Practice & Reference · Glossary

Glossary

Every bit of platform-engineering jargon in one place, in plain language — 330 terms spanning all five CNPE domains, from “golden path” and “GitOps” to “XRD,” “error budget,” and “mutating webhook.” Search to jump straight to a word.

☺ Explain it like I’m 10

This is the platform builder’s dictionary. Half the scary words are just names of tools (Argo, Crossplane, Kyverno) and the other half are Kubernetes parts (a Pod, a Namespace, a probe). Whenever a word in any lesson looks confusing, it’s explained here in one friendly sentence. Nutty the Squirrel keeps the whole pile neatly filed so you can find any of them fast.

🐿️Your host for this topic: Nutty the Squirrel — the Guild’s cataloguer, who collects every term developers trip over and files it by meaning so you can find it in seconds.

New words arrive fast in this field, and a surprising number of them come in near-identical pairs that an exam loves to test — desired vs actual state, liveness vs readiness, showback vs chargeback, Role vs ClusterRole. Whenever a term in a lesson looks unfamiliar, it’s defined below in a sentence or two. Type in the box to filter the list live; the counter tells you how many terms match.

Access modesHow a PersistentVolume can be mounted — ReadWriteOnce (one node), ReadOnlyMany, ReadWriteMany (many nodes), or ReadWriteOncePod (a single pod) — which must match what a PersistentVolumeClaim asks for.
ACK (AWS Controllers for Kubernetes)AWS’s open-source operators that let you define and manage AWS services (S3, RDS, and more) as Kubernetes custom resources, so cloud infrastructure is provisioned through the Kubernetes API.
Actual stateIn a reconciliation loop, what is really running in the cluster right now — as opposed to the desired state you declared. A controller’s whole job is to shrink the gap between actual and desired to zero.
Admission controllerCode that intercepts requests to the Kubernetes API server after authentication and authorization but before an object is persisted, so it can validate or mutate the object. Policy engines and Pod Security run here.
Admission webhookAn external HTTP callback the API server invokes during admission to validate or mutate an object; its two forms are the validating and mutating webhooks — the extension point behind policy engines and sidecar injection.
AIOpsApplying machine learning and analytics to operations data (metrics, logs, traces, alerts) to detect anomalies, correlate incidents, and cut alert noise so on-call humans focus on the real problems.
AlertmanagerThe Prometheus-ecosystem component that receives alerts, then deduplicates, groups, silences, and routes them to receivers such as email, Slack, or PagerDuty.
Ambient meshIstio’s sidecar-less data plane that moves mTLS and L4 routing into a per-node “ztunnel” (plus optional L7 “waypoint” proxies), cutting the overhead of injecting a proxy into every pod.
AnalysisTemplateIn Argo Rollouts, a reusable definition of the metric queries (e.g. success rate from Prometheus) used to judge a canary and automatically promote it or roll it back.
API aggregation layerA Kubernetes extension mechanism that lets a custom API server register extra API groups behind the main kube-apiserver, so extension APIs appear as native endpoints — an alternative to CRDs for advanced cases.
App-of-AppsAn Argo CD pattern where one parent Application points at a folder of other Application manifests, so a single root app bootstraps and manages a whole tree of child apps.
Application (Argo)Argo CD’s core custom resource that binds a source (a Git repo path, Helm chart, or Kustomize overlay) to a destination (a cluster and namespace) and defines how it is synced.
ApplicationSetAn Argo CD controller and CRD that templates many Applications from generators (list, cluster, Git directory, matrix, pull request), fanning one template out across many teams, clusters, or environments.
Argo CDA CNCF-graduated, application-centric GitOps delivery tool for Kubernetes, with a web UI, CLI, and an application-controller that continuously syncs cluster state to Git.
Argo RolloutsAn Argo project whose Rollout CRD replaces the standard Deployment to run progressive-delivery strategies — canary and blue/green — with automated metric analysis and rollback.
Argo WorkflowsA CNCF container-native workflow engine for Kubernetes that runs multi-step pipelines (each step a container) as a DAG; often used to build CI and batch pipelines.
