Concepts

The words used throughout these docs, and what they mean in Stratum specifically. Several are general networking terms that carry a narrower meaning here — those are the ones worth reading even if the term is familiar.

The building blocks

Node — one physical server running the agent. Nodes are peers, and there is only one kind: every node hosts workloads and routes. What differs between two nodes is the interfaces they hold and what you have put on them — see Nodes and Interfaces.

Network — a subnet the fabric carries, with its own address range, gateway, and policy. This is the unit you create first and attach everything else to. A network is created on one node; an overlay can carry its subnet to others.

Endpoint — the attachment point where a workload joins a network. It has an address and a hardware address, and the fabric enforces both: traffic claiming to come from an endpoint must actually match its registration.

Tenant — an ownership boundary. Networks, endpoints, and bandwidth allowances belong to a tenant, which is what lets one node carry several customers' traffic without them reaching each other. Suspending a tenant affects everything under it at once.

Workload — whatever is using an endpoint: a virtual machine, a container, or a physical host on a port.

Addressing

IPAM (IP address management) — the record of which addresses in a network are allocated, reserved, or free. Reservations tie an address to a specific hardware address so a workload always gets the same one.

Floating address — an address that is not permanently attached to one node. It lives on whichever node currently holds a role, and moves when that role moves. This is how gateway failover, coming in a later release, will keep a stable address.

VIP (virtual IP) — the address clients connect to for a load-balanced service. The load balancer accepts traffic on the VIP and distributes it to backends.

Overlays

These four terms describe one mechanism, and they are easy to confuse.

Underlay — the ordinary network that already connects your nodes. Whatever carries traffic between their real addresses.

Overlay — a network Stratum builds on top of the underlay so that workloads on different nodes appear to share a subnet. It exists only as far as the nodes are concerned; the underlay sees only traffic between nodes.

VNI (virtual network identifier) — the number that identifies one overlay. Nodes sharing an overlay must use the same VNI; different overlays use different ones, which is what keeps them separate over the same underlay.

VTEP (tunnel endpoint) — the address a node sends and receives overlay traffic from. In practice this is the node's own address on the underlay. Each node must know the others' VTEPs, or it has nowhere to send overlay traffic — see Networking Overview.

Encapsulation — wrapping an overlay packet inside an underlay packet for the trip between nodes, and unwrapping it on arrival. This is why an overlay packet is slightly larger than the payload it carries, and why overlay networks want a little headroom in the underlay's maximum packet size.

Policy and protection

Rule — one firewall decision: match traffic by direction, address, protocol and port, then allow or deny it. Rules are evaluated in priority order.

Default action — what happens to traffic no rule matched. It starts as allow. Set it to deny (firewall default set deny) to deny by default, so traffic is refused unless something explicitly permits it. See Firewall.

Stateful — a firewall that remembers established conversations, so replies to traffic you allowed are permitted without a matching rule in the other direction. Every Stratum firewall rule is stateful.

Connection tracking — the table of those remembered conversations. It is worth knowing this exists because it explains a common surprise: tightening a rule affects new connections, while ones already established keep going until they end or are flushed.

Anti-spoofing — enforcing that traffic from an endpoint carries that endpoint's registered addresses, so one workload cannot impersonate another.

Block list — addresses refused outright, checked before the rules.

Traffic control

Shaping — limiting how much bandwidth something may use. Applied on the way out of an interface.

Quota — a cap on total volume over a period, as opposed to a rate limit.

Accounting — the record of how much traffic something actually used, which is what billing integrations read.

Routing

BGP — the protocol nodes use to exchange routes with your upstream routers, so the rest of your network learns how to reach the fabric. See BGP Edge Routing.

Peer / neighbour — the router on the other end of a BGP session.

Announce — offering a network to your peers, so traffic for it is sent to this node.

NAT (network address translation) — rewriting addresses in transit. Two uses here: letting many private workloads share one public address on the way out, and publishing an internal service on a public address and port. See Gateway NAT.

Clustering

Cluster — nodes managed as one group, from any of them (agent 1.0.0-rc.81 or later). The members elect a leader, through which they agree on a small set of shared settings, such as tenants and the blocklist; everything else stays with the node it was created on. See Clustering Overview.

Join code — a one-time code, made on any member, that lets one new node join a cluster. It expires (after 15 minutes unless you choose otherwise) and is shown only once.

Member — a node in a cluster. Each member has its own identity, issued by the cluster when it joins and renewed automatically, and its own licence.

Heartbeat — the frequent signal between two nodes paired for high availability, so each knows the other is alive. Missing several in a row is what triggers failover.

Failover — a standby taking over from a failed peer, including the floating address. You cannot set up a high-availability pair yourself yet; see Gateway High Availability.

License and lifecycle

Activation — binding a license to one specific machine. A license covers a number of machines; each is activated separately.

Enforcement state — how the agent is currently treating the license: active, warning as expiry approaches, grace just past it, and frozen. Frozen blocks changes only — traffic never stops. See Licensing.

Release channel — whether a license runs released builds or pre-release ones. The two must match, and the agent refuses a build from the wrong channel.

Manifest — the signed list of available releases the agent checks when looking for an update.

Where to go next

• How Stratum Works — how these pieces fit together.
• Quick Start — put the main ones to use.
• CLI Reference — the commands behind each concept.