internal/

Package addons carries the cluster add-on manifests (CoreDNS, local-path storage, Cilium CNI) embedded in the stratum binary, and renders each one for the cluster it is about to be installed into — substituting the mirrored image registry, the pinned versions, and the per-cluster apiserver endpoint.

Package assets stages the payload embedded in the stratum executable onto disk at runtime.

Package atomicfile is stratum's one durable single-file writer: a file is written to a unique hidden temp file in its own directory, labelled for its destination, fsynced at its final mode, renamed into place, and the directory is fsynced so the rename survives a power loss.

Package bootstrap owns cluster-info transport for every consumer of the kube-public cluster-info ConfigMap, under two distinct trust models.

Package certinputs defines the certificate inputs every control-plane lifecycle issues leaves from — the host, the node's address, and the named SAN purposes the cluster's network facts call for — and builds them through one constructor.

Cross-node orchestration for `stratum certs rotate-ca --cluster`.

Package cluster assembles a SKE node: the declarative cluster config, the persisted per-node state, the component processes the supervisor runs, and the bring-up/join flows around them.

Package comps speaks systemctl-shaped verbs (restart, stop, is-active) to the stratum supervisor's control socket, for the components that are still supervised HOST processes: containerd, kubelet, and the operator.

Package dashboard serves the Stratum dashboard from the stratum binary: the embedded SPA, a reverse proxy to this cluster's own apiserver, and a session layer that authenticates users by ServiceAccount bearer-token passthrough.

Package enginesettings holds the apiserver flags and kubelet lines the engine renders on every node whatever its profile: the apiserver verifies kubelet serving certificates against the cluster's trust bundle, and the kubelet either bootstraps its serving certificate through the CSR flow or serves the static leaf pair a control plane holds.

Package etcddata coordinates Stratum operations that create, replace, or restore the local etcd data directory.

Package etcdsnap wraps the host-staged etcdctl for etcd snapshot save (the pre-upgrade data-safety floor), over the same mTLS endpoint/flags as `stratum etcdctl`, and the host-staged etcdutl for an offline single-member snapshot restore (the heavy rollback path).

Package ha implements HA control-plane join (`stratum server --server --token --certificate-key`): it securely distributes the shared CP certs, adds a live etcd member, brings up an additional apiserver, and fronts them with a per-node HAProxy.

Package host performs node prerequisites: directories, kernel modules, sysctls, swapoff, and node-IP/hostname detection.

Package interrupt owns the one signal set every stratum command stops under, so no two handlers can drift apart: SIGINT, SIGTERM and SIGHUP.

Package k8sutil holds small host-side helpers shared across the stratum subcommands: running the embedded kubectl against admin.conf, the apiserver health gate, node-registration wait, the progress "step" printer, the admin-clientset constructor, the etcdctl mTLS env, the node label/stamp the upgrade orchestrator relies on, and the cluster maintenance fence the command-level seams take.

Package k8sver parses, validates and orders Kubernetes version strings.

Package kubeconfig writes the control-plane kubeconfigs in Go using client-go's clientcmd/api.

Package maintlease holds self-renewing cluster maintenance Leases.

Package mcp serves Stratum's Model Context Protocol tools.

Package netcfg is the single place that understands the cluster's pod/service CIDRs and their address families, so every consumer (systemd unit flags, PKI SANs, Cilium, node-IP detection) agrees on single- vs dual-stack.

Package nodejob runs a privileged, node-pinned Job that nsenters PID 1 and execs the on-host stratum binary, then gates on the Job result.

Package nodelock excludes concurrent node-maintenance operations — upgrade, rollback, certificate rotation, etcd CA migration, snapshot restore, rejoin, uninstall — on one host: while one such operation holds the lock, the next refuses instead of waiting.

Package nodestate persists what a node IS — written at bring-up/join, read on every controller start, patched by rejoin/restore.

Package objstore is a thin S3 client (AWS SDK for Go v2) for offloading etcd snapshots to an S3-compatible object store — AWS S3, MinIO, Ceph RGW, etc.

corednsspread.go — move a CoreDNS replica off a node that holds all of them.

etcd CA migration — splitting etcd out of the Kubernetes trust domain.

Package procid answers one question for every /proc scanner in the tree: which live process is Stratum's, and which component does it belong to?

Package profile is the engine's notion of a node profile: a named set of hardened settings an importer registers through pkg/cli.WithProfiles and a node selects by name.

Package profilefiles writes a node profile's config files where the renderers read them.

Package registry translates an RKE2/k3s-compatible /etc/stratum/registries.yaml into containerd's certs.d configuration so image pulls can be redirected to a mirror (the air-gap / sovereign-registry case).

Package rollout restarts the in-cluster workloads Stratum owns, so that every command that has to do it (snapshot restore, and rotate-ca) rolls one list.

Package rtcheck compares what is installed on disk with what is actually serving: a node can run a different containerd than the one on disk when an orphan from an earlier run holds the CRI socket.

Package runtime configures containerd from the staged payload: config.toml with the host-matched cgroup driver, the stratum CRI socket, and registry mirrors.

Package selinux keeps the files Stratum writes labelled the way the host's SELinux policy says they should be, and registers the file contexts that make the policy treat Stratum's paths the way container-selinux treats the standard container runtime's.

Package staticpod renders and manages the control-plane static pod manifests (the control plane runs as kubelet-managed static pods).

Package supervisor runs and restarts the host processes that make up a SKE node: containerd, kubelet, and the operator.

Package token implements `stratum token create`: it mints a bootstrap token, stores the bootstrap-token Secret, wires the node-bootstrap and node-renewal RBAC with upstream bootstrap auto-approval reserved and empty (the operator approves joins), publishes the cluster-info ConfigMap (so agents can discover the CA), and prints the join command.

Package toolenv is how host tools are found and run when Stratum runs them as root: iptables and tc load code from XTABLES_LIBDIR and TC_LIB_DIR, and a shim of any tool can sit first on the caller's PATH, so neither the caller's environment nor its PATH is used.

Package trustaudit evaluates this node's etcd and kubelet client trust against the live components.

Package uninstall removes a stratum node's footprint: it stops the supervised components (via the controller's control socket, when one is running) and deletes the on-disk layout created by `stratum up`.

Package upgrade implements `stratum upgrade` / `stratum rollback`: a per-node binary-swap primitive and a `--cluster` orchestrator that rolls an HA cluster (serial control planes, then workers) natively, version-stamped and self-contained (the binary embeds the new component binaries).

Package version carries the ldflags-stamped release versions, the ports and fixed component settings every node shares, and the filesystem layout every other package derives paths from.