Artifact HubA CNCF web application for finding, installing, and publishing cloud-native packages — Helm charts, Operators, Kyverno/OPA policies, Tekton tasks, and more — a central index across the ecosystem.
AttestationA signed statement about an artifact — for example “this image was built by this pipeline from this commit” — such as a SLSA provenance attestation that admission control can verify before allowing a deploy.
Audit logA chronological record of who did what to the cluster (Kubernetes API audit events), essential for compliance, forensics, and detecting misuse.
BackpressureA flow-control mechanism where an overloaded component signals upstream senders to slow down, so queues and memory don’t grow unbounded and cascade into failure.
BackstageAn open-source developer-portal framework (created at Spotify, donated to the CNCF) that unifies a software catalog, golden-path templates, and TechDocs behind one UI — the storefront of many internal platforms.
Bin-packingScheduling pods densely onto as few nodes as possible so idle capacity can be scaled away — a core lever for reducing cloud cost.
Blameless postmortemA post-incident review that examines the systems and conditions that let a failure happen rather than blaming individuals, so people share facts freely and the organization actually learns.
Blue/green deploymentA release strategy that runs two identical environments — blue (current) and green (new) — and flips all traffic from one to the other at once, giving instant rollback by switching back.
BuildKitThe modern container-image build engine (from the Docker/Moby project) with parallelized, cache-efficient builds; it powers docker build and underpins fast image builds in CI.
Burn rateHow fast a service is consuming its error budget relative to the SLO window. A burn rate of 1× exactly exhausts the budget over the window; the classic fast-burn threshold of 14.4× spends 2% of a 30-day budget in a single hour and would empty it in about two days, so it warrants an urgent page.
CalicoA widely used CNI plugin (from Tigera) that provides pod networking and NetworkPolicy enforcement, with a choice of eBPF or standard Linux dataplanes and rich network-security policy.
Canary deploymentA progressive-delivery strategy that shifts a small slice of traffic to the new version first, watches its metrics, then ramps up — limiting the blast radius of a bad release.
CapsuleAn open-source multi-tenancy operator that groups namespaces into per-team “Tenants” with shared quotas, RBAC, and network policies, giving teams self-service namespaces within guardrails.
CD (Continuous Delivery / Deployment)Automatically releasing validated changes: Continuous Delivery keeps every change deployable at the push of a button; Continuous Deployment ships each passing change automatically.
cdk8s (Cloud Development Kit for Kubernetes)A CNCF tool for defining Kubernetes manifests with real programming languages (TypeScript, Python, Go) instead of YAML, synthesizing plain YAML that you then apply.
CEL (Common Expression Language)A lightweight expression language used by Kubernetes for in-tree validation (CRD validation rules and ValidatingAdmissionPolicy) and by Kyverno for policy logic — evaluating rules without an external engine.
Cell-based architectureA resilience pattern that splits a system into independent, isolated “cells” — each a full slice of the stack serving a subset of users — so a failure or bad deploy is contained to one cell.
cert-managerA CNCF Kubernetes add-on that automates issuing and renewing TLS certificates from issuers like Let’s Encrypt, Vault, or a private CA, exposing Certificate and Issuer custom resources.
Chainguard / WolfiWolfi is a minimal, security-focused Linux “undistro” designed for containers; Chainguard builds hardened, low-CVE images on it, shipping SBOMs and signatures for a more secure software supply chain.
Change failure rateA DORA metric: the percentage of production deployments that cause a failure needing remediation (rollback, hotfix, patch). Lower is better.
Chaos engineeringThe practice of deliberately injecting failures — killing pods, adding latency, cutting the network — into a system to find weaknesses before a real outage does; testing resilience by controlled experiment.
Chaos MeshA CNCF chaos-engineering platform for Kubernetes that injects faults (pod kills, network delay, IO and stress) declaratively through CRDs, to test how workloads tolerate failure.
ChargebackActually billing each team for the cloud and Kubernetes resources it consumes, allocating real cost to the owning cost center. Contrast showback.
CI (Continuous Integration)Automatically building and testing every code change as it merges, catching integration problems early — the first half of a CI/CD pipeline.
