CIQ Stratum Kubernetes Engine Bundles Cluster Setup and AI Agent Controls

CIQ’s Stratum Kubernetes Engine (SKE) targets a persistent Kubernetes problem: teams spend effort assembling and maintaining a stack of separately released components before they can focus on workloads. The company packages those parts into one signed binary, with cluster installation, upgrades and management built around the same distribution. For organizations running AI and GPU workloads, that packaging could reduce setup friction while keeping deployment consistent between a developer’s machine and production.

That’s the practical proposition. Kubernetes complexity comes from the coordination work around the core platform: networking, storage, security, monitoring and scheduling each bring their own configuration and release cadence. Hybrid environments, different Linux distributions and GPU infrastructure add more operational variables. SKE’s design groups roughly 10 upstream projects into a tested set, aiming to make the lifecycle easier to manage without asking teams to replace their existing operating system.

One package for the cluster lifecycle

CIQ, known for Rocky Linux, describes SKE as open-source Kubernetes for AI infrastructure. The distribution is built from unmodified upstream source, according to the company, and is intended for administrators, developers and platform engineers working alongside Linux, high-performance computing and GPU systems. The packaged binary installs Kubernetes, adds nodes to a cluster and handles upgrades.

That packaging choice matters most after initial deployment. When components evolve on separate schedules, operators have to track compatibility and manage the risk of drift between cluster environments. SKE pins and tests its components as a set. Rolling upgrades check node health at each stage, and a node that fails a check is rolled back. The system also takes etcd snapshots every 12 hours by default, renews certificates before they expire, and signs each release with a software bill of materials included.

These features make lifecycle management part of the product’s core pitch rather than an afterthought. Teams can standardize how they install and update clusters, then carry the same operating model from an initial deployment to a larger fleet. The payoff depends on how well the bundled set fits a team’s needs, but the intended reduction in component-by-component coordination is clear.

CIQ CTO Peter Nelson said the binary includes a visual interface alongside the command line. He described a workflow in which a developer can run Kubernetes locally, refine a solution in an environment aligned with production, and then use the same binary in the cloud. The aim is to reduce the gap between a prototype and its production deployment, a familiar source of friction for platform teams.

Nelson also framed the interface around both human users and AI agents. “Traditional Kubernetes is a multi-step process to deploy and configure,” he said. “Ours is a single binary, with a visual interface alongside the command line, so it’s simple to get started with whether you’re a developer or an agent.” His broader claim is that the agent can be restricted to actions developers allow, while the same setup can be used to prototype and test.

Agent access comes with permission tiers

SKE includes a Model Context Protocol (MCP) server that exposes 37 tools to AI agents. The tools are grouped into read, write and destructive tiers. Operators enable access by tier, and tools above the chosen level are not registered. Kubernetes access controls continue to govern calls, while secrets remain inaccessible to agents.

This structure puts an important operational question directly into the product: what should an agent be allowed to do on a cluster? Read access can support inspection and troubleshooting; write access permits changes; destructive actions carry a different level of risk. By separating those capabilities, SKE gives operators a way to limit the available actions rather than treating agent access as a single on-or-off switch.

The distribution also includes an AGENTS.md file to guide agent-assisted installations, and CIQ publishes documentation in llms.txt format. A built-in web dashboard provides access to pods, logs and a shell. Those features suggest CIQ is treating agent use as part of the platform’s operating workflow, while leaving permissions and Kubernetes access controls in the hands of the cluster operator.

The need for simpler operations has a measurable backdrop in the source report: a 2026 survey of 785 Kubernetes decision makers found that 62% said complexity was slowing business initiatives, while 65% ran air-gapped clusters. Those figures point to two different pressures. Teams want to reduce the work required to run Kubernetes, and many must do so in environments with limited or no network connectivity.

Open-source core, paid fleet management

CIQ is offering SKE as free, open-source software under the Apache 2.0 license. The free edition runs a single cluster and includes the web UI. CIQ Stratum Pro is the commercial subscription for organizations that need to manage multiple SKE clusters through one interface and sign-on, spanning GPU systems and general-purpose infrastructure.

Stratum Pro adds an application catalog, an optional CIS hardening profile with checks for individual controls, and support from CIQ. Its fleet agent connects outbound only, so managed clusters do not require inbound ports. Cluster API provisioning is planned for a later release. That division leaves the base distribution available for individual clusters while placing fleet-level management and additional enterprise features in the paid tier.

Compatibility is designed to avoid tying SKE to a CIQ-specific node operating system. It runs on Enterprise Linux 9 or later, including Rocky Linux, RLC Pro AI and RLC Pro Hardened, on amd64 and arm64 systems. It can also be used alongside Warewulf Pro for node provisioning, Fuzzball for HPC and AI workflows, and Ascender Pro for automation. CIQ says each of those products can also run independently.

Availability and the test for adoption

At publication, SKE was available as a technical preview, with general availability scheduled for November 5. CIQ said both editions would be downloadable through CIQ Depot and the CIQ Portal, with one binary for each supported architecture and public documentation at docs.ciq.com. Pricing for Stratum Pro was due at general availability.

CIQ is entering a crowded Kubernetes market that includes offerings from Red Hat, SUSE, Mirantis, Nvidia and the major cloud providers. SKE’s distinction is its combination of an upstream-based distribution, a single packaged binary, support for existing Enterprise Linux systems and built-in agent controls. Those choices will matter to teams that want predictable cluster operations across development and production, particularly where GPU, HPC or disconnected environments are involved.

The meaningful test will be whether the bundled release and upgrade process holds up across varied infrastructure without limiting the flexibility teams expect from upstream Kubernetes. If it does, SKE could make cluster operations easier to repeat while giving platform teams a defined way to bring agents into routine work. For now, the clearest value is operational: fewer independently managed pieces, with more of the cluster lifecycle gathered under one distribution.