Concepts
The words used throughout these docs, and what they mean in Stratum specifically. Several are general networking terms that carry a narrower meaning here — those are the ones worth reading even if the term is familiar.
The building blocks
Node — one physical server running the agent. Nodes are peers, and there is only one kind: every node hosts workloads and routes. What differs between two nodes is the interfaces they hold and what you have put on them — see Nodes and Interfaces.
Network — a subnet the fabric carries, with its own address range, gateway, and policy. This is the unit you create first and attach everything else to. A network can exist on one node or stretch across many.
Endpoint — the attachment point where a workload joins a network. It has an address and a hardware address, and the fabric enforces both: traffic claiming to come from an endpoint must actually match its registration.
Tenant — an ownership boundary. Networks, endpoints, and bandwidth allowances belong to a tenant, which is what lets one node carry several customers' traffic without them reaching each other. Suspending a tenant affects everything under it at once.
Workload — whatever is using an endpoint: a virtual machine, a container, or a physical host on a port.
Addressing
IPAM (IP address management) — the record of which addresses in a network are allocated, reserved, or free. Reservations tie an address to a specific hardware address so a workload always gets the same one.
Floating address — an address that is not permanently attached to one node. It lives on whichever node currently holds a role, and moves when that role moves. This is how gateway failover keeps a stable address.
VIP (virtual IP) — the address clients connect to for a load-balanced service. The load balancer accepts traffic on the VIP and distributes it to backends.
Overlays
These four terms describe one mechanism, and they are easy to confuse.
Underlay — the ordinary network that already connects your nodes. Whatever carries traffic between their real addresses.
Overlay — a network Stratum builds on top of the underlay so that workloads on different nodes appear to share a subnet. It exists only as far as the nodes are concerned; the underlay sees only traffic between nodes.
VNI (virtual network identifier) — the number that identifies one overlay. Nodes sharing an overlay must use the same VNI; different overlays use different ones, which is what keeps them separate over the same underlay.
VTEP (tunnel endpoint) — the address a node sends and receives overlay traffic from. In practice this is the node's own address on the underlay. Each node must know the others' VTEPs, or it has nowhere to send overlay traffic — see Networking Overview.
Encapsulation — wrapping an overlay packet inside an underlay packet for the trip between nodes, and unwrapping it on arrival. This is why an overlay packet is slightly larger than the payload it carries, and why overlay networks want a little headroom in the underlay's maximum packet size.
Policy and protection
Rule — one firewall decision: match traffic by direction, address, protocol and port, then allow or deny it. Rules are evaluated in priority order.
Default action — what happens to traffic no rule matched. Set it to deny for a zero-trust posture, where traffic is refused unless something explicitly permits it. See Zero-Trust Firewall.
Stateful — a firewall that remembers established conversations, so replies to traffic you allowed are permitted without a matching rule in the other direction.
Connection tracking — the table of those remembered conversations. It is worth knowing this exists because it explains a common surprise: tightening a rule affects new connections, while ones already established keep going until they end or are flushed.
Anti-spoofing — enforcing that traffic from an endpoint carries that endpoint's registered addresses, so one workload cannot impersonate another.
Block list — addresses refused outright, checked before the rules.
Traffic control
Shaping — limiting how much bandwidth something may use. Applied on the way out of an interface.
Quota — a cap on total volume over a period, as opposed to a rate limit.
Accounting — the record of how much traffic something actually used, which is what billing integrations read.
Routing
BGP — the protocol nodes use to exchange routes with your upstream routers, so the rest of your network learns how to reach the fabric. See BGP Edge Routing.
Peer / neighbour — the router on the other end of a BGP session.
Announce — offering a network to your peers, so traffic for it is sent to this node.
NAT (network address translation) — rewriting addresses in transit. Two uses here: letting many private workloads share one public address on the way out, and publishing an internal service on a public address and port. See Gateway NAT.
Clustering
Cluster — nodes that share configuration and coordinate with each other.
Leader — the member that currently accepts changes to shared state. Chosen by election; losing it triggers a new election and does not stop traffic.
Heartbeat — the frequent signal between two nodes paired for high availability, so each knows the other is alive. Missing several in a row is what triggers failover.
Failover — a standby taking over from a failed peer, including the floating address.
Licence and lifecycle
Activation — binding a licence to one specific machine. A licence covers a number of machines; each is activated separately.
Enforcement state — how the agent is currently treating the licence: active, warning as expiry approaches, grace just past it, and frozen. Frozen blocks changes only — traffic never stops. See Licensing.
Release channel — whether a licence runs released builds or pre-release ones. The two must match, and the agent refuses a build from the wrong channel.
Manifest — the signed list of available releases the agent checks when looking for an update.
Where to go next
- How Stratum Works — how these pieces fit together.
- Quick Start — put the main ones to use.
- CLI Reference — the commands behind each concept.