CiliumA CNCF-graduated CNI built on eBPF that provides high-performance pod networking, NetworkPolicy (including L7), load balancing, and observability (Hubble); it can also form a cross-cluster cluster mesh.
Circuit breakerA resilience pattern that stops sending requests to a failing dependency once errors cross a threshold — “tripping” to fail fast and give the dependency time to recover — often provided by a service mesh.
CIS BenchmarkA consensus set of security-hardening recommendations from the Center for Internet Security (such as the Kubernetes Benchmark) that tools like kube-bench check a cluster against.
CKA (Certified Kubernetes Administrator)A well-known CNCF hands-on certification focused on operating Kubernetes clusters; a common stepping-stone before platform-focused certs like the CNPE.
ClaimIn Crossplane, a namespaced, developer-facing request for infrastructure (“I want a PostgreSQL database”) that a Composition satisfies — the self-service front door to a Composite Resource.
Cloud Native BuildpacksA CNCF specification and toolset that turns application source code into an OCI container image automatically, without a Dockerfile, by detecting the language and applying reproducible build layers.
Cloud Native LandscapeThe CNCF’s interactive map of the cloud-native ecosystem, categorizing hundreds of projects and products by function and maturity — the famously crowded “landscape” poster.
CloudNativePGA popular Kubernetes operator for running PostgreSQL, handling provisioning, high-availability failover, backups, and rolling updates through custom resources.
Cluster API (CAPI)A Kubernetes sub-project that manages the lifecycle of Kubernetes clusters themselves — creating, scaling, upgrading, and deleting them declaratively via CRDs, treating clusters as cattle.
Cluster AutoscalerA Kubernetes component that adds nodes when pods can’t be scheduled for lack of capacity and removes underused nodes, resizing a node group to fit pending workloads.
Cluster meshConnecting multiple Kubernetes clusters so services can discover and reach each other across cluster boundaries with shared identity and policy (for example Cilium Cluster Mesh or Istio multi-cluster).
ClusterRoleA non-namespaced RBAC object defining permissions across the whole cluster (or for cluster-scoped resources), bound to subjects via a ClusterRoleBinding or, within one namespace, a RoleBinding.
CNCF (Cloud Native Computing Foundation)The Linux Foundation body that hosts and governs cloud-native open-source projects (Kubernetes, Prometheus, Argo, and many more) and runs the certification program that includes the CNPE.
CNCF maturity levels (Sandbox / Incubating / Graduated)The three stages of a CNCF project’s lifecycle that signal growing adoption and governance: Sandbox (early, experimental), Incubating (proven and growing), and Graduated (mature, widely used).
CNI (Container Network Interface)The specification and plugin system (Calico, Cilium, Flannel, etc.) that wires pods into the cluster network and assigns IPs. NetworkPolicy needs a CNI that enforces it.
CNPA (Cloud Native Platform Engineering Associate)The CNCF associate-level, multiple-choice certification covering platform-engineering fundamentals — a common stepping-stone to the CNPE, though not a formal prerequisite for it.
CNPE (Certified Cloud Native Platform Engineer)The CNCF / Linux Foundation performance-based certification (introduced in 2025) this course prepares you for: 120 minutes, 15–20 hands-on tasks, a 64% pass mark, and results within 24 hours. Aimed at experienced platform engineers and architects.
CoderAn open-source platform for self-hosted, on-demand cloud development environments, giving developers consistent, pre-provisioned workspaces that the platform team manages centrally.
Cognitive loadThe total mental effort a developer must spend to get work done. Platform engineering aims to lower extraneous cognitive load by paving golden paths so teams focus on their product, not the plumbing.
Complicated-subsystem teamIn Team Topologies, a team that owns a part of the system needing deep specialist expertise (like a video codec or an ML model), so other teams don’t all have to learn it.
Composite Resource Definition (XRD)The Crossplane object that defines a new platform API — the name and schema of a composite resource (XR) and its optional Claim — which a Composition then implements.
CompositionIn Crossplane, the template that maps a Composite Resource to a set of concrete Managed Resources, turning an abstract request (“a database”) into real cloud resources.
Config ConnectorGoogle Cloud’s Kubernetes add-on that lets you manage GCP resources (buckets, databases, IAM) as Kubernetes custom resources, reconciling them like any other cluster object.
