DevOps Glossary.

289 Terms

A simple, no-jargon dictionary for DevOps and Cloud engineering. Find clear definitions for technical terms, tools, and concepts to help you understand modern infrastructure.

Linux

Bash

Bash (Bourne Again Shell) is the default command-line shell on Linux servers. It is both an interactive shell for daily commands and a scripting language for automation. Bash scripts power CI/CD pipelines, deployment scripts, health checks, and server automation across the industry.

LinuxRead

Daemon

A daemon is a background process that runs continuously without a controlling terminal, typically started at boot and providing a service to other processes or the system. Common daemons include sshd (SSH server), nginx (web server), and cron (job scheduler).

LinuxRead

Environment Variable

An environment variable is a named value stored in a process's environment that child processes inherit. Environment variables configure application behaviour without hardcoding values. They are the standard method for passing configuration, secrets, and runtime settings to processes.

LinuxRead

File Descriptor

A file descriptor is a non-negative integer that the Linux kernel assigns to an open file, socket, pipe, or device. Every process has a table of file descriptors. 0 is stdin, 1 is stdout, 2 is stderr. All I/O in Linux happens through file descriptors.

LinuxRead

File Permissions

Linux file permissions control which users can read, write, or execute a file using a three-level model: owner, group, and other. Each level has three bits that can be independently set, represented as rwxr-xr-- or in octal as 754.

LinuxRead

Filesystem

A filesystem is the method an operating system uses to organise, store, and retrieve files on a storage device. Linux uses ext4 and XFS most commonly in production, plus virtual filesystems like /proc and /sys that exist only in memory.

LinuxRead

Inode

An inode is a data structure in a Linux filesystem that stores metadata about a file — its permissions, owner, size, and data block locations — but not its filename. The filename lives in a directory entry that points to the inode number.

LinuxRead

Linux Firewall

A Linux firewall controls which network packets are allowed into, out of, or through a server using rules evaluated by the kernel's netfilter framework. Tools like iptables, nftables, and ufw write rules into netfilter. The default-deny model blocks all traffic not explicitly permitted.

LinuxRead

Linux Kernel

The Linux kernel is the core of the operating system — the software that manages hardware, memory, processes, and system calls. It runs in privileged kernel space while applications run in user space. The kernel is the layer that makes all higher-level Linux functionality possible.

LinuxRead

Mount

Mounting in Linux attaches a filesystem (on a disk partition, network share, or virtual source) to a directory in the filesystem tree. After mounting, files on the device appear at that directory path and are accessible through normal file operations.

LinuxRead

Network Port

A network port is a 16-bit number (0-65535) that identifies a specific service or process on a host within a TCP/IP connection. Ports allow a single IP address to host multiple services simultaneously. Ports below 1024 are privileged and require root to bind.

LinuxRead

PATH

PATH is an environment variable containing a colon-separated list of directories the shell searches when you type a command. The shell checks each directory in order and runs the first matching binary found. Commands not in any PATH directory require an absolute path.

LinuxRead

PID

PID (Process ID) is a unique integer assigned by the Linux kernel to every running process. PID 1 is always systemd (or init), the first process after the kernel boots. Every other process gets the next available PID number up to the system maximum.

LinuxRead

Package Manager

A Linux package manager installs, updates, and removes software packages along with their dependencies. apt manages .deb packages on Debian/Ubuntu. yum and dnf manage .rpm packages on RHEL/CentOS/Amazon Linux. Both verify package integrity with GPG signatures before installation.

LinuxRead

Pipe

A pipe (|) connects the standard output of one command to the standard input of the next, creating a data processing chain. Pipes let you compose simple commands into powerful one-liners without temporary files. The kernel implements pipes as in-memory buffers between processes.

LinuxRead

Process

A process is a running instance of a program. Linux gives each process a unique PID, its own memory space, and a set of open file descriptors. Every process has a parent — except PID 1 (systemd) — forming a tree of all running processes.

LinuxRead

Redirect

Shell redirection operators control where a command's input comes from and where its output goes. The > operator writes stdout to a file, >> appends, < reads stdin from a file, and 2> captures stderr. Combining them allows precise control over all three standard streams.

LinuxRead

SSH

SSH (Secure Shell) is a cryptographic network protocol that provides encrypted remote access to Linux servers. It authenticates using key pairs or passwords and creates an encrypted tunnel for all data, replacing insecure protocols like Telnet and rsh.

LinuxRead

SSH Private Key

An SSH private key is the secret half of an asymmetric key pair stored locally at ~/.ssh/id_ed25519. It proves identity during SSH authentication by signing a server challenge. It must never be shared, transmitted, or committed to version control under any circumstances.

LinuxRead

SSH Public Key

An SSH public key is the shareable half of an asymmetric key pair used for SSH authentication. It is placed in ~/.ssh/authorized_keys on the server. The server uses it to verify that the connecting client holds the matching private key, without the private key ever being transmitted.

LinuxRead

Shell

A shell is a command-line interpreter that reads user input, executes commands, and returns output. Bash is the standard shell on Linux servers. The shell is both an interactive interface and a scripting language for automation.

LinuxRead

Signal

A signal is an asynchronous notification sent to a Linux process by the kernel, another process, or the user. Each signal has a number and name. A process can handle signals with custom code, ignore them, or let the default action (often termination) occur.

LinuxRead

Symbolic Link

A symbolic link (symlink) is a special file that contains a path pointing to another file or directory. Accessing the symlink transparently accesses the target. Unlike hard links, symlinks can cross filesystems and point to directories.

LinuxRead

Unit File

A systemd unit file is a configuration file that describes a service, socket, timer, or other system resource managed by systemd. Unit files have three sections: [Unit] for metadata and dependencies, [Service] for execution details, and [Install] for boot-time configuration.

LinuxRead

awk

awk is a text processing tool that splits each input line into fields and applies pattern-action rules. It excels at extracting specific columns from structured text like logs, CSV files, and command output. awk is indispensable for log analysis and data transformation in shell scripts.

LinuxRead

cron

cron is a time-based job scheduler daemon that executes commands at specified intervals. Jobs are defined in crontab files using a five-field time syntax (minute, hour, day, month, weekday). It is the standard mechanism for backups, log rotation, and scheduled maintenance.

LinuxRead

grep

grep (Global Regular Expression Print) searches files or stdin for lines matching a pattern and prints matching lines. It is the standard tool for filtering log files, searching code, and extracting information from command output in Linux environments.

LinuxRead

iptables

iptables is the user-space command-line tool for configuring the Linux kernel's netfilter packet filtering framework. It organises rules into tables (filter, nat, mangle) and chains (INPUT, OUTPUT, FORWARD) that evaluate every network packet passing through the system.

LinuxRead

sed

sed (Stream Editor) processes text line by line, applying editing commands like substitution, deletion, and insertion. It is the standard tool for find-and-replace operations on files and streams, used in scripts to modify config files, transform log output, and perform batch text transformations.

LinuxRead

systemd

systemd is the init system and service manager used by virtually all modern Linux distributions. As PID 1, it is the first process after the kernel boots and the parent of all other processes. It manages service lifecycle, logging, timers, and system state.

LinuxRead

CICD

Argo Rollouts

Argo Rollouts is a Kubernetes controller that extends Deployments with advanced rollout strategies — blue-green, canary with traffic weighting, and automated analysis. It integrates with Prometheus and Istio to automatically promote or roll back based on real-time metrics.

CICDRead

ArgoCD

ArgoCD is a declarative GitOps continuous delivery tool for Kubernetes that watches a Git repository and automatically synchronises the cluster to match the declared state — providing self-healing, auditable deployments where every change is a Git commit.

CICDRead

Artifact

A CI/CD artifact is a file or set of files produced by one pipeline job and passed to subsequent jobs or stored for later use. Common artifacts include Docker image references, compiled binaries, test reports, and coverage files that travel through the pipeline.

CICDRead

Artifact Promotion

Artifact promotion is the practice of building a Docker image or binary exactly once and passing the same immutable artifact through dev, staging, and production — rather than rebuilding for each environment. What was tested is exactly what gets deployed.

CICDRead

Change Failure Rate

One of the four DORA metrics — measures the percentage of deployments that cause a production incident requiring a hotfix or rollback. Elite performers keep this below 5%. High failure rates indicate insufficient test coverage or inadequate staging environment fidelity.

CICDRead

Deployment Frequency

One of the four DORA metrics — measures how often an organisation successfully deploys to production. Elite performers deploy multiple times per day. High frequency is only safe with automated testing, fast rollback, and small batch sizes.

CICDRead

Environment

A CI/CD environment is a named deployment target — such as dev, staging, or production — that tracks deployment history, enforces approval requirements, and holds environment-specific secrets. Environments make promotion workflows explicit and auditable.

CICDRead

GitHub Actions

GitHub Actions is GitHub's built-in CI/CD platform that runs automated workflows in YAML files under .github/workflows/. Workflows trigger on repository events — push, pull request, schedule — and run jobs on GitHub-hosted or self-hosted runners.

CICDRead

GitLab CI

GitLab CI is GitLab's integrated CI/CD system defined in a .gitlab-ci.yml file at the repository root. It runs jobs on registered runners, tracks deployments to named environments, and integrates tightly with GitLab's merge request workflow for inline pipeline status.

