Reference · Glossary
Glossary
Every term this course leans on without stopping to define it mid-lesson, gathered into one alphabetical, searchable page — GitOps and the Argo family, service-mesh and eBPF vocabulary, policy-as-code, observability, the developer portal, supply-chain signing, Linux fundamentals, and the vocabulary of the Kubestronaut program itself.
☺ Explain it like I'm 10
If a lesson uses a word you don't recognize — ztunnel, PolicyReport, Fulcio — it's defined here in one or two sentences, not buried three paragraphs into a page you've already left. Search the box below or scan the list; nothing here assumes you already know the acronym.
Admission controlReal-time enforcement at the moment a resource is written to the Kubernetes API, before it reaches etcd — the layer that blocks a bad object outright instead of noticing it later on a reconcile pass. Kyverno's mutating and validating webhooks are this course's working example.
Ambient meshIstio's sidecar-less data-plane shape: a shared per-node ztunnel handles mTLS and L4 for every pod, with an optional per-namespace waypoint proxy added only where L7 policy is actually needed, instead of injecting an Envoy sidecar into every pod.
AnalysisRunThe Argo Rollouts object that queries a metrics provider such as Prometheus at a canary or blue-green gate and can promote or abort the release on its own, without a human watching a dashboard.
Argo CDThe most widely run GitOps controller, and 34% of the CAPA blueprint on its own: it watches a Git repository, continuously compares it against what's actually running in the cluster, and syncs the two through its Application custom resource.
Argo EventsThe smallest of the four Argo projects: it turns something happening outside the cluster — a webhook, a queue message, a cron tick — into a Kubernetes object, so an external event can start a Workflow or nudge a Rollout.
Argo RolloutsA controller that replaces the plain Kubernetes Deployment with a Rollout resource carrying a real strategy — canary or blue-green — plus pauses and metric-checked gates a rolling update alone can't express.
Argo WorkflowsThe Argo family's workflow engine: a multi-step pipeline declared as one custom resource and run to completion as real pods, sequenced through steps or a dag, rather than reconciled forever the way Argo CD is.
BackstageThe CNCF developer-portal project this course's CBA credential is built around: a forked, self-hosted TypeScript monorepo split into a public-facing app package and a credential-holding backend, extended through installable plugins.
Blue-green deploymentA release strategy that runs the new version fully live behind a preview service, then cuts all traffic over at once once it passes checks, keeping the old version warm as an instant rollback target. One of Argo Rollouts' two strategy types.
Canary releaseA release strategy that ramps traffic to a new version in small, authored steps with pauses between them, so a regression is caught while it can only affect a fraction of users. Argo Rollouts' other strategy type, and the one most often gated by an AnalysisRun.
CAPA (Certified Argo Project Associate)The exam covering all four Argo projects in one blueprint: Argo Workflows 36%, Argo CD 34%, Argo Rollouts 18%, Argo Events 12%.
CBA (Certified Backstage Associate)The exam built around Backstage: Customizing Backstage 32%, Development Workflow 24%, Infrastructure 22%, Catalog 22%.
CCA (Cilium Certified Associate)The exam built around Cilium, weighted heavily toward Architecture and Network Policy — 38% of the blueprint together — and tested against this specific CNI by name rather than as a vendor-neutral concept.
CGOA (Certified GitOps Associate)The vendor-neutral exam behind this course's GitOps thread: Principles 30%, Terminology 20%, Patterns 20%, Related Practices 16%, Tooling 14%.
cgroupsThe Linux kernel mechanism, short for control groups, that limits and accounts for a process's CPU, memory, and I/O — the primitive underneath both systemd's resource directives and every container runtime's resource limits.
CiliumThe CNCF-graduated, eBPF-based CNI this course's CCA exam is built around: cilium-agent compiles Services and CiliumNetworkPolicy into kernel eBPF programs on every node, enforcing on pod identity rather than IP.
CiliumNetworkPolicy (CNP)Cilium's own network-policy object, layered on top of the standard Kubernetes NetworkPolicy with far more grammar: L7 HTTP, DNS or Kafka rules, egress by hostname, entity selectors, and explicit deny.
ClusterPolicyThe Kyverno custom resource a validate, mutate, generate, or verifyImages rule lives inside, reconciled through Git by Argo CD or Flux like any other GitOps-managed workload.
Control loopA closed-loop control system in the control-theory sense: a setpoint, a sensor reading actual state, a comparator producing an error signal, and an actuator correcting it — the model underneath every GitOps reconciler.
CosignThe Sigstore CLI used to sign and verify container images. In a keyless flow it trades an OIDC identity for a short-lived Fulcio certificate, signs the image digest, records the event in Rekor, and discards the private key.
Data planeIn a service mesh, the layer that actually carries traffic — an Envoy sidecar per pod, or Cilium's own eBPF datapath — as opposed to the control plane that computes what the data plane should do.