ConfigMapA Kubernetes object holding non-secret configuration as key/value pairs, mounted into pods as environment variables or files to keep config out of the image.
ConstraintIn OPA Gatekeeper, an instance of a ConstraintTemplate that turns a policy on for specific resources with specific parameters (e.g. “all Ingresses must use HTTPS”).
ConstraintTemplateIn OPA Gatekeeper, a reusable CRD that packages a Rego policy and defines a new Constraint kind, from which you create parameterized Constraints.
ContainerA lightweight, isolated package of an application and its dependencies that shares the host OS kernel and runs consistently across environments.
containerdA CNCF-graduated container runtime that pulls images and manages container lifecycles; it sits below Kubernetes via the CRI and is the default runtime in most clusters.
Control loopThe endless observe → diff → act cycle at the heart of every Kubernetes controller: read desired state, compare to actual state, take action to reconcile, repeat forever.
Control planeThe components that make global decisions about a cluster or mesh (API server, controllers, scheduler, etcd), as opposed to the data plane that runs the workloads and carries traffic.
ControllerA Kubernetes control-loop process that watches one or more resource types and drives the cluster’s actual state toward the desired state expressed in them.
Conway’s LawThe observation that a system’s architecture tends to mirror the communication structure of the organization that builds it — so team boundaries end up shaping software boundaries.
CoreDNSThe CNCF-graduated, pluggable DNS server that is Kubernetes’ default in-cluster DNS, resolving Service and Pod names so workloads can find each other by name.
cosignA Sigstore tool for signing and verifying container images and other artifacts, storing signatures in the registry so admission controllers can require that only signed images run.
CrashLoopBackOffA pod status meaning a container keeps starting, crashing, and restarting while Kubernetes waits longer between attempts. Usually a bad command, missing config, failed dependency, or a failing probe.
CRD (CustomResourceDefinition)A Kubernetes object that registers a brand-new resource type (kind) with the API server, extending Kubernetes with your own declarative API — the foundation of operators and platform APIs.
CRI (Container Runtime Interface)The gRPC API through which the kubelet talks to a container runtime (containerd, CRI-O), so Kubernetes can run containers without being tied to one specific runtime.
CrossplaneA CNCF project that turns Kubernetes into a universal control plane for infrastructure, provisioning and composing cloud resources through Kubernetes APIs (Providers, Managed Resources, XRDs, Compositions, Claims).
CSI (Container Storage Interface)The standard plugin API by which Kubernetes talks to storage systems, so any compliant vendor driver can provide volumes without changes to Kubernetes core.
Custom ResourceAn instance of a type defined by a CRD — a piece of declarative desired state (e.g. a Certificate or an Argo Application) that a controller acts on.
DaemonSetA Kubernetes workload that runs one copy of a pod on every (or selected) node — used for per-node agents like log collectors, CNI, and metrics exporters.
Day-2 operationsEverything after the initial “day-1” install: upgrades, scaling, backup, monitoring, incident response, and maintenance — the ongoing work a good platform automates.
Declarative configurationDescribing the desired end state (“what”) and letting the system work out the steps (“how”). The Kubernetes and GitOps default, as opposed to imperative commands.
Deployment (Kubernetes)A Kubernetes workload that manages a replicated, stateless set of pods (via a ReplicaSet) and supports rolling updates and rollbacks.
Deployment frequencyA DORA metric: how often an organization successfully ships to production. Elite teams deploy on demand, many times a day.
DeschedulerA Kubernetes add-on that evicts pods running on sub-optimal nodes so the scheduler can place them better, rebalancing a cluster over time for spread, utilization, or affinity fixes.
Desired stateWhat you declared should be running — in a Git repo, a manifest, or a custom resource — that a controller continuously works to make real. The counterpart to actual state.
Developer experience (DevEx / DX)How productive, frictionless, and satisfying it feels to build and ship software on your platform — the core thing a platform-as-product team optimizes for.
DevSpaceAn open-source developer tool that syncs code into a live Kubernetes cluster and automates the inner-loop build-deploy-debug cycle, speeding up development against real clusters.
distrolessMinimal container base images that contain only your app and its runtime — no shell or package manager — shrinking image size and attack surface for better security.
