stratumctl admin

Operator-only commands (install-scope; bootstrap-admin only)

stratumctl admin [flags]

Subcommands

• stratumctl admin doctor: Check substrate component version compatibility
• stratumctl admin readiness: Why this cluster cannot serve yet: capability findings with their fixes
• stratumctl admin selfcheck: Post-install substrate health self-check

stratumctl admin doctor

Check substrate component version compatibility

stratumctl admin doctor [flags]

Fetch the substrate compatibility matrix from the controlplane and report it. Each component’s detected version is checked against the version this Stratum build was tested against, plus cross-component constraints — notably the OVN central / host ovn-controller major.minor match, whose mismatch silently breaks bridged floating-IP traffic.

Exits non-zero when any component or constraint is unsupported, so it can gate a deploy or an HA node-join in a script:

stratumctl admin doctor && deploy-next-node

Run it right after adding a node to catch an ovn-controller that has drifted off the cluster’s OVN release before it breaks the dataplane.

Examples

stratumctl admin doctor
stratumctl admin doctor --output json

stratumctl admin readiness

Why this cluster cannot serve yet: capability findings with their fixes

stratumctl admin readiness [flags]

Show the cluster’s readiness findings: capability gaps rather than faults (no storage class, no radosgw, an operator image that never built, a node not reporting), each with its remediation and, where one exists, the single API call that fixes it.

Exits non-zero when the cluster is not ready, so it gates a script:

stratumctl admin readiness --wait 15m && terraform apply

–service gates on one service instead of the whole cluster (“ready for instances, not for S3” is a real answer):

stratumctl admin readiness --service s3

Checks whose input could not be read are listed as incomplete: their findings are unknown, not absent.

Examples

stratumctl admin readiness
stratumctl admin readiness --service s3 --wait 5m

Flags

Flag	Type	Default	Description
--interval	duration	10s	time between checks with –wait
--service	string		gate on one service (s3, db, k8s, dns,…) instead of the whole cluster
--wait	duration	0s	poll until ready or this long has passed (0 = check once)

stratumctl admin selfcheck

Post-install substrate health self-check

stratumctl admin selfcheck [flags]

Roll up the control plane’s health surfaces into one pass/fail report: readiness (managed deps), the L2/L3 dataplane, cluster HA (Patroni / OpenBao raft / OVN raft / service VIPs across every node), substrate services, version compatibility, the observability backends, and the internal PKI (one cluster CA across all nodes, no orphan roots, front door issued by it).

Exits non-zero if any check FAILs (WARN passes, advisory), so it can gate a deploy or post-install verification from a script:

stratumctl admin selfcheck && echo substrate-healthy

With –tenant it ALSO runs a DESTRUCTIVE end-to-end smoke against –project: VPC -> subnet -> security group -> key pair -> instance (launched from an existing image, polled to running), then tears it all back down. Teardown runs even on failure, so a failed smoke doesn’t strand resources:

stratumctl admin selfcheck --tenant --project p-system

Examples

stratumctl admin selfcheck
stratumctl admin selfcheck --output json

Flags

Flag	Type	Default	Description
--tenant	bool	false	also run the DESTRUCTIVE tenant end-to-end smoke against –project