DestinationRuleThe Istio object that defines named subsets of pods and a traffic policy — load balancing, connection pools, circuit breaking — for a destination once a VirtualService has already decided a request belongs there. Name a subset with no matching DestinationRule and the request fails with a bare 503.
DriftThe gap between a system's desired state and its actually observed state — the error term a GitOps reconciler exists to close continuously, not an anomaly to be permanently eliminated. See level-triggered reconciliation.
eBPFA Linux kernel technology that runs sandboxed, verified programs directly in the kernel, letting Cilium replace linear iptables rule-chain traversal with constant-cost hash-map lookups for routing, load balancing, and policy enforcement.
EnvoyThe high-performance proxy Istio's sidecar data plane is built on, handling retries, timeouts, mTLS, and traffic shifting for every mesh-enrolled pod it rides alongside.
FluxA GitOps toolkit of small, single-purpose controllers — no single CRD, no built-in web UI — that answers the same four GitOps principles as Argo CD through a GitRepository source plus a Kustomization or HelmRelease.
FulcioThe Sigstore certificate authority that issues short-lived, roughly ten-minute X.509 certificates bound to an OIDC identity, rather than to a key anyone has to generate, store, or rotate.
GitOpsAn operating model that uses a Git repository as the single source of truth for declarative, versioned infrastructure, pulled automatically by an in-cluster agent and continuously reconciled against it — the four principles CGOA tests directly.
GitOps ToolkitFlux's own name for its family of narrow, composable controllers — source, kustomize, helm, notification, and image-automation — that a team assembles piece by piece instead of adopting one all-in-one product.
Golden KubestronautThe top tier of the CNCF's certification program: all sixteen exams across the Kubernetes core, the Platform pair, the eight project associates, and LFCS, all valid at once. It adds Golden-tier gear, a wellness subscription, free KCD tickets, and — from 2026 — a recommendation letter, on top of plain Kubestronaut's benefits.
GrafanaThe read-only visualization layer over Prometheus, Loki, Tempo and other backends: it queries live and never stores a metric itself, turning PromQL results into dashboards, alerts, and template-variable-driven per-service views.
HelmReleaseThe Flux custom resource that tells the helm controller which Helm chart to install and with which values — Flux's equivalent of pointing an Application at a chart in Argo CD.
HubbleCilium's built-in observability layer: it reads flow events straight out of the same eBPF maps the agent uses to enforce policy, turning them into a queryable, cluster-wide record of who talked to whom and whether the datapath let it through.
ICA (Istio Certified Associate)The hybrid hands-on-plus-multiple-choice exam built around Istio: Traffic Management 35%, Securing Workloads 25%, Installation/Upgrades/Config 20%, Troubleshooting 20%.
Identity-based policyCilium's core enforcement model: every pod sharing the relevant labels shares one numeric identity cluster-wide, so a policy written against that identity survives rescheduling, autoscaling, and IP churn without ever being rewritten.
IstioThe CNCF-graduated, Envoy-based service mesh ICA is built around: a control plane, istiod, computes what every proxy should do, and a data plane — sidecars, or an ambient ztunnel plus waypoint — carries the bytes.
istiodIstio's control-plane component: it takes VirtualService, DestinationRule, and other mesh config and pushes the resulting proxy configuration out to every Envoy sidecar or ztunnel in the mesh.
journaldsystemd's logging component: every unit's stdout, stderr, and structured metadata land in one indexed, trusted binary log queried with journalctl, rather than scattered across flat files.
KCA (Kyverno Certified Associate)The exam built around Kyverno: Writing Policies 32%, Fundamentals 18%, Installation & Upgrades 18%, CLI 12%, Applying Policies 10%, Policy Management 10%.
KubestronautThe CNCF title earned by holding all five Kubernetes core certifications — KCNA, KCSA, CKA, CKAD, CKS — at once. The prerequisite tier beneath Golden Kubestronaut, and the one that first unlocks the jacket and discount vouchers.
KustomizationIn Flux, the custom resource that tells the kustomize controller which path in a Git source to build and apply — not to be confused with a plain kustomization.yaml file, which it wraps.
KyvernoThe CNCF policy engine KCA is built around: a Kubernetes-native admission controller whose rules are plain YAML rather than a separate policy language, split across four rule types — validate, mutate, generate, verifyImages.
Level-triggered reconciliationSampling current-vs-desired state on a fixed cadence regardless of any specific event, so a lost webhook or missed watch event still gets caught on the next pass. Contrast with edge-triggered, which reacts only to a notification and has no fallback if one is lost.
LFCS (Linux Foundation Certified System Administrator)The one exam on the sixteen-exam ladder that isn't a CNCF credential at all: a fully performance-based, two-hour, live-terminal exam covering Linux system administration, including LVM and systemd/journald.