DORA metricsFour research-backed measures of delivery performance from the DevOps Research and Assessment program: deployment frequency, lead time for changes, change failure rate, and time to restore service (MTTR).
DriftWhen a cluster’s actual state diverges from the declared desired state — someone hand-edits a resource, or something fails — which a GitOps reconciler detects and (with self-heal) corrects.
DX Core 4A developer-productivity measurement framework (from DX, unifying DORA, SPACE, and DevEx) that tracks four dimensions — speed, effectiveness, quality, and impact — for a balanced view.
Dynamic secretsShort-lived credentials generated on demand and automatically expired (for example by HashiCorp Vault), so no long-lived password sits around to leak — you get a fresh one per use.
eBPF (extended Berkeley Packet Filter)A Linux kernel technology that runs sandboxed programs inside the kernel without changing kernel code, powering high-performance networking, security, and observability tools like Cilium, Falco, and Pixie.
Enabling teamIn Team Topologies, a team of specialists that temporarily coaches stream-aligned teams to adopt new skills or tools, then steps back — helping others improve rather than doing the work for them.
EndpointSliceA scalable Kubernetes object that tracks the network endpoints (pod IPs and ports) backing a Service, split into manageable chunks — the successor to the older Endpoints object.
Error budgetThe unreliability an SLO allows (100% minus the target). If your SLO is 99.9%, the 0.1% of failures is a budget you can “spend” on releases and risk before you must slow down and stabilize.
etcdThe consistent, distributed key-value store that is Kubernetes’ backing database, holding all cluster state; losing it means losing the cluster.
ExporterA small process that publishes a system’s metrics in Prometheus format on an HTTP endpoint (e.g. node-exporter for host metrics), so Prometheus can scrape them.
External Secrets OperatorA Kubernetes operator that syncs secrets from external managers (HashiCorp Vault, cloud secret stores) into native Kubernetes Secrets, so the plaintext never lives in Git.
FalcoA CNCF runtime-security project that watches kernel syscalls and Kubernetes audit events to detect suspicious behavior — a shell in a container, an unexpected connection — and raise alerts at runtime.
Feature flagA runtime switch that turns a feature or code path on or off without redeploying, decoupling deploy from release and enabling gradual rollouts, A/B tests, and instant kill switches.
Feature storeA central system for storing, sharing, and serving the curated input “features” used to train and run machine-learning models, keeping training and production data consistent.
FinalizerAn entry in a Kubernetes object’s metadata.finalizers list that blocks its deletion until a controller performs cleanup (e.g. deprovisioning a cloud resource) and then removes the finalizer, letting the delete complete.
FinOpsA cultural practice and framework bringing engineering, finance, and product together to manage cloud cost as a shared, data-driven responsibility (inform, optimize, operate).
FlaggerA progressive-delivery operator (part of the Flux ecosystem) that automates canary, blue/green, and A/B rollouts by shifting traffic through a service mesh or ingress and analyzing metrics to promote or roll back.
Fluent BitA lightweight, high-performance CNCF log processor and forwarder, often run as a per-node DaemonSet to collect, parse, and ship container logs to backends like Loki.
FluentdA CNCF unified logging layer that collects, transforms, and routes logs from many sources to many destinations via a plugin ecosystem; heavier than its sibling Fluent Bit.
FluxA CNCF-graduated GitOps toolkit for Kubernetes: composable controllers (source, kustomize, helm, notification, image automation) that pull desired state from Git, Helm, or OCI and reconcile it.
Four golden signalsGoogle SRE’s four key signals to monitor for any user-facing system: latency, traffic, errors, and saturation.
GatekeeperThe OPA-based Kubernetes admission controller that enforces policies written in Rego via ConstraintTemplates and Constraints, and can audit existing resources for violations.
Gateway APIThe successor to Ingress: a richer, role-oriented set of Kubernetes networking CRDs (GatewayClass, Gateway, HTTPRoute) for advanced L4/L7 routing, increasingly adopted by service meshes too.