CICDRead

GitOps

A set of practices where the entire desired state of infrastructure and applications is stored in Git as the single source of truth. Changes are made via Git commits and pull requests — a reconciliation agent (ArgoCD, Flux) automatically applies them to the target environment.

CICDRead

Helm

Helm is the package manager for Kubernetes that bundles manifests into reusable parameterised charts. In CI/CD pipelines, Helm deploys applications with environment-specific values — enabling the same chart to deploy to dev, staging, and production with different configurations.

CICDRead

Jenkins

Jenkins is an open-source automation server widely used in enterprise environments for CI/CD pipelines. It uses a Groovy-based Jenkinsfile to define declarative pipelines with stages, agents, and post-build actions — running on self-hosted infrastructure with full customisation.

CICDRead

Job

A CI/CD job is a discrete unit of work within a pipeline stage that runs on a runner or agent. Each job runs in isolation, has its own set of steps, and produces a pass or fail result that determines whether dependent jobs can proceed.

CICDRead

Lead Time for Changes

One of the four DORA metrics — measures the time from a code commit to that code running in production. Elite performers achieve lead times under one hour. Long lead times indicate slow pipelines, large batch sizes, or excessive manual gates.

CICDRead

MTTR

One of the four DORA metrics — measures the average time to restore service after a production incident. Elite performers restore in under one hour. MTTR is driven by detection speed, rollback speed, and on-call runbook quality.

CICDRead

OIDC for CI/CD

OIDC (OpenID Connect) for CI/CD allows pipelines to assume cloud provider roles using short-lived tokens instead of long-lived static credentials. GitHub Actions, GitLab CI, and other platforms issue OIDC tokens that AWS, GCP, and Azure accept in exchange for temporary access credentials.

CICDRead

Pipeline

A CI/CD pipeline is an automated sequence of stages that takes source code from a Git commit through building, testing, scanning, and deploying to production — eliminating manual steps and ensuring every change follows the same verified path to release.

CICDRead

Runner

A CI/CD runner is the machine or container that executes jobs in a pipeline. GitHub-hosted runners are managed ephemeral VMs. Self-hosted runners run on your own infrastructure — giving control over hardware, networking, installed tools, and access to private resources.

CICDRead

SAST

SAST (Static Application Security Testing) scans source code or compiled binaries for security vulnerabilities without executing the program. Integrated into CI pipelines, tools like Semgrep, SonarQube, and CodeQL catch injection flaws, secrets, and insecure patterns before code reaches production.

CICDRead

Stage

A CI/CD stage is a logical grouping of related jobs within a pipeline representing one phase of delivery — such as Build, Test, Scan, or Deploy. Stages run sequentially and a failed stage blocks all subsequent stages from running.

CICDRead

Test Coverage Gate

A test coverage gate is a CI pipeline rule that fails the build if code test coverage drops below a defined threshold. Coverage gates enforce a minimum quality standard and prevent developers from shipping new code without corresponding tests.

CICDRead

Trigger

A CI/CD trigger is the event that starts a pipeline run. Common triggers include a Git push to a branch, a pull request opening, a scheduled cron expression, a manual dispatch, or a webhook from an external system like a monitoring alert.

CICDRead

Docker

.dockerignore

A file in the build context directory that lists files and directories Docker should exclude when sending the build context to the daemon. Excluding node_modules, .git, and test fixtures reduces build context from gigabytes to megabytes.

DockerRead

Base Image

The starting point of a Dockerfile specified in the FROM instruction. The base image determines the operating system, package manager, and initial filesystem of the final image — and is the single biggest factor in image size and security.

DockerRead

Bridge Network

The default Docker network driver that creates an isolated virtual network on the host, connecting containers via a Linux bridge device. User-defined bridge networks add automatic DNS resolution by container name.

DockerRead

Build Cache

Docker's mechanism for reusing unchanged image layers from previous builds to speed up rebuild time. Each instruction is a cache key — if the instruction and its inputs are unchanged, Docker reuses the cached layer instead of re-executing the instruction.

DockerRead

Compose Health Check

A configuration in a Docker Compose service that defines a command Docker runs periodically to determine if a container is healthy. Other services use depends_on with condition: service_healthy to wait until a dependency passes its health check before starting.

DockerRead

Compose Override

A secondary Docker Compose file that extends or modifies the base compose file for specific environments. Docker automatically merges docker-compose.override.yml with docker-compose.yml, allowing environment-specific configuration without duplicating the base file.

DockerRead

Compose Profiles

A Docker Compose feature that tags services with profile names, allowing them to be selectively started. Services without a profile always start — services with a profile only start when that profile is explicitly activated with --profile.

DockerRead

Compose Service

A named container definition in a Docker Compose file that specifies the image, ports, environment, volumes, dependencies, and runtime configuration for one component of a multi-container application.

DockerRead

Container

A lightweight, isolated process running on a shared Linux kernel using namespaces and cgroups — providing filesystem, network, and process isolation without the overhead of a full virtual machine.

DockerRead

Container Image

A read-only, layered filesystem snapshot containing an application and everything it needs to run — code, runtime, libraries, and configuration. Container images are the templates from which containers are created.

DockerRead

Container Isolation

The security boundaries that Linux namespaces and cgroups create around a container process, limiting its view of the filesystem, network, processes, and system resources. Container isolation is weaker than VM isolation — all containers share the host kernel.

DockerRead

Container Lifecycle

The sequence of states a Docker container moves through from creation to removal — created, running, paused, stopped, and dead — each triggered by specific Docker CLI commands or container exit events.

DockerRead

Container Registry

A service that stores and distributes Docker images. The registry serves as the central repository from which developers push built images and deployment systems pull them to create containers.

DockerRead

Container Runtime Interface

A Kubernetes plugin interface that defines how Kubernetes communicates with container runtimes. CRI allows Kubernetes to work with containerd, CRI-O, and other runtimes — and explains why Kubernetes deprecated Docker as a runtime in version 1.24.

DockerRead

Docker BuildKit

The modern Docker build engine that replaces the legacy builder with parallel layer building, better caching, secret mounts, SSH agent forwarding, and multi-platform builds. Enabled by default in Docker 23+.

DockerRead

Docker Buildx

A Docker CLI plugin that extends docker build with BuildKit features including multi-platform image building, advanced cache management, and parallel builds. Buildx enables building images for linux/amd64, linux/arm64, and other architectures from a single machine.

DockerRead

Docker Compose

A tool for defining and running multi-container Docker applications using a YAML file. A single docker compose up command creates and starts all services, networks, and volumes defined in the compose file.

DockerRead

Docker Compose vs Kubernetes

A comparison of two container orchestration approaches. Compose runs multi-container apps on a single host and suits small teams and local development. Kubernetes orchestrates containers across multiple hosts with self-healing, auto-scaling, and rolling deployments.

DockerRead

Docker Content Trust

A Docker security feature that enables cryptographic signing and verification of images using Notary. When enabled, Docker refuses to pull or run images that have not been signed by a trusted key — protecting against image tampering in transit.

DockerRead

Docker Context

The set of files and directories sent to the Docker daemon when building an image. Docker reads everything in the build context directory and sends it to the daemon — making a small, well-scoped context essential for fast builds.

DockerRead

Docker DNS

Docker's embedded DNS server (127.0.0.11) that runs inside every container on a user-defined network, resolving container names and network aliases to IP addresses without any manual configuration.

DockerRead

Docker Daemon

The background service (dockerd) that manages Docker objects — images, containers, networks, and volumes. The Docker CLI communicates with the daemon via a REST API over a Unix socket at /var/run/docker.sock.

DockerRead

Docker Health Check

A Dockerfile instruction or docker run flag that defines a command Docker runs periodically inside a container to determine if it is healthy. Containers can be starting, healthy, or unhealthy — used by orchestrators for traffic routing decisions.

DockerRead

Docker Image

A read-only, layered filesystem snapshot that serves as the template for creating containers. Each layer represents a Dockerfile instruction and is cached and reused across builds to speed up image creation.

DockerRead

Docker Logging Driver

The mechanism Docker uses to capture and route container stdout and stderr output. The default json-file driver writes to the host filesystem — production systems typically use awslogs, fluentd, or splunk drivers to ship logs to centralised aggregation systems.

DockerRead

Docker Network

A virtual network that Docker creates to enable communication between containers and between containers and the host. Docker provides several network drivers (bridge, host, overlay, none) for different connectivity requirements.

DockerRead

Docker Non-Root

The practice of configuring Docker containers to run as a non-root user (UID > 0) to limit the damage a compromised container process can do to the host system and other containers.

DockerRead

Docker Prune

A family of Docker commands that remove unused objects — stopped containers, dangling images, unused volumes, unused networks — to recover disk space on the host. Essential maintenance on build machines where layers accumulate over time.

DockerRead

Docker Restart Policy

A configuration that tells Docker what to do when a container exits. The four policies — no, always, on-failure, and unless-stopped — determine whether Docker automatically restarts a container and under what conditions.

