CIQ Stratum Kubernetes Engine Bundles Cluster Setup, Upgrades and AI Agent Controls

CIQ targets Kubernetes’ operational drag with a single package

Kubernetes deployments often become difficult to manage after the initial install, as networking, storage, security and monitoring components follow separate release schedules. CIQ’s new Stratum Kubernetes Engine (SKE) aims to reduce that upkeep by packaging roughly ten upstream projects into one signed binary for installing, joining and upgrading clusters. The approach could appeal to teams running AI and GPU workloads across existing Linux and high-performance computing environments.

CIQ, the company behind Rocky Linux, says SKE is built from unmodified upstream source. Its pitch is less about changing Kubernetes itself and more about making the pieces work together as a tested set. That’s a practical focus: teams can keep using their Linux environment while reducing the work of coordinating component versions and lifecycle tasks.

The company says Kubernetes runs in production at 82% of organizations using containers, and the Cloud Native Computing Foundation describes it as the de facto operating system for AI. But adoption doesn’t remove the operational burden. CIQ cited a 2026 survey of 785 Kubernetes decision makers in which 62% said complexity slowed business initiatives and 65% reported running air-gapped clusters.

One binary across local development and production

CIQ CTO Peter Nelson described SKE as a way to make Kubernetes available through a single binary, with both a visual interface and command line. Developers can run a cluster on a desktop, then use the same binary in a cloud environment, keeping local testing closer to production. Nelson also said developers can ask an AI agent to set up a cluster, subject to permissions they define.

That consistency is the product’s central operational promise. If the same software package runs on a developer’s machine and on production infrastructure, teams have fewer differences to account for when moving workloads between the two. The value will depend on how well SKE fits each organization’s existing deployment processes, but the packaging model addresses a familiar source of friction: configuration and version drift between environments.

CIQ also focuses on what happens after installation. SKE pins and tests its components together, checks node health during rolling upgrades, and can roll back a node that fails. It takes etcd snapshots every 12 hours by default, renews certificates before expiration, and signs each release. A software bill of materials ships with each release, giving operators a record of included components.

Nelson said the team designed SKE around “getting that step right,” arguing that a cluster’s installation sets the tone for its ongoing operation. The same idea carries through the product: skills gained while managing one SKE cluster should transfer to others, whether they run on a laptop, in the cloud or alongside GPU infrastructure.

AI agents get bounded access to cluster operations

SKE includes an MCP server that lets AI agents interact with a cluster through 37 tools grouped into read, write and destructive permission tiers. Operators choose the enabled tier; tools above it aren’t registered. Kubernetes access controls still apply to each call, and agents cannot access secrets.

This design puts the control boundary in the cluster configuration rather than trusting an agent to decide which operations are appropriate. It also gives platform teams a way to let agents inspect or change infrastructure within defined limits. The distinction between read, write and destructive actions matters as teams move from agent-assisted troubleshooting toward automated cluster management.

CIQ includes an AGENTS.md file to guide agent-driven installations, and publishes documentation in llms.txt format. A built-in web dashboard provides access to pods, logs and a shell. Together, these features suggest SKE is intended to support both human operators and agents through the same cluster management environment.

That doesn’t remove the need for careful permission design. The practical question for teams will be whether the available controls map cleanly to their workflows and security boundaries, especially where agents can make changes. CIQ’s tiered approach offers a starting structure, while leaving Kubernetes access controls in force.

Open-source SKE and commercial Stratum Pro

The free, open-source SKE edition supports a single cluster and includes the web interface. CIQ’s commercial Stratum Pro subscription adds multi-cluster management through the same interface and sign-on, along with an app catalog, CIQ support and an optional CIS hardening profile with per-control checks.

Stratum Pro’s fleet agent makes outbound connections, so managed clusters don’t need inbound ports. CIQ says Cluster API provisioning is planned for a later release. Pricing for Stratum Pro is expected when the product reaches general availability.

The split gives teams a way to try the core distribution without a subscription, while reserving fleet management and support for the paid tier. For organizations with GPU clusters and general-purpose fleets, the commercial offer is aimed at bringing both into a shared management view.

Linux compatibility and availability

SKE runs on Enterprise Linux 9 or later, including Rocky Linux, RLC Pro AI and RLC Pro Hardened, on amd64 and arm64 systems. It doesn’t require a CIQ-specific node operating system, which may make it easier to fit into environments already standardized on Enterprise Linux.

CIQ positions SKE alongside its other infrastructure products: Warewulf Pro for node provisioning, Fuzzball for HPC and AI workflows, and Ascender Pro for automation. The company says each can also run independently, so adopting SKE doesn’t require adopting the rest of the portfolio.

SKE is in technical preview, with general availability expected November 5. The open-source distribution is licensed under Apache 2.0. Both SKE and Stratum Pro are available through CIQ Depot and the CIQ Portal, with one binary for each supported architecture and public documentation at docs.ciq.com.

CIQ’s bet is that Kubernetes operations can become more repeatable when installation, upgrades and agent access share a single delivery model. For teams building AI platforms, the test will be whether that model reduces day-to-day cluster work while fitting the Linux and GPU systems they already run.