GatewayClassA cluster-scoped Gateway API resource that defines a class of gateways backed by a particular controller (like an IngressClass for the Gateway API), which Gateway objects then reference.
GitOpsAn operating model where the entire desired state of a system lives in Git and software agents continuously pull and reconcile the cluster to match it; you change infrastructure by changing Git.
GitOps ToolkitThe set of composable controllers and APIs that make up Flux (source-controller, kustomize-controller, helm-controller, notification-controller, image-automation), usable as building blocks for your own platform.
GitpodA platform for automated, ephemeral cloud development environments launched from a Git repository, giving each branch or pull request a ready-to-code workspace in the browser.
Golden pathA supported, opinionated, well-paved route for building and shipping a common kind of software — templated, secure, and observable by default — that developers choose because it’s the easiest way.
GPU OperatorNVIDIA’s Kubernetes operator that automates installing and managing the drivers, runtime, and monitoring needed to schedule GPU workloads, so nodes become GPU-ready without manual setup.
GrafanaThe de-facto open-source dashboarding tool that queries data sources like Prometheus, Loki, and Tempo to visualize metrics, logs, and traces, and can define alerts.
GreenOpsPractices for reducing the carbon footprint and energy use of cloud workloads — scheduling for efficiency, right-sizing, and using carbon-aware signals — the sustainability sibling of FinOps.
GrypeAn open-source vulnerability scanner (from Anchore) that checks container images and filesystems — often via an SBOM produced by Syft — against known CVE databases.
HarborA CNCF-graduated open-source container registry that stores and serves OCI images and artifacts with added security: vulnerability scanning, image signing, replication, and RBAC.
HashiCorp VaultA widely used secrets-management system that stores, encrypts, and tightly controls access to tokens, passwords, and keys, and can issue dynamic, short-lived credentials on demand.
HelmThe de-facto Kubernetes package manager; it bundles manifests into versioned, parameterized “charts” you install and upgrade as releases, templating values per environment.
Helm chartA versioned, parameterized package of Kubernetes manifests (templates plus a values.yaml) that Helm installs and upgrades as a release — the unit Helm distributes.
Hierarchical Namespaces (HNC)A Kubernetes extension that lets namespaces have parent/child relationships, so policies, RBAC, and quotas set on a parent are inherited by its children — easing self-service multi-tenancy.
HPA (HorizontalPodAutoscaler)A Kubernetes controller that automatically scales the number of pod replicas up or down based on observed CPU, memory, or custom/external metrics.
HTTPRouteA Gateway API resource that defines HTTP routing rules (match by host, path, or header; split traffic; rewrite) and attaches them to a Gateway — the L7 counterpart to Ingress rules.
Image digestThe content-addressable SHA-256 hash that uniquely identifies an exact container image; pinning to a digest instead of a mutable tag guarantees you run the precise bits you verified.
ImagePullBackOffA pod status meaning Kubernetes cannot pull the container image and is backing off between retries; usually a wrong image name/tag, a private registry needing credentials, or a pull rate limit.
Immutable infrastructureThe practice of never modifying running servers or artifacts in place; to change something you build a new version and replace the old, reducing drift and “snowflakes.”
Incident commanderThe single person who coordinates the response to a major incident — driving decisions, delegating tasks, and communicating status — so responders stay organized under pressure.
Informer / watchThe Kubernetes client mechanism controllers use to observe resources efficiently: a “watch” streams change events from the API server, and an “informer” caches objects and fires handlers, avoiding constant polling.
Infrastructure as Code (IaC)Managing and provisioning infrastructure through version-controlled declarative files (Terraform, Crossplane, Kubernetes manifests) instead of manual clicks or ad-hoc commands.
IngressA Kubernetes API object defining HTTP/HTTPS routing rules (hosts, paths, TLS) into cluster services, implemented by an ingress controller such as NGINX or Traefik.
Ingress controllerThe component (NGINX, Traefik, HAProxy, etc.) that watches Ingress resources and actually implements their HTTP/HTTPS routing and TLS; an Ingress does nothing without a controller running.
Inner loopThe fast, local, repeated cycle of a developer coding, building, running, and testing on their own machine — the work a platform tries to keep quick and friction-free. Contrast the outer loop.