DockerRead

Docker Secrets

Sensitive data (passwords, tokens, certificates) that must be available to containers at runtime without being stored in image layers, environment variables, or compose files in plaintext. Docker provides BuildKit secret mounts for build-time and file-based secrets for runtime.

DockerRead

Docker Stats

Docker's built-in runtime resource monitoring command that shows real-time CPU, memory, network I/O, and block I/O usage for running containers. Used for capacity planning and detecting runaway containers before formal monitoring is in place.

DockerRead

Docker Swarm

Docker's built-in container orchestration mode that turns a group of Docker hosts into a cluster. Swarm provides service scaling, rolling updates, secrets management, and overlay networking — a simpler alternative to Kubernetes for teams not ready for its complexity.

DockerRead

Docker Volume

A Docker-managed persistent storage location on the host filesystem that exists outside the container's union filesystem. Volumes persist beyond container lifetime, can be shared between containers, and are the recommended way to store data that must survive container restarts.

DockerRead

Dockerfile

A text file containing ordered instructions that Docker executes to build an image layer by layer. Each instruction creates a new filesystem layer — FROM sets the base, RUN executes commands, COPY adds files, and CMD defines the startup command.

DockerRead

Host Network

A Docker network mode where the container shares the host's network namespace directly, using the host's IP address and ports without any NAT. Provides the best network performance but eliminates all network isolation between the container and host.

DockerRead

Image Digest

A content-addressable SHA256 hash that uniquely and immutably identifies a specific version of a Docker image. Unlike tags which can be overwritten, a digest always refers to exactly the same image bytes.

DockerRead

Linux Capabilities

Granular Linux kernel privileges that can be individually granted or revoked from container processes. Docker drops 14 dangerous capabilities by default — using --cap-drop ALL with selective --cap-add provides the most restrictive security posture.

DockerRead

Multi-Stage Build

A Dockerfile pattern that uses multiple FROM instructions to separate build-time dependencies from runtime artifacts. The final image contains only what is needed to run the application — not the compilers, test frameworks, or build tools used during the build.

DockerRead

OCI Standard

Open Container Initiative — an open industry standard for container image format and runtime specification maintained by the Linux Foundation. OCI ensures that images built with Docker can run on containerd, podman, CRI-O, and any other OCI-compliant runtime.

DockerRead

Overlay Network

A multi-host Docker network driver that spans multiple Docker hosts, enabling containers on different machines to communicate as if on the same network. Used in Docker Swarm and as the conceptual foundation for understanding Kubernetes CNI networking.

DockerRead

Port Publishing

The mechanism by which Docker exposes a container's internal port to the host network, making the container service accessible from outside using -p host_port:container_port. Docker creates iptables DNAT rules to route traffic from the host port to the container.

DockerRead

Union Filesystem (OverlayFS)

The copy-on-write filesystem that Docker uses to layer image layers on top of each other. Each layer is immutable and shared across containers using the same image — only the top read-write layer is unique per container.

DockerRead

Volume Mount

A configuration that connects a directory or file from outside a container into the container's filesystem, making data accessible to the container process. Docker supports three mount types: named volumes, bind mounts, and tmpfs.

DockerRead

seccomp Profile

A Linux kernel security feature that filters which system calls a container process is allowed to make. Docker applies a default seccomp profile blocking 44 dangerous syscalls — custom profiles can restrict further for high-security workloads.

DockerRead

Kubernetes

Affinity

A Kubernetes scheduling rule that expresses attraction constraints — directing the scheduler to prefer or require that pods land on specific nodes or near specific other pods. Comes in two forms: Node Affinity (pod-to-node preferences) and Pod Affinity/Anti-Affinity (pod-to-pod co-location or separation rules).

KubernetesRead

Alertmanager

A Prometheus stack component that receives firing alerts, deduplicates and groups related ones, applies routing rules, and delivers notifications to Slack, PagerDuty, or email. Alertmanager turns raw metric threshold violations into actionable team notifications.

KubernetesRead

BestEffort

A Kubernetes QoS Class assigned to pods that have no resource requests or limits configured at all. BestEffort pods receive whatever CPU and memory is left over on the node, have zero resource guarantees, and are the first pods evicted when a node experiences memory pressure.

KubernetesRead

Blue-Green Deployment

A release strategy that runs two identical environments simultaneously — blue (live) and green (new version). Traffic switches from blue to green all at once after green is fully tested. Rollback is instant by switching traffic back to blue.

KubernetesRead

Burstable

A Kubernetes QoS Class where at least one container has resource requests set but they differ from the limits. Burstable pods can use more resources than requested when the node has spare capacity, and are evicted second after BestEffort during node memory pressure.

KubernetesRead

CNI

Container Network Interface - a specification and set of plugins that configure network interfaces inside Linux containers, enabling pod-to-pod communication across all nodes in a Kubernetes cluster. Popular implementations include Calico, Cilium, and Flannel. Without a CNI plugin installed, no pods can communicate and all will remain stuck in Pending.

KubernetesRead

Canary Deployment

A release strategy that sends a small percentage of real user traffic (typically 5-10%) to the new application version while the majority continues on the stable version. If the canary performs well, traffic percentage is gradually increased until full rollout.

KubernetesRead

Circuit Breaking

A resilience pattern that stops sending requests to a failing service after a configured number of errors, giving the service time to recover while preventing cascading failures from spreading to other services. In Istio, implemented via outlier detection in a DestinationRule.

KubernetesRead

Cluster Autoscaler

A Kubernetes component that automatically adds worker nodes when pods cannot be scheduled due to insufficient resources, and removes idle nodes when utilisation drops — reducing cloud costs without manual intervention.

KubernetesRead

ClusterIP

The default Kubernetes Service type that assigns a stable virtual IP address accessible only within the cluster, enabling internal pod-to-pod communication through a consistent endpoint that remains fixed regardless of underlying pod IP changes.

KubernetesRead

ConfigMap

A Kubernetes object that stores non-sensitive configuration data as key-value pairs, allowing application configuration to be completely decoupled from container images and injected into pods as environment variables or mounted files at runtime.

KubernetesRead

Control Plane

The central management component of a service mesh that distributes configuration to all sidecar proxies. In Istio, the control plane is called istiod. It manages certificate issuance, routing rule distribution, and service discovery - but never handles actual service traffic.

KubernetesRead

CoreDNS

The default DNS server in Kubernetes that runs as a Deployment inside the cluster, resolving service names to ClusterIP addresses and enabling pods to discover and communicate with each other using human-readable DNS names instead of raw IP addresses.

KubernetesRead

CrashLoopBackOff

A Kubernetes pod status indicating the container repeatedly crashes immediately after starting and the kubelet applies exponential backoff delays before each restart attempt, beginning at 10 seconds and capping at 5 minutes. It signals that something inside the container is fundamentally broken - not a transient network issue.

KubernetesRead

DaemonSet

A Kubernetes controller that ensures exactly one copy of a pod runs on every node in the cluster (or a filtered subset). When new nodes join, the DaemonSet automatically schedules a pod on them. When nodes leave, those pods are garbage collected. Used for infrastructure agents that must run everywhere — log collectors, monitoring exporters, network plugins, and security scanners.

KubernetesRead

Data Plane

All the sidecar proxy instances running alongside application pods in a service mesh. The data plane handles actual service traffic - applying mTLS, routing rules, retries, and metrics collection on every request.

KubernetesRead

Deployment

A Kubernetes controller that manages a set of identical pods — ensuring the desired number of replicas always runs, handling rolling updates to new versions with zero downtime, and automatically replacing crashed or deleted pods.

KubernetesRead

DestinationRule

An Istio custom resource that defines policies applied to traffic after routing decisions are made. It groups pods into named subsets (for use in VirtualService), and configures connection pooling, circuit breaking, and load balancing per destination.

KubernetesRead

Envoy Proxy

An open-source high-performance proxy developed by Lyft, used as the sidecar proxy in Istio and several other service meshes. Envoy handles mTLS, load balancing, circuit breaking, retries, metrics, and distributed tracing at the proxy level.

KubernetesRead

Fault Injection

A service mesh feature that deliberately introduces delays or error responses into traffic to test how services respond to failures, without requiring any changes to the services themselves. In Istio, configured via a VirtualService fault block.

KubernetesRead

Grafana

An open-source visualisation platform that connects to Prometheus to create real-time dashboards and alert panels. In Kubernetes environments Grafana turns raw PromQL queries into readable charts that make cluster health and pod performance visible across the entire engineering team.

KubernetesRead

Guaranteed

A Kubernetes QoS Class assigned to pods where every container has CPU and memory requests set exactly equal to their limits. Guaranteed pods receive the highest resource protection and are the last to be evicted when a node runs out of memory.

KubernetesRead

HPA

Horizontal Pod Autoscaler - a Kubernetes controller that automatically scales the number of pod replicas in a Deployment or StatefulSet up or down based on observed CPU utilization, memory usage, or custom application metrics. It eliminates the need to manually adjust replica counts during traffic spikes and quiet periods.

KubernetesRead

Helm and Helm Chart

A package manager for Kubernetes that bundles all required Kubernetes manifests into a reusable unit called a chart. Helm templates variables at deploy time, enabling the same chart to deploy consistently across dev, staging, and production environments with different configurations.