LVM (Logical Volume Manager)The Linux layer between a raw block device and its filesystem: pvcreate claims a Physical Volume, vgcreate pools PVs into a Volume Group, and lvcreate carves a resizable Logical Volume out of that pool, all without unmounting or rebuilding anything.
mTLSMutual TLS: both sides of a connection present and verify a certificate, not just the server, so a service mesh can guarantee both encryption and a verified caller identity on every hop. Istio and Cilium both offer it as a mesh-wide default.
OpenTelemetryThe CNCF observability standard OTCA is built around: a vendor-neutral API, SDK, and data model for traces, metrics, and logs, plus the Collector that receives, reshapes, and exports them.
OpenTelemetry CollectorThe one piece of an OpenTelemetry pipeline that's pure infrastructure rather than application code: a single Go binary whose config declares receivers, processors, exporters, connectors, and extensions, none of which run unless the service's pipelines block explicitly names them.
OTCA (OpenTelemetry Certified Associate)The exam built around OpenTelemetry: API & SDK 46%, Collector 26%, Fundamentals of Observability 18%, Maintaining & Debugging Pipelines 10%.
OTLPThe OpenTelemetry Protocol: the wire format traces, metrics, and logs travel in between an SDK and a Collector, or between two Collectors, typically over gRPC on port 4317 or HTTP on port 4318.
PCA (Prometheus Certified Associate)The exam built around Prometheus: PromQL 28%, Prometheus Fundamentals 20%, Observability Concepts 18%, Alerting & Dashboarding 18%, Instrumentation and Exporters 16%.
Policy-as-codeExpressing security and compliance rules as versioned, reviewable YAML enforced automatically at admission, instead of as a wiki page a human is trusted to remember. Kyverno's ClusterPolicy objects are this course's working example.
PolicyReportThe Kyverno object, namespaced or cluster-scoped, that a ClusterPolicy's results — pass, fail, warn, skip, error — land in, aggregated from both live admission checks and periodic background scans.
Progressive deliveryReleasing a new version gradually and reversibly — canary steps, a blue-green cutover, metric-gated pauses — instead of all at once, so a regression is caught while it can still be stopped cheaply. Argo Rollouts is this course's implementation of it.
PrometheusThe CNCF-graduated metrics system PCA is built around: it pulls, or scrapes, metrics from targets on an interval, stores them in its own local time-series database under a label-based data model, and answers questions about them in PromQL.
PromQLPrometheus's own query language for selecting, aggregating, and computing over time-series metrics — the language behind both the dashboards Grafana renders and the checks an AnalysisRun evaluates at a Rollout gate.
Pull-based deploymentA model where each environment holds only read credentials to a shared state store and initiates its own outward connection, rather than a central system holding write credentials into every environment it deploys to — the trust-boundary argument behind GitOps's "pulled automatically" principle.
ReconcilerThe component that collapses control theory's controller and actuator roles into one: it computes the diff between desired and observed state and issues the calls that shrink it, running forever rather than once.
RekorSigstore's append-only, publicly auditable transparency log: every signing event lands in it permanently, so a signature can't be minted quietly and later denied.
Service meshAn infrastructure layer — Istio with Envoy sidecars, or Cilium's eBPF-native mesh — that handles service-to-service traffic, including retries, mTLS, load balancing, and observability, uniformly, without each application implementing it itself.
SidecarA helper container or proxy deployed alongside a main application container in the same pod to handle a cross-cutting concern — Istio's Envoy proxy is the canonical example — without modifying the main container's own code.
SigstoreThe Linux Foundation, OpenSSF-hosted supply-chain-security project underneath cosign, Fulcio, and Rekor: it makes container-image signing keyless by issuing certificates too short-lived to be worth stealing.
Software catalogBackstage's central inventory of every service, API, and resource an organization owns, populated from catalog-info.yaml files checked in by hand, discovered automatically, or ingested on a schedule.
Sync (GitOps)The act of reconciling live state to match what's declared in Git. In Argo CD it produces its own sync status — Synced, OutOfSync, or Unknown — kept separate from health status, which asks whether what's running is actually working.
systemdThe Linux init system and service manager LFCS tests directly: it manages units — service, socket, timer, target, mount — with declared dependencies, restart policy, and cgroup-backed resource limits.
The jacketThe physical, one-time garment shipped to anyone whose Kubestronaut or Golden Kubestronaut status the Linux Foundation's records confirm — the program's most visible, non-digital benefit, and the one people actually recognize across a conference hallway.
Voucher stackingSequencing sixteen separate exam purchases through whichever legitimate discount fits each one — a KubeCon promotion, a subscription bundle, a program-earned voucher, an employer's budget — since checkout accepts only one discount code per order, not layering several onto a single purchase.
ztunnelThe lightweight, per-node proxy at the center of Istio's ambient mesh: it handles mTLS and L4 for every pod on its node with no sidecar, handing anything that needs L7 policy up to an optional waypoint proxy.