Internal Developer Platform (IDP)The self-service layer of tools, services, and golden paths a platform team builds on top of Kubernetes and cloud so product developers can provision and ship without filing tickets.
Internal Developer PortalThe single UI/catalog (e.g. Backstage) through which developers discover services, run golden-path templates, and read docs — the storefront on top of the IDP. A portal is not the whole platform.
IRSA (IAM Roles for Service Accounts)An AWS EKS feature that maps a Kubernetes ServiceAccount to an AWS IAM role via OIDC, so pods get fine-grained AWS permissions without static credentials — a form of workload identity.
IstioA feature-rich CNCF service mesh providing mTLS, traffic management, and observability — historically via Envoy sidecars, and now also a sidecar-less ambient mode.
JaegerA CNCF distributed-tracing backend for storing, querying, and visualizing traces, showing how a single request fans out across microservices to pinpoint latency and errors.
Job / CronJobKubernetes workloads for finite tasks: a Job runs one or more pods to completion (batch work), and a CronJob creates Jobs on a schedule, like a cluster-native cron.
JsonnetA data-templating language that extends JSON with variables, functions, and imports, used to generate Kubernetes manifests programmatically while avoiding copy-paste YAML.
k3sA lightweight, certified Kubernetes distribution (from Rancher/SUSE) packaged as a single small binary, popular for edge, IoT, CI, and resource-constrained environments.
KanikoA tool that builds container images from a Dockerfile inside a container or Kubernetes cluster without a Docker daemon or privileged access — handy for building images in CI on Kubernetes.
KarmadaA CNCF multi-cluster orchestration project that lets you run and schedule workloads across many Kubernetes clusters from a single control plane, with policy-based placement and failover.
KarpenterAn open-source Kubernetes node autoscaler (originally built by AWS) that provisions right-sized nodes just-in-time for pending pods and consolidates for cost — typically reacting faster and picking instance types more flexibly than the node-group-bound Cluster Autoscaler.
KCL (Kubernetes Configuration Language)A CNCF configuration and policy language for defining and validating structured config (such as Kubernetes manifests) in a typed, programmable way — an alternative to raw YAML or Jsonnet.
KEDA (Kubernetes Event-Driven Autoscaling)A CNCF add-on that scales workloads based on event sources (queue length, Kafka lag, cron, Prometheus queries), including scaling to and from zero.
KnativeA CNCF platform that adds serverless capabilities to Kubernetes — request-driven autoscaling (including scale-to-zero) and eventing — so services run only when they are needed.
koA simple tool for building and deploying Go applications as container images without a Dockerfile or Docker daemon, producing small, reproducible images straight from source.
KopfA Python framework (Kubernetes Operator Pythonic Framework) for writing operators quickly with decorators — popular for lightweight or glue-logic controllers.
KratixAn open-source framework for building internal platforms by defining “Promises” — self-service capabilities (a database, a whole pipeline) that developers request and the platform fulfills across clusters.
KServeA Kubernetes-native platform for serving machine-learning models at scale, with standardized inference endpoints, autoscaling (including scale-to-zero), canaries, and multi-framework support.
kube-apiserverThe front door of the Kubernetes control plane: the REST API server that validates and processes every request and is the only component that reads and writes cluster state in etcd.
KubebuilderA widely used Go SDK and CLI for scaffolding CRDs and controllers on top of controller-runtime — the standard way to build production operators in Go.
KubecostA cost-monitoring tool for Kubernetes (built on OpenCost) that breaks down spend by namespace, workload, team, or label and supports showback/chargeback and right-sizing recommendations.
kubectlThe primary Kubernetes command-line tool for talking to the API server — creating, inspecting, and debugging resources (kubectl apply, get, describe, logs).
KubeEdgeA CNCF project that extends Kubernetes orchestration out to edge devices and nodes, syncing workloads and data between a cloud control plane and far-flung edge locations.