KubernetesRead

ImagePullBackOff

A Kubernetes pod status indicating the kubelet cannot pull the container image from the registry and is applying exponential backoff delays between retry attempts. It is always caused by one of four things: the image name or tag is wrong, the image does not exist, the registry requires authentication that the cluster does not have, or the registry is unreachable from the node.

KubernetesRead

Ingress

An API object that manages external HTTP and HTTPS access to services inside a cluster. Ingress sits in front of multiple services and acts as a smart router — directing traffic based on hostnames, URL paths, or headers without exposing each service directly to the internet.

KubernetesRead

Kubelet

The primary node agent in Kubernetes that runs on every worker node, responsible for ensuring containers described in PodSpecs are running, healthy, and reporting status back to the control plane.

KubernetesRead

LimitRange

A namespace-scoped policy that sets default, minimum, and maximum resource constraints for individual containers and pods within a namespace. While ResourceQuota caps the total consumption of a namespace, LimitRange enforces boundaries at the per-container level — automatically injecting default requests/limits into pods that don't specify them.

KubernetesRead

Mutual TLS (mTLS)

A two-way TLS authentication protocol where both the client and the server verify each other's identity before any communication begins. In a service mesh, mTLS is automatically applied between all services without application code changes.

KubernetesRead

Namespace

A Kubernetes mechanism for partitioning cluster resources into isolated virtual segments. Namespaces allow multiple teams, projects, or environments to share the same physical cluster while maintaining logical separation of workloads, access controls, and resource quotas. They do not provide network isolation by themselves — that requires Network Policies.

KubernetesRead

OOMKilled

A pod termination status in Kubernetes that occurs when a container exceeds its configured memory limit, causing the Linux kernel to forcefully terminate the process. Exit code is always 137.

KubernetesRead

PersistentVolumeClaim

A user's formal request for storage in Kubernetes that binds to an available PersistentVolume, abstracting the underlying storage provider and allowing pods to consume durable storage independently of their own lifecycle.

KubernetesRead

Pod

The smallest deployable unit in Kubernetes — a group of one or more containers that share the same network namespace, storage volumes, and lifecycle. Every container in Kubernetes runs inside a pod, and every pod gets its own unique IP address inside the cluster.

KubernetesRead

PodDisruptionBudget

A Kubernetes policy object that limits the number of pods of a replicated application that can be simultaneously down during voluntary disruptions like node drains, cluster upgrades, or autoscaling events, ensuring minimum availability is always maintained.

KubernetesRead

PromQL

Prometheus Query Language — the functional query language used to select, filter, aggregate, and calculate metrics stored in Prometheus. PromQL is used to build Grafana dashboard panels, define alert thresholds in PrometheusRule objects, and explore live metric data in the Prometheus web UI.

KubernetesRead

Prometheus

An open-source monitoring system that collects time-series metrics by scraping HTTP endpoints every 15 seconds. In Kubernetes it is the standard tool for collecting pod CPU, memory, request rates, and error rates — storing them locally and providing PromQL for querying.

KubernetesRead

QoS Class

A Quality of Service classification that Kubernetes automatically assigns to every pod based on its resource requests and limits configuration. QoS Class determines the eviction priority when a node runs low on memory — pods with lower QoS Class are evicted first to protect higher-priority pods.

KubernetesRead

RBAC

Role-Based Access Control — Kubernetes's built-in authorization system that controls who (users, groups, or ServiceAccounts) can perform what actions (get, list, create, delete) on which resources (pods, secrets, deployments) within the cluster. RBAC is enforced through four objects: Role, ClusterRole, RoleBinding, and ClusterRoleBinding.

KubernetesRead

ResourceQuota

A namespace-scoped Kubernetes object that enforces hard upper limits on the total amount of compute resources (CPU, memory) and API objects (pods, secrets, services) that can exist within a namespace. ResourceQuotas protect shared clusters from a single team or runaway workload consuming all available resources.

KubernetesRead

Retry Policy

A service mesh configuration that automatically retries failed requests to a destination without application code changes. In Istio, retry policies are defined per route in a VirtualService, specifying the number of attempts, per-attempt timeout, and which error conditions trigger a retry.

KubernetesRead

Rolling Update

A Kubernetes deployment strategy that replaces old pods with new ones gradually — one at a time or in small batches — ensuring pods are always running and serving traffic throughout the entire update. The default zero-downtime release strategy for Kubernetes Deployments.

KubernetesRead

Service Mesh

A dedicated infrastructure layer that handles all service-to-service communication in a microservices architecture. It adds security, observability, and reliability to inter-service traffic without requiring any changes to application code.

KubernetesRead

ServiceAccount

A Kubernetes identity assigned to pods that controls what API operations the pod is permitted to perform within the cluster. Every pod runs under a ServiceAccount — if you don't specify one, Kubernetes automatically assigns the `default` ServiceAccount. ServiceAccounts are the foundation of pod-level RBAC: they are bound to Roles and ClusterRoles to grant or restrict cluster API access.

KubernetesRead

Sidecar Injection

The automatic process by which a service mesh adds a proxy container to every new pod created in a labeled namespace. Triggered by a Kubernetes mutating admission webhook - no changes to application manifests are required.

KubernetesRead

Sidecar Proxy

A proxy container automatically injected into every pod in a service mesh. It intercepts all inbound and outbound traffic for the pod, enabling the mesh to apply encryption, retry logic, metrics collection, and routing rules without touching application code.

KubernetesRead

StatefulSet

A Kubernetes workload controller designed for applications that require stable, persistent identity across pod restarts — such as databases, message queues, and distributed stores. Unlike Deployments, each StatefulSet pod gets a predictable name, dedicated storage, and starts/stops in a guaranteed sequential order.

KubernetesRead

Taint

A key-value property applied to a Kubernetes node that repels pods from being scheduled onto it unless the pod explicitly declares a matching Toleration, enabling controlled and dedicated workload placement.

KubernetesRead

Toleration

A pod-level configuration in Kubernetes that allows the scheduler to place a pod onto a node that carries a matching Taint, enabling specific workloads to run on dedicated or restricted nodes.

KubernetesRead

Traffic Splitting

A service mesh capability that routes a specified percentage of requests to different versions of a service simultaneously. Used for canary releases, A/B testing, and blue-green deployments without changing replica counts.

KubernetesRead

VirtualService

An Istio custom resource that defines how requests are routed to services. It replaces the default Kubernetes Service routing with precise traffic rules - including weighted splits, header matching, retries, timeouts, and fault injection.

KubernetesRead

etcd

A distributed key-value store that serves as Kubernetes' primary backing store for all cluster state and configuration data, making it the single source of truth for the entire control plane including nodes, pods, secrets, and configs.

KubernetesRead

kube-proxy

A network proxy that runs on every Kubernetes node, maintaining iptables or IPVS rules to enable Service-based load balancing and routing of network traffic to the correct pod endpoints across the cluster.

KubernetesRead

Terraform

Atlantis

Atlantis is an open-source tool that automates Terraform pull request workflows — running terraform plan automatically when a PR is opened and posting the output as a comment, then running terraform apply when an approved reviewer comments 'atlantis apply'.

TerraformRead

Count and For Each

Terraform count and for_each are meta-arguments that create multiple instances of a resource or module from a single block. Count creates N identical copies using a numeric index. For_each creates one instance per item in a map or set, giving each instance a meaningful key instead of a number.

TerraformRead

Depends On

The depends_on meta-argument in Terraform explicitly declares that one resource must be created before another, even when there is no direct reference between them. Terraform normally infers dependencies automatically from references — depends_on handles the rare cases where the dependency is implicit and invisible to Terraform.

TerraformRead

Drift

Infrastructure drift in Terraform occurs when real cloud resources are changed outside of Terraform — by clicking in the AWS console, running AWS CLI commands, or making emergency fixes — causing the actual infrastructure to no longer match what Terraform expects from its state file.

TerraformRead

HCL

HCL (HashiCorp Configuration Language) is the configuration language Terraform uses to define infrastructure. It is designed to be human-readable and machine-parseable — more readable than JSON and simpler than a full programming language.

TerraformRead

Infracost

Infracost is an open-source tool that estimates the monthly cloud cost of a Terraform plan before you apply it — showing a cost breakdown per resource and the cost difference between your current and proposed infrastructure.

TerraformRead

Input Variable

A Terraform input variable is a parameter that makes a module or configuration reusable by letting callers pass in different values at runtime. Variables are declared with a variable block and can have a type, default value, description, and validation rules.

TerraformRead

Local Value

A Terraform local value is a named expression that you compute once and reuse throughout a configuration without repeating the calculation. Locals are like constants or intermediate variables — they are not input parameters and cannot be set by callers.

TerraformRead

Module Source

The source argument in a Terraform module block tells Terraform where to find the module code — a local relative path, a Terraform Registry address, a GitHub URL, or a private registry. The source determines how Terraform downloads and versions the module.

TerraformRead

Output Value

A Terraform output value exposes specific attributes from your infrastructure after an apply — like an EC2 instance's IP address or an S3 bucket's name. Outputs are printed to the terminal after apply and can be read by other Terraform configurations through remote state data sources.

