \ --url https://stratum.example.com/v1/admin/upgrades/release \ --header 'Authorization: Bearer <token>'Each node’s release as its own control plane recorded it: the OS deployments (booted, staged, rollback) on an image-mode node, os-release and the kernel, the host packages and system extensions, the host binaries, the control plane’s build and schema levels, and every container image against the pins of that control plane.
summary.skew lists each field whose value differs between the nodes
that reported recently. summary.drift lists what a node runs other
than its own release says (an image that is not its pin, stale host
binaries, a staged deployment) and nodes whose record is missing or
older than ten minutes. Install-scope; gates on
upgrade:DescribeRelease.
Authorizations
Section titled “Authorizations”Responses
Section titled “Responses”The cluster’s release set.
The cluster’s release set: every node’s release, and where the nodes
differ from each other (skew) or from their own release (drift).
object
The node whose control plane answered.
A control plane’s build and schema levels.
object
The newest database migration this build carries. Absent when not known.
The oldest schema level whose control plane still runs against this build’s schema.
The database’s schema level, above schemaLevel when this build runs against a newer one.
The release the cluster runs: its oldest node’s. Empty when it is not
known. The same value the update check (running), the plan’s version
precheck and /version report.
object
Nodes whose record is at most ten minutes old.
Every node reported, no field differs between nodes, and none drifts from its release.
Each field whose value differs between the reporting nodes.
object
Os, imageMode, kernel, controlPlane, schema, hostBinaries,
extensions, package:
object
A readable form of the value, such as a version for a digest.
What a node runs other than its release says, and nodes that did not report.
object
Report, host, pin:
object
False when the node has never recorded its release.
The record is older than ten minutes.
The release the node runs: the release of the last upgrade that completed on it, else the cluster’s. Its OS image can be older: an upgrade of kind containers or host keeps the OS. Empty when it is not known.
object
When the node’s control plane recorded this.
When the node collected the host facts; null when it has not reported them.
True on a node booted from a stratum-os image; false on a node whose packages come from dnf.
object
The stratum-os release, on an image-mode node.
Identifies the base (kernel, base packages, bootc base). Only a change of it needs a reboot. Empty on an image that predates it.
Identifies the kernel arguments the booted image declares (its bootc kargs.d files). An upgrade whose release declares other ones reboots fully. Empty on a node whose host-helper predates it.
The OS deployments, on an image-mode node.
object
object
The reference the deployment was installed or switched from.
The OS image’s manifest digest.
The image’s version label.
When the image was built, as the image says.
A switch to this deployment can use a soft reboot (the kernel is unchanged).
The deployment the next boot switches to, if one is staged.
object
The reference the deployment was installed or switched from.
The OS image’s manifest digest.
The image’s version label.
When the image was built, as the image says.
A switch to this deployment can use a soft reboot (the kernel is unchanged).
The previous deployment, kept to roll back to.
object
The reference the deployment was installed or switched from.
The OS image’s manifest digest.
The image’s version label.
When the image was built, as the image says.
A switch to this deployment can use a soft reboot (the kernel is unchanged).
A control plane’s build and schema levels.
object
The newest database migration this build carries. Absent when not known.
The oldest schema level whose control plane still runs against this build’s schema.
The database’s schema level, above schemaLevel when this build runs against a newer one.
object
Os-image (they change with the OS image), overlay (switched in live from a release, under /var) or control-plane-image (installed from it).
The commit the binaries share, mixed, or unknown.
The binaries are not the build the node should run (want), or some cannot report their commit.
The commit the binaries should be at: the host binaries of the release the cluster runs on an image-mode node, the control plane’s build on a mutable one. Empty when it is not known, or while an upgrade runs.
object
The system extensions (host packages shipped as signed extensions): every image systemd-sysext finds and every merged one.
object
Merged into /usr now.
The merged extension’s version (its main package’s version-release).
The OS level (SYSEXT_LEVEL) the merged extension is built for.
The release whose extension set the image is linked from.
The image’s dm-verity root hash, as that release’s manifest records it.
The installed host packages Stratum depends on, one per component.
object
Every image this node’s control plane pins, against what runs.
object
The pinned reference. Empty for the control plane’s own image
(state: self): an image cannot embed its own digest, so the
entry it carries names the build before it; running
says what runs.
current: every container of this image runs the pin.
differs: a container runs another image (see running).
absent: nothing of this image runs here, which is normal for an
image the node’s role or the install’s profile does not run.
self: the control plane’s own image, listed in running. Its
pin names the build before it, so it is compared between nodes,
not with the pin.
What runs in place of the pin, or the control plane’s own image (self).
Running containers of this image.
Images running containers use that no pin names.
object
Release payloads loaded onto this node.
object
The payload manifest’s sha256.
What the node keeps under /var/lib/stratum/upgrade; null when it was not read.
object
object
Its fetch finished. A release that is not was interrupted.
The release the node was installed with.
Its manifest and system extensions.
