Global – October 31, 2026 -- CIQ has released Stratum Kubernetes Engine (SKE), an Apache 2.0-licensed distribution that packages the roughly ten upstream projects a Kubernetes cluster needs into one signed file for installing, joining, upgrading and maintaining clusters on Enterprise Linux.

CIQ built SKE to cut the upkeep cost that AI workloads add, since training and inference spread across many systems and capacity moves with demand. The company is the team behind Rocky Linux, Fuzzball, Warewulf and Apptainer.

SKE pins and tests every component as one set

SKE builds Kubernetes, etcd, containerd, runc and kube-vip from unmodified upstream source. It adds Cilium for networking and CoreDNS for cluster DNS. Users download the file for their architecture and run stratum up.

The same file then handles four post-install jobs:

• Join: adds worker and control-plane nodes.
• Upgrade: rolling upgrades check node health at each step and roll back a node that fails.
• Snapshot: etcd snapshots run every 12 hours by default.
• Renew: certificates renew before they expire.

A web dashboard ships with SKE and shows pods, logs and shell access for each cluster.

MCP server gives AI agents 37 tools across three permission tiers

SKE includes a Model Context Protocol (MCP) server that AI agents use to read and change the cluster. Its 37 tools are split into read, write and destructive tiers. Operators choose which tiers to enable, and the server never registers tools above the selected tier. Kubernetes access controls bound every agent call, and secrets stay off limits.

CIQ cites the Cloud Native Computing Foundation's Annual Cloud Native Survey: Kubernetes runs in production at 82% of organizations that use containers. Among organizations hosting generative AI models, 66% run some or all of their inference on Kubernetes.

Every release ships with a cosign signature, SBOM and provenance file

Each SKE release carries a keyless cosign signature, an SPDX software bill of materials for each architecture, and a provenance file. Security reviewers can verify the signature, read the component list in the SBOM, and confirm the build origin from the provenance file before installation.

Stratum Pro adds fleet management and single sign-on for GPU and general clusters

CIQ Stratum Pro, the commercial version built on SKE, shows GPU clusters and general fleets in one web interface. Sign-in runs through the customer's existing identity provider, and identity provider groups map to admin and viewer roles. Each cluster's fleet agent connects outbound only, so no inbound ports need opening. Stratum Pro also adds support from CIQ.

Stratum Pro manages SKE clusters. Other Kubernetes clusters can join the same interface through a kubeconfig, with no agent to install.

SKE runs on Enterprise Linux 9 or later on amd64 and arm64

SKE supports any Enterprise Linux 9 or later distribution, including Rocky Linux, RLC Pro AI and RLC Pro Hardened. It works alongside Warewulf Pro for node provisioning, Fuzzball for HPC and AI workflows, and Ascender Pro for automation. Each product also runs on its own.