TerraformRead

Remote State

Terraform remote state stores the terraform.tfstate file on a shared backend — like AWS S3 or Terraform Cloud — instead of on a local disk. Remote state allows a whole team to share infrastructure state safely and enables one Terraform configuration to read outputs from another.

TerraformRead

State Lock

A Terraform state lock prevents multiple terraform apply operations from running against the same state file simultaneously. When one engineer runs terraform apply, the state is locked — any other apply attempt waits or fails until the lock is released.

TerraformRead

Terraform Apply

The terraform apply command executes the changes shown in a plan — creating, updating, or destroying real infrastructure to match your Terraform configuration. It updates the state file after each successful change.

TerraformRead

Terraform Backend

A Terraform backend defines where Terraform stores its state file and how operations like plan and apply are executed. The default backend stores state locally on disk — production teams use remote backends like S3 or Terraform Cloud to share state safely across a team.

TerraformRead

Terraform Import

The terraform import command brings an existing cloud resource that was created outside of Terraform under Terraform management by adding it to the state file. After importing, Terraform can plan and apply changes to that resource without recreating it.

TerraformRead

Terraform Init

The terraform init command initialises a Terraform working directory — downloading required provider plugins, configuring the backend, and installing module dependencies. You must run terraform init before any other Terraform command when working in a new directory or after adding a new provider or module.

TerraformRead

Terraform Module

A Terraform module is a container for multiple Terraform resources that are used together. Every Terraform configuration is technically a module — but the term usually refers to reusable child modules that are called from a root module to create a specific piece of infrastructure.

TerraformRead

Terraform Plan

The terraform plan command shows you exactly what Terraform will create, change, or destroy before it does anything. It reads your configuration files, compares them to the current state file, and prints a diff — giving you a safe preview before you apply.

TerraformRead

Terraform Provider

A Terraform provider is a plugin that gives Terraform the ability to create, read, update, and delete resources in a specific platform — such as AWS, GCP, Azure, or GitHub. Each provider translates your HCL configuration into real API calls for that platform.

TerraformRead

Terraform Refresh

Terraform refresh updates the state file to match the current real state of your infrastructure — detecting changes made outside of Terraform. In modern Terraform (1.0+), refresh behaviour is built into every plan and apply by default.

TerraformRead

Terraform Resource

A Terraform resource is a block of HCL configuration that declares one piece of infrastructure — like an EC2 instance, an S3 bucket, or a DNS record. Terraform creates, updates, and deletes the real-world object to match the resource declaration.

TerraformRead

Terraform State File

The terraform.tfstate file is a JSON file that Terraform uses to track the real-world infrastructure it has created. It maps each resource in your configuration to its actual ID in the cloud provider — like an EC2 instance ID or an S3 bucket name.

TerraformRead

Terraform Validate and Tflint

terraform validate checks that a Terraform configuration is syntactically correct and internally consistent — catching errors before plan or apply. Tflint is a Terraform linter that catches additional issues like deprecated syntax, missing required provider version constraints, and provider-specific rule violations.

TerraformRead

Terraform Workspace

A Terraform workspace is a named instance of state within a single backend configuration. Workspaces allow running the same Terraform configuration against separate state files — often used to manage dev, staging, and production environments from one codebase.

TerraformRead

Terragrunt

Terragrunt is a thin wrapper around Terraform that adds features for DRY (Don't Repeat Yourself) configurations — automatically configuring remote state backends, enabling module dependency management, and reducing copy-paste across environments.

TerraformRead

tfvars File

A .tfvars file (terraform.tfvars or *.auto.tfvars) contains values for Terraform input variables, keeping configuration values separate from variable declarations. Different .tfvars files for dev, staging, and production let you reuse the same infrastructure code with environment-specific settings.

TerraformRead

AWS

AMI

Amazon Machine Image. A pre-built template containing the OS, installed software, and configuration used to launch EC2 instances. Custom AMIs with your app pre-installed reduce boot time from minutes to seconds.

AWSRead

AWS CloudTrail

Records every API call made in your AWS account — console clicks, CLI commands, and SDK calls. Answers who did what, when, and from where. 90 days of history free, longer with an S3 Trail.

AWSRead

Amazon Aurora

AWS cloud-native relational database compatible with PostgreSQL and MySQL. 5x faster than MySQL, storage auto-grows to 128 TB, and data is stored in 6 copies across 3 Availability Zones automatically.

AWSRead

Amazon DynamoDB

DynamoDB is AWS's fully managed, serverless NoSQL database delivering single-digit-millisecond read and write latency at any scale, with no capacity planning required in On-Demand mode. Tables store schema-flexible items identified by a mandatory primary key, making it ideal for simple, high-throughput key-based access patterns rather than workloads needing SQL joins or complex ad-hoc queries.

AWSRead

Amazon EFS

EFS (Elastic File System) is a fully managed NFS file system that multiple EC2 instances or Fargate tasks can mount simultaneously across different Availability Zones, with all changes visible to every mounted client immediately. It scales storage automatically with no capacity to provision, replicates data across multiple AZs by default, and is the only shared storage option ECS Fargate tasks can attach to, since EBS cannot mount to Fargate.

AWSRead

Amazon RDS

RDS (Relational Database Service) is AWS's managed hosting for SQL databases — PostgreSQL, MySQL, MariaDB, Oracle, and SQL Server — where AWS handles OS patching, automated backups, Multi-AZ failover, and storage scaling. You cannot SSH into an RDS instance; that trade-off is the cost of offloading infrastructure management. Applications manage schema, queries, and indexes as they would with any SQL engine.

AWSRead

Amazon Redshift

Amazon Redshift is AWS's managed data warehouse, using columnar storage to make analytical queries across billions of rows fast by reading only the columns a query actually needs. It's kept separate from production databases; ETL jobs load data from RDS, DynamoDB, or S3 into Redshift, where analysts and BI tools query it without adding load to production systems.

AWSRead

Amazon S3

Simple Storage Service. Object storage for files of any type up to 5 TB each. Globally unique bucket names, virtually unlimited capacity, and 11 nines of durability across multiple Availability Zones.

AWSRead

Amazon SNS

SNS (Simple Notification Service) is a pub/sub messaging service where a single message published to a topic is delivered to every subscriber simultaneously — unlike SQS, where each message goes to exactly one consumer. Subscribers can be SQS queues, Lambda functions, HTTP endpoints, email, or SMS, and publishers never need to know who's subscribed, letting you add new consumers without changing the producer.

AWSRead

Amazon SQS

SQS (Simple Queue Service) is a fully managed message queue that decouples producers from consumers — each message is delivered to and processed by exactly one consumer, then deleted. Standard queues offer unlimited throughput with at-least-once, best-effort-ordered delivery; FIFO queues guarantee strict ordering and exactly-once processing at lower throughput, making SQS the standard buffer for absorbing traffic spikes before they hit a database.

AWSRead

Auto Scaling Group

An Auto Scaling Group (ASG) manages a fleet of EC2 instances automatically — launching new instances when load increases, terminating them when load drops, and replacing unhealthy ones without human involvement. It operates between a defined minimum and maximum instance count, adjusting toward a desired count driven by scaling policies such as target tracking or scheduled scaling.

AWSRead

CloudFormation Stack

A CloudFormation Stack is a deployed instance of a CloudFormation template — all defined resources (VPCs, EC2 instances, RDS databases, IAM roles) are created, updated, and deleted together as one managed unit. This makes infrastructure reproducible and version-controlled: the same template deployed as separate dev and prod stacks guarantees identical environments instead of manual console clicks drifting apart over time.

AWSRead

CloudWatch Alarm

A CloudWatch Alarm watches a single metric and automatically triggers an action — stopping or recovering an EC2 instance, scaling an Auto Scaling Group, or notifying via SNS — when the metric crosses a defined threshold. Alarms exist in one of three states: OK, ALARM, or INSUFFICIENT_DATA, and enable automated operational responses without requiring a human to be watching a dashboard.

AWSRead

DAX

DAX (DynamoDB Accelerator) is a fully managed, in-memory cache that sits in front of DynamoDB and returns cached reads in microseconds instead of DynamoDB's normal single-digit-millisecond latency. It's the only AWS caching layer that requires zero application code changes — the SDK call is identical, only the endpoint changes — because DAX speaks the native DynamoDB API.

AWSRead

EBS Volume

EBS (Elastic Block Store) is network-attached, persistent block storage for EC2 instances that behaves like a physical hard drive but survives instance stop and restart. Each volume is locked to a single Availability Zone and attaches to one EC2 instance at a time. Production workloads should default to gp3, which decouples IOPS and throughput from provisioned size, unlike the legacy gp2 type.

AWSRead

EC2 Instance

An EC2 Instance is a virtual server rented on demand from AWS, where you choose the operating system, CPU, memory, and storage, and pay only for the time it runs. Every other AWS compute service — ECS, EKS, EMR — ultimately runs on EC2 underneath. Instance types are named by family and size (e.g. `m5.2xlarge`), where the family letter signals whether it's optimized for general use, compute, memory, storage, or GPU workloads.

