stratumctl admin cluster

Cluster-level administration (bootstrap-admin only)

stratumctl admin cluster [flags]

Subcommands

• stratumctl admin cluster members: Inspect and change which nodes are cluster members
• stratumctl admin cluster shutdown: Shut the whole cluster down; it recovers by itself when it boots

stratumctl admin cluster members

Inspect and change which nodes are cluster members

stratumctl admin cluster members [flags]

Cluster membership decides node-to-node transport access.

The node-transport listener — cold migration, console relay, session relay accepts a peer only if its certificate is signed by the cluster CA AND its node id is a current member. Decommissioning a node is therefore the revocation mechanism: it is what stops a wiped, retired or stolen node from continuing to authenticate with a certificate that may be valid for another year.

Membership is seeded from the install’s declared topology and changed only through these commands. Records are never deleted, only decommissioned, so a refusal can always be explained rather than merely observed.

Subcommands

• stratumctl admin cluster members decommission: Revoke a node’s membership, and with it its transport access
• stratumctl admin cluster members list: List cluster members, including decommissioned ones
• stratumctl admin cluster members readmit: Return a decommissioned node to active membership

stratumctl admin cluster members decommission

Revoke a node’s membership, and with it its transport access

stratumctl admin cluster members decommission <node-id> [flags]

Revoke a node’s cluster membership.

This is a security operation, not a bookkeeping one: the node’s certificate stays cryptographically valid, and this is what stops it being accepted. Take it when a node is wiped, retired, or believed compromised.

–reason is required. Six months later the only other record is a node id that stopped working, which explains nothing.

The control plane refuses to leave a multi-node cluster with fewer than two active members, because the raft services (Patroni, OpenBao, OVN) need a majority of the active set and losing quorum is not a state you recover from by waiting. There is no guard against decommissioning the node you are talking to: requests arrive through the HA VIP, so which node serves a call is arbitrary.

Decommissioning revokes transport access and takes the node out of the peer set. It does NOT take the node out of the Postgres, OpenBao or OVN rafts: the cluster does that automatically only for a join that failed. The raft membership of a dead or removed node is not cleaned up for you.

Reversible with ‘readmit’, which restores transport access and nothing else.

Examples

stratumctl admin cluster members decommission n-AbCd1234 --reason "hardware retired"

Flags

Flag	Type	Default	Description
--reason	string		Why this node is being removed (required, recorded and audited)

stratumctl admin cluster members list

List cluster members, including decommissioned ones

stratumctl admin cluster members list [flags]

List every membership record.

Decommissioned nodes are shown deliberately: those rows are the audit trail, and they are what turns “this peer was refused” into “this peer was decommissioned by <actor> on <date> because <reason>”.

Examples

stratumctl admin cluster members list
stratumctl admin cluster members list --output json

stratumctl admin cluster members readmit

Return a decommissioned node to active membership

stratumctl admin cluster members readmit <node-id> [flags]

Return a decommissioned node to active membership, restoring its transport access.

Explicit by design. Re-running an install or restarting the control plane re-asserts the seeded topology, and that seed deliberately never resurrects a decommissioned node — a revocation silently undone by a restart would be the worst behavior this could have.

Examples

stratumctl admin cluster members readmit n-AbCd1234

stratumctl admin cluster shutdown

Shut the whole cluster down; it recovers by itself when it boots

stratumctl admin cluster shutdown [flags]

Shut the whole cluster down.

The control plane:

1. sets the Ceph flags noout, norebalance, nobackfill and norecover (when
   the cluster has Ceph), so nothing is marked out or moved meanwhile;
2. stops every running instance, keeping its desired state;
3. powers every node off, the one it runs on last.

With –prepare-only it stops after step 2 and you power the nodes off.

When the nodes boot again the cluster waits for every node and OSD, clears the flags it set, and the instances start. Follow it with ‘stratumctl admin cluster shutdown status’. Before the nodes power off, ‘stratumctl admin cluster shutdown cancel’ undoes it.

You confirm by typing the cluster id, or pass it with –confirm.

Examples

stratumctl admin cluster shutdown --reason "planned power maintenance"
stratumctl admin cluster shutdown --reason "planned power maintenance" --confirm cl-5byupirp
stratumctl admin cluster shutdown --reason "planned power maintenance" --prepare-only

Flags

Flag	Type	Default	Description
--confirm	string		The cluster id, to confirm without a prompt
--prepare-only	bool	false	Stop the instances and set the Ceph flags, but leave powering the nodes off to you
--reason	string		Why (recorded and audited)

Subcommands

• stratumctl admin cluster shutdown cancel: Cancel a shutdown before the nodes power off; the instances start again
• stratumctl admin cluster shutdown status: Show the cluster shutdown and how far it got

stratumctl admin cluster shutdown cancel

Cancel a shutdown before the nodes power off; the instances start again

stratumctl admin cluster shutdown cancel [flags]

Examples

stratumctl admin cluster shutdown cancel

stratumctl admin cluster shutdown status

Show the cluster shutdown and how far it got

stratumctl admin cluster shutdown status [flags]

Examples

stratumctl admin cluster shutdown status