Running Kubernetes means assembling about ten upstream projects that each release on their own schedule, then keeping them working together through every upgrade. AI raises the cost of that upkeep, because training and inference spread across many systems and capacity grows and shrinks with demand. CIQ Stratum Kubernetes Engine (SKE) ships those projects as one signed file that installs, joins, and upgrades your cluster on the Enterprise Linux you already run. It's open source Kubernetes for the AI era. SKE is licensed under Apache 2.0 and built by the team behind Rocky Linux, Fuzzball, Warewulf, and Apptainer.
SKE pins and tests every component as a set, so each cluster you run installs and upgrades the same way. What you learn on your first SKE cluster applies to your tenth. When you run more than one, including GPU clusters for AI work, CIQ Stratum Pro adds fleet management, single sign-on, and support from CIQ.
Run the whole cluster lifecycle from one signed file
SKE builds Kubernetes, etcd, containerd, runc, and kube-vip from unmodified upstream source and adds Cilium for networking and CoreDNS for cluster DNS. You download the file for your architecture, then run stratum up.
The same file also does four jobs after the install:
- Join: add worker and control-plane nodes to the cluster.
- Upgrade: rolling upgrades check node health at each step and roll back a node that fails.
- Snapshot: etcd snapshots run every 12 hours by default.
- Renew: certificates renew before they expire.
A web dashboard ships with SKE and gives you pods, logs, and shell access on each cluster.
AI agents work within the limits you set
Kubernetes runs in production at 82% of organizations that use containers, according to the Cloud Native Computing Foundation's Annual Cloud Native Survey. The same survey found that 66% of organizations hosting generative AI models run some or all of their inference on Kubernetes.
SKE includes an MCP server that AI agents use to read and change the cluster. MCP, the Model Context Protocol, is the interface AI assistants use to call tools. The MCP server in SKE has 37 tools in read, write, and destructive tiers. You choose which tiers to enable, and the server never registers tools above that tier.
Kubernetes access controls bound every call an AI agent makes through the SKE MCP server, and secrets stay off limits.
See it run. Watch a live install of SKE and a tour of Stratum Pro in the product overview webinar.
Verify every release before you install it
Your security reviewer can check each SKE release before you install it. Every release ships with a keyless cosign signature, an SPDX software bill of materials (SBOM) for each architecture, and a provenance file. Your reviewer verifies the signature, reads the component list in the SBOM, and confirms from the provenance file where the build came from.
See every SKE cluster in one web interface with Stratum Pro
When a GPU cluster for AI work arrives with its own tools, you end up managing your clusters in two places. Stratum Pro, the commercial version built on SKE, adds fleet management.
Stratum Pro shows your GPU clusters and your general fleet in one web interface, with sign-in through the identity provider you already use. Groups in your identity provider map to admin and viewer roles. Each cluster's fleet agent connects outbound only, so you open no inbound ports to bring a cluster into the fleet. Stratum Pro manages SKE clusters. You can also add another Kubernetes cluster to the same web interface by giving Stratum Pro a kubeconfig for it, with no agent to install.
| SKE | Stratum Pro | |
|---|---|---|
| License | Free and open source (Apache 2.0) | Commercial subscription |
| Install, join, upgrade, and snapshot from one signed file | Yes | Yes |
| Signature, SBOM, and provenance on every release | Yes | Yes |
| Web dashboard and MCP server | Yes | Yes |
| Every SKE cluster in one web interface, with single sign-on | Yes | |
| App catalog | Yes | |
| Optional CIS hardening profile with a per-control check | Yes | |
| Support from CIQ | Yes |
Keep the Enterprise Linux you already run
SKE runs on any Enterprise Linux 9 or later distribution, on amd64 and arm64. That includes Rocky Linux, RLC Pro AI, and RLC Pro Hardened, so you keep the operating system you already trust on your Kubernetes nodes.
If you use other parts of the CIQ stack, SKE works alongside them: Warewulf Pro provisions the nodes, Fuzzball runs HPC and AI workflows, and Ascender Pro runs your automation. Each product also runs on its own, and you choose which ones to use.
To start, download SKE and run stratum up on an Enterprise Linux 9 host.