AWSRead

EC2 Instance Store

EC2 Instance Store is physical NVMe storage directly attached to the host server running your instance, delivering the highest possible IOPS on AWS with zero network latency since there's no network hop involved. Unlike EBS, data is permanently lost whenever the instance is stopped or terminated, making it suitable only for temporary data the application can regenerate — never for anything that must survive a restart.

AWSRead

ECS Task

A running instance of a Task Definition in Amazon ECS — equivalent to a running Docker container. Tasks are managed by ECS Services which keep a desired number of tasks running and replace failed ones automatically.

AWSRead

ElastiCache

ElastiCache is AWS's managed in-memory caching service for Redis and Memcached, returning frequently accessed data in under 1 millisecond and dramatically reducing read load on RDS or DynamoDB. Unlike DAX, it requires explicit application code to check the cache before falling back to the database, giving more flexibility to cache computed or aggregated results rather than only raw items.

AWSRead

Glue Data Catalog

A central metadata repository that stores table definitions — column names, data types, and S3 locations — for your data lake. Athena, Redshift Spectrum, and EMR all use it to discover and query data without manual table definitions.

AWSRead

GuardDuty

GuardDuty is AWS's managed threat detection service that continuously analyzes CloudTrail logs, VPC Flow Logs, and DNS logs using machine learning and threat intelligence to detect compromised instances, credential misuse, and cryptocurrency mining — with no agents to install. It generates findings but does not block anything on its own; automated response requires wiring findings to EventBridge and Lambda.

AWSRead

IAM Role

An IAM Role is an AWS identity with temporary, automatically rotating credentials, designed for services and applications rather than humans. EC2 instances, Lambda functions, and ECS tasks assume a role to access other AWS services, receiving short-lived credentials that expire on their own — eliminating the risk of long-lived access keys sitting exposed on disk indefinitely.

AWSRead

KMS Key

A KMS Key is an encryption key managed by AWS Key Management Service, used to encrypt data across S3, EBS, RDS, DynamoDB, and other services without your application ever handling raw key material directly. Every encrypt and decrypt operation is logged automatically in CloudTrail. Only Customer Managed Keys (CMKs) can be shared across AWS accounts — AWS-owned and AWS-managed keys cannot.

AWSRead

Kinesis Data Streams

A real-time streaming service that collects and stores streaming data for 1 to 365 days. Multiple consumers can read the same stream simultaneously and replay data from any point in the retention window.

AWSRead

Kinesis Firehose

A fully managed delivery service that loads streaming data into S3, Redshift, OpenSearch, or third-party destinations. Buffers data by size or time and delivers in near-real-time batches. No consumer code needed.

AWSRead

Lambda Function

A Lambda Function is a serverless unit of code that runs only when triggered by an event — an API call, file upload, queue message, or scheduled timer — with AWS managing all provisioning and scaling. You pay only for the milliseconds your code actually executes, and each invocation is capped at a 15-minute maximum runtime, making Lambda suited to short, event-driven workloads rather than long-running processes.

AWSRead

Load Balancer

A load balancer distributes incoming traffic across multiple EC2 instances, containers, or IPs, continuously health-checking every backend and automatically removing unhealthy targets from rotation. AWS offers three types: ALB for Layer 7 HTTP/HTTPS routing decisions, NLB for ultra-low-latency Layer 4 TCP/UDP traffic with static IPs, and GWLB for routing packets through third-party security appliances.

AWSRead

Multi-AZ RDS

An RDS high availability configuration that keeps a synchronous standby copy in a different Availability Zone. If the primary fails, RDS automatically promotes the standby in 60-120 seconds with no data loss.

AWSRead

NAT Gateway

A NAT Gateway lets EC2 instances in a private subnet make outbound internet requests — pulling OS updates, calling external APIs — without being reachable from the internet or requiring a public IP. It lives in a public subnet, requires an Elastic IP, and is fully managed by AWS with no patching or scaling required.

AWSRead

Read Replica

A read-only copy of an RDS or Aurora database that handles SELECT queries. Uses asynchronous replication from the primary — there may be seconds of lag. Scales read throughput, not high availability.

AWSRead

Route Table

A set of rules inside a VPC directing where network traffic goes based on destination IP. Every subnet must associate with one route table. Public subnets route to the Internet Gateway, private subnets route to NAT Gateway.

AWSRead

Savings Plan

A flexible AWS pricing model where you commit to a minimum spend per hour for 1 or 3 years in exchange for up to 72% discount on compute services including EC2, Lambda, and Fargate.

AWSRead

Security Group

A Security Group is a stateful virtual firewall attached to EC2 instances, RDS databases, and other AWS resources that supports allow rules only — there is no explicit deny. Because it's stateful, return traffic for an allowed inbound connection is automatically permitted outbound without a matching rule, unlike stateless Network ACLs which require explicit rules in both directions.

AWSRead

Subnet

A segment of a VPC's IP address range locked to one Availability Zone. Public subnets route internet traffic to an Internet Gateway. Private subnets route outbound traffic to a NAT Gateway.

AWSRead

VPC

A VPC (Virtual Private Cloud) is your logically isolated private network inside AWS, where every resource — EC2, RDS, Lambda, ECS — receives a private IP address and resources in different VPCs cannot communicate by default. You define the IP address range, subnets, route tables, and internet access, giving full control over network isolation and traffic flow.

AWSRead

Microsoft Azure

Access Tier

A setting on blob storage that determines the cost and retrieval latency of stored data, offered as Hot (frequent access), Cool (infrequent, 30+ day retention), and Archive (rare access, hours-long rehydration).

Microsoft AzureRead

App Service Plan

An App Service Plan defines the compute resources — VM size, region, and pricing tier — that power one or more Azure App Service web apps, function apps, or API apps. Multiple apps can share a single plan and its underlying instances, and scaling (manual or automatic) is configured at the plan level, meaning every app on that plan scales together.

Microsoft AzureRead

Application Gateway

Azure Application Gateway is a Layer 7 load balancer that routes HTTP/HTTPS traffic based on URL path or host header, terminates TLS, and includes an integrated Web Application Firewall (WAF) to block common exploits like SQL injection and cross-site scripting. It's the Azure equivalent of an AWS ALB, purpose-built for web application traffic rather than raw TCP/UDP.

Microsoft AzureRead

Availability Set

A logical grouping of VMs within a datacenter that spreads them across separate fault domains and update domains, protecting against hardware failures and planned host maintenance taking down all instances at once.

Microsoft AzureRead

Availability Zone

A physically separate datacenter within an Azure region, each with independent power, cooling, and networking, used to distribute VMs so a single datacenter failure doesn't take down an entire application.

Microsoft AzureRead

Azure Bastion

A fully managed PaaS service that provides secure RDP and SSH connectivity to VMs directly through the Azure Portal over TLS, without exposing the VM's public IP or opening inbound ports to the internet.

Microsoft AzureRead

Azure Container Registry

A managed, private Docker registry service in Azure used to store and manage container images, integrated with AKS, ACI, and App Service for authenticated image pulls without exposing images publicly.

Microsoft AzureRead

Azure Front Door

A global, edge-based entry point that provides Layer 7 load balancing, SSL offloading, and CDN caching across multiple Azure regions, routing users to the closest healthy backend for low-latency global applications.

Microsoft AzureRead

Azure Key Vault

Azure Key Vault is a managed service for securely storing and controlling access to secrets, encryption keys, and TLS/SSL certificates, so credentials never need to be hardcoded in application config or source code. Applications authenticate via Entra ID identities and retrieve secrets at runtime through RBAC-scoped access policies, and every access is logged for audit purposes.

Microsoft AzureRead

Azure Load Balancer

A Layer 4 (TCP/UDP) load balancing service that distributes incoming traffic across a pool of backend VMs or Scale Set instances, used for high-throughput, protocol-agnostic traffic distribution within a region.

Microsoft AzureRead

Azure Monitor

Azure Monitor is Azure's unified platform for collecting, analyzing, and acting on metrics, logs, and traces from Azure resources, applications, and infrastructure. It underpins Log Analytics for querying with Kusto Query Language (KQL), Application Insights for application performance monitoring, and alert rules that trigger notifications or automated actions when defined conditions are met.

Microsoft AzureRead

Azure Policy Initiative

A collection of individual Azure Policy definitions grouped together and assigned as a single unit, used to enforce a broader compliance standard (such as "PCI-DSS baseline") across multiple resources at once.

Microsoft AzureRead

Azure Private Endpoint

A network interface that connects privately to an Azure PaaS service (like Storage or SQL Database) using a private IP address from your VNet, eliminating exposure of that service over the public internet.

Microsoft AzureRead

Azure Resource Manager

The deployment and management layer that all Azure tools (Portal, CLI, PowerShell, SDKs) go through to create, update, and delete resources, processing requests as declarative JSON templates with built-in dependency resolution.

Microsoft AzureRead

Azure Secure Score

Azure Secure Score is a percentage-based metric within Microsoft Defender for Cloud that quantifies your overall security posture by measuring how many recommended security controls — like MFA enforcement, disk encryption, and network hardening — are actually implemented across your subscriptions. Each recommendation carries a weighted point value, and completing it raises the score, giving teams a single number to track improvement over time.