Its stratum-os layout, shared by the releases of one OS.
A directory under /var/lib/stratum/upgrade.
object
Example
{ "controlPlane": { "version": "v0.0.0-4298b2fe", "commit": "4298b2fe" }, "runningRelease": "0.2.0", "summary": { "skew": [ { "field": "controlPlane" } ] }, "nodes": [ { "runningRelease": "0.2.0", "release": { "os": { "prettyName": "Stratum OS v0.0.0-4298b2fe", "id": "almalinux", "versionId": "10.2", "imageVersion": "v0.0.0-4298b2fe", "buildId": "4298b2fe", "kernelArgsDigest": "sha256:5f0e1d7983fa91e8392d2855004148644ca31cb43a5f74a1f7b1a23f4efc161e", "kernel": "6.12.0-211.56.1.el10_2.x86_64" }, "bootc": { "booted": { "image": "registry.example.com/stratum-os:v0.0.0-4298b2fe", "transport": "registry", "digest": "sha256:dbcb96dfa0abfb1869e5b22412fef9b5e096f8bc0ba51451db730710c885eb6a", "version": "v0.0.0-4298b2fe", "architecture": "amd64" }, "staged": { "image": "registry.example.com/stratum-os:v0.0.0-4298b2fe", "transport": "registry", "digest": "sha256:dbcb96dfa0abfb1869e5b22412fef9b5e096f8bc0ba51451db730710c885eb6a", "version": "v0.0.0-4298b2fe", "architecture": "amd64" }, "rollback": { "image": "registry.example.com/stratum-os:v0.0.0-4298b2fe", "transport": "registry", "digest": "sha256:dbcb96dfa0abfb1869e5b22412fef9b5e096f8bc0ba51451db730710c885eb6a", "version": "v0.0.0-4298b2fe", "architecture": "amd64" } }, "controlPlane": { "version": "v0.0.0-4298b2fe", "commit": "4298b2fe" }, "extensions": [ { "name": "stratum-ovs", "version": "3.5.3-5.el10s" } ], "packages": [ { "component": "openvswitch", "name": "openvswitch3.5", "version": "3.5.3-5.el10s" } ], "pins": [ { "name": "stratum-controlplane", "state": "current" } ], "stored": { "leftovers": [ { "path": "os/3f1c0d77" } ] } } } ]}Authenticated but not authorized.
object
The findings of a rejected IAM policy document (custom and resource policies).
One finding of a rejected IAM policy document. A rejection lists every finding, so the author fixes the document in one round trip.
object
The finding, e.g. INVALID_DOCUMENT, UNKNOWN_ACTION, ACTION_NOT_APPLICABLE.
Index of the statement at fault; -1 for the document as a whole.
The offending action, where one is at fault (ACTION_NOT_APPLICABLE).
Field errors, for codes that carry them: each problem at its field
(see FieldError). Documented on the responses that set it, e.g.
approveNodeJoin’s INVALID_INPUT and JOIN_APPROVAL_REFUSED.
Absent otherwise.
One field’s problem, the stage-2 installer API’s shape.
field is the field’s path, message what is wrong with it.
object
The field’s path, e.g. links[0].interface, disks[1].confirm,
mgmt.address or role; empty for the whole request.
Structured facts about the refusal, for codes that carry them. The
shape is fixed per code and documented on the response that answers
it, e.g. IMAGE_POOL_MISMATCH (see ImagePoolMismatchDetails) and
IMAGE_IN_USE. Absent for codes that carry none.
object
Example
{ "issues": [ { "code": "ACTION_NOT_APPLICABLE", "action": "compute:CreateVpc" } ]}Upstream temporarily unavailable (driver / scheduler / dependency).
object
The findings of a rejected IAM policy document (custom and resource policies).
One finding of a rejected IAM policy document. A rejection lists every finding, so the author fixes the document in one round trip.
object
The finding, e.g. INVALID_DOCUMENT, UNKNOWN_ACTION, ACTION_NOT_APPLICABLE.
Index of the statement at fault; -1 for the document as a whole.
The offending action, where one is at fault (ACTION_NOT_APPLICABLE).
Field errors, for codes that carry them: each problem at its field
(see FieldError). Documented on the responses that set it, e.g.
approveNodeJoin’s INVALID_INPUT and JOIN_APPROVAL_REFUSED.
Absent otherwise.
One field’s problem, the stage-2 installer API’s shape.
field is the field’s path, message what is wrong with it.
object
The field’s path, e.g. links[0].interface, disks[1].confirm,
mgmt.address or role; empty for the whole request.
Structured facts about the refusal, for codes that carry them. The
shape is fixed per code and documented on the response that answers
it, e.g. IMAGE_POOL_MISMATCH (see ImagePoolMismatchDetails) and
IMAGE_IN_USE. Absent for codes that carry none.
object
Example
{ "issues": [ { "code": "ACTION_NOT_APPLICABLE", "action": "compute:CreateVpc" } ]}