Version 1.0.0-rc.77

Stratum v1.0.0-rc.77

Release candidate. Continues the Stratum 1.0 preview. It is recommended for evaluation and staging. Hold production rollouts for the stable v1.0.0 release.

This is the largest update of the 1.0 preview. Stratum is growing into a platform. Alongside Fabric networking, this build carries early-access previews of Stratum Compute (virtual machines) and Stratum Storage (volumes and backups). The previews are active only on nodes whose licence includes them. Apart from the improvements below, a Fabric node behaves as before.

Highlights

• Stronger isolation between tenants on the same node. Traffic between two tenants' workloads is now blocked at every workload port, including traffic that never leaves the node's own switch. A tenant's workloads still reach each other, the node and the internet.
• Public addresses for workloads. Register the extra IPv4 addresses your provider routes to the server, then give single addresses to workloads. Anti-spoofing, tenant isolation and bandwidth plans apply to them. An address that no workload holds is answered by the node itself, instead of bouncing back to your provider.
• Internet access for a network with one flag. network create --host-gateway places the network's gateway on the node, with optional outbound NAT (--snat) and DHCP (--dhcp). The same option can be switched on for an existing network.
• Safer defaults.

- A workload may send only from its own addresses. - Private addresses that no NAT rule covers no longer leave the uplink untranslated. An operator setting keeps the previous behaviour, for providers who route private ranges.

• Suspension holds for tenants of any size. Suspending a tenant now covers every address it uses, however many there are.
• Runs alongside Docker on the same server.
• New installer profiles. fabric (the default), compute and suite. Compute is set up only when the licence includes it, and the installer never changes virtualization settings that another management panel on the same server relies on.

Early access: Stratum Compute

Requires a licence that includes Compute.

• Virtual machines from cloud images. Images are checksum-verified before use. Each machine is set up on first boot (hostname, SSH keys, static addressing) and connected to Fabric networking before it starts.
• Consoles. The display and serial consoles of a machine are available through the API and from the command line.
• Machine settings. Change a machine's size, choose UEFI, Secure Boot and TPM, and add or remove network cards on a running machine.
• Operations. Password reset through the guest agent, per-machine metrics and a machine-down alert.
• Suspension. Suspending a tenant stops its machines. Resuming starts again the ones that were running.
• Restarts. Machines keep running while Stratum itself restarts or updates.

Early access: Stratum Storage

Requires a licence that includes Storage.

• Volumes. Data volumes can be attached to running machines and grown while attached.
• Snapshots. Machines keep running while a snapshot is taken.
• Backups. Full and incremental backups, verified before they are listed as complete.
• Restore. Restore to a new volume, or in place.

Security

• Tenant keys. Tenant-scoped API keys can no longer change their own quotas, billing state or tenant record. A tenant key reads its own tenant, quota and billing state, and manages its own tenant's keys only.
• Consoles and imports. Console sessions and local image imports are hardened against misuse by other local users.

Improvements

• Reliability fixes. Tenant isolation, address handling, handing a public address over from one tenant to another, and suspension.
• The installer.

- It waits for another package manager to finish instead of failing. - It explains a refusal clearly even when it is piped into a shell. - Its package steps can no longer hang.

• The website and customer area have been redesigned.

Documentation

• New sections: virtual machines (early access), public addresses, the network host gateway, and what a tenant key can and cannot do.

Feedback on this release candidate is welcome. Report issues through your account before the stable v1.0.0 cut.