Microsoft AzureRead

Azure Tag

An Azure Tag is a key-value metadata pair attached to a resource, resource group, or subscription, used to organize resources for cost allocation, automation, and governance without affecting how the resource actually functions. Tags like `environment:production` or `team:payments` let teams filter cost reports, target automation scripts, and enforce policy based on metadata rather than resource names alone.

Microsoft AzureRead

Azure Tenant

A dedicated instance of Microsoft Entra ID representing a single organization, serving as the identity boundary that contains users, groups, and app registrations, with one or more Azure subscriptions trusting it for authentication.

Microsoft AzureRead

Azure VPN Gateway

A managed service that creates an encrypted IPsec/IKE tunnel over the public internet between an on-premises network (or another VNet) and an Azure Virtual Network, used when ExpressRoute's dedicated circuit isn't required.

Microsoft AzureRead

Blob Storage Container

A logical grouping inside an Azure Storage Account that holds blobs (unstructured files like images, logs, or backups), similar to a folder but with its own access policy and public-access setting.

Microsoft AzureRead

Conditional Access Policy

An Entra ID feature that enforces access rules based on signals like user location, device compliance, and risk level, requiring conditions such as MFA or blocking sign-in entirely when those conditions aren't met.

Microsoft AzureRead

Deployment Slot

A separate, live instance of an App Service (such as staging) that shares the same App Service Plan as production and can be swapped with it for zero-downtime deployments and instant rollback.

Microsoft AzureRead

ExpressRoute

Azure ExpressRoute is a dedicated, private network connection between an on-premises datacenter and Azure that bypasses the public internet entirely, offering higher reliability, lower latency, and greater bandwidth than a site-to-site VPN. It's typically used by enterprises with strict compliance or performance requirements who need consistent, predictable connectivity to their Azure resources.

Microsoft AzureRead

Fault Domain

A logical grouping representing shared physical infrastructure (power source and network switch) within a datacenter; VMs in different fault domains within an Availability Set won't fail together from a single hardware fault.

Microsoft AzureRead

Kusto Query Language (KQL)

Kusto Query Language (KQL) is the query language used across Azure Monitor Log Analytics, Application Insights, and Microsoft Sentinel to search, filter, and aggregate large volumes of log and telemetry data. It uses a readable pipe-based syntax (`|`) chaining operators like `where`, `summarize`, and `project`, purpose-built for fast exploration of time-series and event data rather than relational joins.

Microsoft AzureRead

Lifecycle Management Policy

An Azure Storage Lifecycle Management Policy is a rule-based configuration that automatically transitions blobs between access tiers (Hot, Cool, Archive) or deletes them based on age or last-access time, without manual intervention. It's the primary cost-optimization lever for large or growing blob storage accounts where most data cools off in access frequency over time.

Microsoft AzureRead

Log Analytics Workspace

The centralized data store in Azure Monitor where log and telemetry data from multiple resources is collected, retained, and queried using KQL, serving as the backend for alerts, dashboards, and diagnostics.

Microsoft AzureRead

Managed Disk

A block-level storage volume managed by Azure and attached to a virtual machine, available in Standard HDD, Standard SSD, Premium SSD, and Ultra Disk performance tiers, with Azure handling the underlying storage account.

Microsoft AzureRead

Managed Identity

An automatically managed identity in Entra ID tied directly to an Azure resource (like a VM or App Service), allowing that resource to authenticate to other Azure services without any stored credentials or secrets.

Microsoft AzureRead

Management Group

A container above subscriptions used to organize multiple subscriptions under a shared hierarchy, allowing RBAC roles and Azure Policies to be applied once and inherited down to every subscription and resource group beneath it.

Microsoft AzureRead

Microsoft Entra ID

Microsoft Entra ID (formerly Azure Active Directory) is Azure's cloud-based identity and access management service, handling authentication and authorization for users, groups, and applications across Azure resources and Microsoft 365. It underpins role-based access control (RBAC), Managed Identities, conditional access, and single sign-on across an organization's entire cloud footprint, replacing scattered per-app credentials with one central identity provider.

Microsoft AzureRead

Multi-Factor Authentication (Azure)

An Entra ID security feature requiring users to verify their identity through a second factor (authenticator app, SMS, or hardware key) in addition to a password before gaining access, typically enforced through Conditional Access.

Microsoft AzureRead

Network Security Group

An Azure Network Security Group (NSG) is a stateful firewall that filters inbound and outbound traffic to resources within a virtual network, using prioritized allow/deny rules evaluated in order by priority number. NSGs can be attached to a subnet, a network interface, or both, and Azure evaluates the combined rule set to decide whether traffic is permitted.

Microsoft AzureRead

RBAC Scope

In Azure Role-Based Access Control, scope defines the boundary at which a role assignment applies — management group, subscription, resource group, or individual resource — with permissions inheriting downward from broader to narrower scopes. Assigning a role at the narrowest scope that satisfies the need follows the principle of least privilege and limits the blast radius of a compromised identity.

Microsoft AzureRead

Resource Group

An Azure Resource Group is a logical container that holds related resources — VMs, databases, storage accounts — for a solution, sharing a common lifecycle for deployment, access control, and billing. Deleting a resource group deletes every resource inside it, and RBAC permissions and tags applied at the resource group level cascade down to everything it contains.

Microsoft AzureRead

Service Principal

An identity used by applications, CI/CD pipelines, or scripts to authenticate to Azure and access resources under defined RBAC permissions, distinct from a user identity and typically authenticated via a client secret or certificate.

Microsoft AzureRead

Shared Access Signature

A Shared Access Signature (SAS) is a URI-based token that grants time-limited, scoped access to Azure Storage resources — blobs, queues, tables, or files — without sharing the storage account's master key. It encodes the permissions (read, write, delete), start and expiry times, and allowed IP ranges directly in the signed token, letting you hand out narrow, revocable access to a specific container or file.

Microsoft AzureRead

Soft Delete (Azure)

A data-protection feature that retains deleted blobs, containers, or Key Vault secrets in a recoverable state for a configured retention period before permanent deletion, protecting against accidental or malicious data loss.

Microsoft AzureRead

Storage Redundancy

The replication strategy applied to a Storage Account to protect against data loss, ranging from LRS (three copies in one datacenter) to ZRS (copies across availability zones) to GRS (copies replicated to a secondary region).

Microsoft AzureRead

Subscription

A billing and access-management boundary in Azure that groups resource groups together, tied to an Azure AD/Entra ID tenant, and used to apply spending limits, quotas, and top-level access policies.

Microsoft AzureRead

Update Domain

An Update Domain is a logical grouping Azure uses within an Availability Set to ensure that planned maintenance (host OS updates, patching) is rolled out to VMs in batches rather than all at once, so at least one instance of a redundant application stays running during platform maintenance. Azure updates one Update Domain at a time, waiting a grace period between domains before proceeding to the next.

Microsoft AzureRead

VM Scale Set

An Azure Virtual Machine Scale Set (VMSS) manages a group of identical, load-balanced VMs that scale automatically based on demand or a defined schedule, and automatically replaces unhealthy instances. It's the Azure equivalent of an AWS Auto Scaling Group — a single model defines the VM image, size, and configuration applied uniformly across every instance in the set.

Microsoft AzureRead

Virtual Network

An Azure Virtual Network (VNet) is your isolated private network within Azure, providing the address space, subnets, and routing that resources like VMs, App Services, and databases use to communicate securely with each other, the internet, and on-premises networks. Resources in separate VNets cannot communicate by default unless connected via peering or a gateway.

Microsoft AzureRead

GCP

Artifact Registry

Google Cloud's current, unified package and container image storage service, the successor to the older Container Registry. It supports container images alongside language packages like npm, Maven, and Python packages in one service, and supports cleanup policies to automatically remove old, untagged image versions.

GCPRead

BigQuery

Google Cloud's serverless data warehouse for analytics, priced based on the volume of data a query actually scans rather than pre-provisioned compute capacity. Selecting only needed columns and querying a properly partitioned table's relevant date range are the two highest-impact levers for controlling BigQuery cost.

GCPRead

Bigtable (GCP)

A wide-column NoSQL database built for very high throughput at extremely low latency, suited to time-series data, IoT telemetry, and analytics workloads with massive write volume. It is a specialized tool distinct from Firestore's document model or Cloud SQL's relational model.

GCPRead

Billing Account (GCP)

A separate object from a Project that holds the actual payment method for Google Cloud usage. One Billing Account can be linked to many Projects, all of whose usage is billed to that same account, letting a company centralize payment while individual Projects retain their own separate IAM control over resources.

GCPRead

Cloud Armor

A security policy service attached to a Global External HTTP(S) Load Balancer, filtering malicious requests before they reach the backend. It supports rate-based rules blocking a single source IP exceeding a request threshold, and preconfigured WAF rules blocking common attack patterns like SQL injection, Google's equivalent of AWS WAF or Azure WAF.

GCPRead

Cloud Functions (GCP)

Google Cloud's event-driven, single-purpose compute service, the most granular and shortest-lived compute unit in GCP's compute spectrum. It fits a narrow niche compared to Cloud Run - a specific triggered action like resizing an uploaded image, rather than a full application with multiple routes and business logic.

GCPRead

Cloud Load Balancing

Google Cloud's family of load balancing products, spanning Global External HTTP(S) Load Balancers (public, distributed globally via a single IP), Regional External Load Balancers, and Internal Load Balancers reachable only from within the VPC. The right type depends on traffic type and whether the backend should ever be reachable from the public internet.

GCPRead

Cloud Logging

Google Cloud's service for collecting, storing, and querying log data from every GCP service and custom applications. Its query filter syntax lets logs be narrowed by resource, severity, and specific field values, and Log Sinks can route matching logs to BigQuery, Cloud Storage, or Pub/Sub for long-term retention beyond the default window.

GCPRead

Cloud Monitoring

Google Cloud's metrics, dashboards, and alerting service. An alert policy requires a Notification Channel explicitly attached to actually notify someone when it fires - without one, the policy still evaluates and logs its own firing history, but nobody is ever told, a common and easy-to-miss misconfiguration.

GCPRead

Cloud NAT

A service providing outbound-only internet connectivity for resources with no external IP address, GCP's equivalent of an AWS or Azure NAT Gateway. Cloud NAT requires a Cloud Router in the same region and provides zero inbound connectivity capability - a resource behind it remains completely unreachable from the internet.

GCPRead

Cloud Run

A fully managed, serverless platform for running containerized applications, scaling automatically to zero when idle and billing only for actual invocations. It combines the flexibility of running any container with zero OS management overhead, making it the right default for a standard stateless containerized web service.

GCPRead

Cloud SQL

Google Cloud's managed relational database service, supporting MySQL, PostgreSQL, and SQL Server. It is the right default for a traditional relational workload with moderate scale needs, handling patching, backups, and replication automatically without requiring OS-level access to the underlying database server.

GCPRead

Cloud Spanner

A globally distributed, strongly consistent relational database offering both SQL semantics and horizontal scalability beyond what a single Cloud SQL instance can provide. It is the right choice specifically when a workload needs both relational query capability and massive scale simultaneously, not simply because a workload feels large or important.

GCPRead

Cloud Storage Bucket

The top-level container for objects in Google Cloud Storage, GCP's object storage service equivalent to AWS S3 or Azure Blob Storage. Every object uploaded to Cloud Storage must belong to exactly one bucket, and bucket-level settings control default storage class, location, and access permissions for everything inside it.

GCPRead

Cloud VPN (GCP)

A service connecting an on-premises network to a GCP VPC over an encrypted tunnel, similar to VPN Gateway in Azure or a Site-to-Site VPN in AWS. It requires a Cloud Router as its foundation and is distinct from VPC Network Peering, which connects two GCP VPCs directly rather than an external network.

GCPRead

Compute Engine

Google Cloud's Infrastructure-as-a-Service offering, providing full virtual machines with complete OS-level control. It is the right choice specifically when a workload needs custom software, specific OS configurations, or hardware-level access that GKE and Cloud Run don't expose.

GCPRead

Error Reporting (GCP)

A Google Cloud operations service that automatically aggregates and groups application errors from logs and instrumented code, surfacing recurring error patterns and their frequency without requiring manual log searching for each individual occurrence.

GCPRead

Firestore

A serverless NoSQL document database built for mobile and web application data, flexible schemas, and real-time client synchronization. It is not a strong fit for workloads needing complex relational joins or multi-row transactions across unrelated entities, which point instead to Cloud SQL or Spanner.

GCPRead

GCP Audit Log

A specific category of Cloud Logging entry recording administrative actions and data access. Admin Activity logs (configuration changes) are always enabled and cannot be disabled; Data Access logs (who read or wrote actual data) are disabled by default for most services and must be explicitly enabled before that history exists.

GCPRead

GCP Firewall Rule

A rule defined at the VPC level controlling inbound or outbound traffic, applied using network tags or Service Accounts on instances rather than being tied to a specific subnet boundary. A firewall rule only affects VMs carrying the exact matching tag or identity - a VM without it is entirely unaffected, silently, with no error to flag the mismatch.

GCPRead

GCP Folder

An optional grouping node in the GCP resource hierarchy, sitting between the Organization and individual Projects. Folders are commonly used to group Projects by team, department, or environment, letting IAM permissions and Organization Policies be applied once at the Folder level rather than repeated across every Project inside it.

GCPRead

GCP IAM Role Types

Google Cloud IAM roles come in three types: Basic roles (Owner, Editor, Viewer) which are broad and legacy; Predefined roles curated by Google and scoped to a specific service's specific needs; and Custom roles built from individual permissions for access needs a predefined role doesn't precisely match.

GCPRead

GCP Organization

The top-level node in Google Cloud's resource hierarchy, tied to a Google Workspace or Cloud Identity domain. An Organization contains Folders and Projects, and policies or IAM permissions set at this level automatically apply to everything beneath it across the entire company.

GCPRead

GCP Project

The fundamental unit of organization in Google Cloud - every resource belongs to exactly one Project, which serves as the boundary for billing, IAM permissions, and API enablement. A Project has a permanent, globally unique Project ID chosen at creation and never changeable, distinct from its display name which can be updated freely.

GCPRead

GCP Quota

A default limit on how much of a specific resource (like VM CPUs or API calls) can be used per Project per region, designed to prevent runaway costs and protect shared infrastructure. Quotas can be checked and increased through the Console ahead of a known future need, such as a planned launch event.

GCPRead

GCP Storage Class

A pricing and access tier for Cloud Storage objects - Standard, Nearline, Coldline, or Archive - trading lower storage cost against higher retrieval cost and a longer minimum storage duration. Deleting or overwriting an object before its class's minimum duration elapses still bills as if it were stored the full minimum period.

GCPRead

GKE Autopilot

A mode of Google Kubernetes Engine where Google manages node provisioning, sizing, and patching entirely - you define workloads, and nodes appear automatically to run them, billed per pod resource request rather than per node. It is the lower-effort default for most containerized workloads, versus Standard mode's direct node pool control.

GCPRead

Managed Instance Group

A group of identical Compute Engine VMs created from an Instance Template and managed as a single unit, GCP's equivalent of an AWS Auto Scaling Group or Azure VM Scale Set. A Managed Instance Group can autoscale based on a metric like CPU utilization, adding or removing instances automatically within configured minimum and maximum bounds.

GCPRead

Network Tag (GCP)

A freeform string label attached to a Compute Engine VM at creation time, used to target firewall rules to specific VMs. Network tags are simple but can be forgotten or misspelled at scale, which is why Service Account-based targeting is often preferred for anything security-critical in a growing fleet.

GCPRead

OS Login

A Compute Engine feature that ties SSH access to a user's actual Google Identity and IAM permissions, rather than manually managing individual SSH public keys per VM. Enabling OS Login means revoking a departing employee's GCP access also immediately revokes their SSH access to every VM, with no separate key cleanup needed.

GCPRead

Organization Policy (GCP)

A constraint applied at the Organization, Folder, or Project level that restricts what resources are allowed to look like across everything beneath that level - for example, blocking external IP addresses on VMs or restricting allowed regions. Unlike IAM, which controls who can act, Organization Policy controls what configurations are permitted.

GCPRead

Persistent Disk (GCP)

The block storage attached to a Compute Engine VM, equivalent to an AWS EBS volume or Azure Managed Disk. Persistent Disks come in zonal (replicated within one zone, lower cost) and regional (synchronously replicated across two zones, survives a single zone failure) variants.

GCPRead

Security Command Center

Google Cloud's security posture management service, continuously scanning deployed resources against security best practices and surfacing specific, severity-ranked findings - like a publicly accessible storage bucket - rather than a single opaque score. Findings should be prioritized by actual severity, not treated as a count to minimize.

GCPRead

Service Account (GCP)

An identity used by applications, VMs, and automated processes to authenticate to Google Cloud APIs, rather than by a human user. A Service Account is itself also a resource with its own IAM permissions, and can be attached directly to a VM or impersonated temporarily, both safer alternatives to downloading its long-lived JSON key file.

GCPRead

Shared VPC

A configuration where one Project (the host) owns a VPC network, while other Projects (service projects) attach to it and deploy resources using its subnets. This centralizes network administration in the host Project while letting individual teams in service Projects still manage their own resources independently.

GCPRead

Spot VM (GCP)

A Compute Engine VM using Google's spare, unused capacity at a steep discount, with the trade-off that Google can reclaim the instance with short notice. Spot VMs are appropriate only for fault-tolerant, interruption-tolerant workloads like batch processing, never for customer-facing services needing reliable availability.

GCPRead

VPC (GCP)

A Virtual Private Cloud in Google Cloud is a global resource by default, unlike the regional VPC or VNet model in AWS or Azure - a single GCP VPC can span every region, with individual subnets defined per-region inside it. The default auto-mode VPC pre-creates a subnet in every region, while a custom-mode VPC starts empty until subnets are deliberately defined.

GCPRead

VPC Network Peering

A direct connection between two separate VPCs, potentially in different Projects or Organizations, with traffic never touching the public internet. Peering must be established from both sides to become active, and is explicitly non-transitive - if VPC A peers with B, and B peers with C, A cannot reach C without its own direct peering connection to C.

GCPRead