KubeflowA CNCF platform for running machine-learning workflows on Kubernetes — pipelines, notebooks, training jobs, hyperparameter tuning, and model serving — as a cohesive MLOps toolkit.
kubeletThe Kubernetes agent running on every node that talks to the API server, starts and stops containers via the CRI, and reports node and pod health back to the control plane.
kube-proxyA per-node Kubernetes network component that implements Service virtual IPs by programming iptables/IPVS rules to load-balance traffic to the right pod endpoints (some CNIs like Cilium can replace it).
Kubernetes (K8s)The CNCF-graduated open-source container orchestrator that schedules, scales, and self-heals containerized workloads across a cluster — the substrate platforms are built on.
Kubernetes Operator patternEncoding the operational knowledge of running an application into a custom controller plus CRDs, so the software manages its own day-2 operations (install, upgrade, backup) the way a human operator would.
KubescapeAn open-source, CNCF Kubernetes security platform that scans clusters, manifests, and images against frameworks (NSA, CIS, MITRE) to find misconfigurations and vulnerabilities.
kube-schedulerThe Kubernetes control-plane component that assigns newly created pods to nodes, weighing resource requests, affinity/anti-affinity, taints, and spread constraints to pick the best fit.
KubeVelaA CNCF application-delivery platform built on the Open Application Model that lets teams define apps and their deployment as reusable components and traits, abstracting away raw Kubernetes YAML.
KustomizeA template-free Kubernetes configuration tool (built into kubectl) that customizes plain YAML with a shared base plus per-environment overlays and patches, without duplicating manifests.
KyvernoA CNCF policy engine for Kubernetes that expresses validate / mutate / generate policies as Kubernetes-native YAML (with CEL support) — no new language to learn, a common alternative to OPA/Gatekeeper.
Lead time for changesA DORA metric: the time from a code change being committed to it running in production. Shorter lead times mean faster feedback and delivery.
Least privilegeThe security principle of granting each user or workload only the permissions it needs and no more — the guiding rule for RBAC roles and ServiceAccount scoping.
Level-triggeredA reconciliation style that repeatedly compares desired vs actual state and drives toward the target regardless of missed events (self-correcting), as opposed to edge-triggered logic that reacts only to a change event.
LimitRangeA Kubernetes policy object that sets default and min/max CPU and memory for containers or pods in a namespace, so workloads can’t be created without sensible resource bounds.
LinkerdA CNCF service mesh focused on simplicity and low overhead, using lightweight Rust “micro-proxy” sidecars to provide mTLS, metrics, and reliability features.
LitmusChaosA CNCF chaos-engineering framework for Kubernetes that runs fault-injection “experiments” from a hub, with a UI and CRDs to define, schedule, and observe resilience tests.
Liveness probeA Kubernetes health check that decides whether a container is still healthy; if it fails, the kubelet restarts the container. Contrast the readiness probe.
LogsTimestamped records of discrete events emitted by applications and infrastructure — one of the three pillars of observability, aggregated by tools like Loki or Fluentd.
LokiA log-aggregation system from Grafana Labs that indexes only labels (not full log text) for cost efficiency, queried with LogQL and paired with Grafana.
LonghornA CNCF, lightweight distributed block-storage system for Kubernetes (from Rancher/SUSE) that provides replicated persistent volumes, snapshots, and backups using the nodes’ own disks.
Managed ResourceIn Crossplane, a Kubernetes representation of a single external resource (an RDS instance, an S3 bucket) that a Provider continuously reconciles with the real thing.
ManifestA YAML (or JSON) file declaring a Kubernetes object’s desired state, submitted to the API server with kubectl apply or reconciled from Git.
MetacontrollerA Kubernetes add-on that lets you build controllers/operators as simple webhooks (in any language) by delegating the watch-and-reconcile machinery to Metacontroller.
MetricsNumeric measurements sampled over time (counters, gauges, histograms) such as request rate or memory usage — one of the three observability pillars, typically collected by Prometheus.
MIG (Multi-Instance GPU)An NVIDIA feature that partitions a single physical GPU into several isolated smaller GPU instances, so multiple workloads can share one card with guaranteed slices.
MimirA Grafana Labs project for horizontally scalable, long-term, multi-tenant storage of Prometheus metrics, handling very high cardinality beyond a single Prometheus.
mirrordAn open-source tool that lets a locally running process behave as if it were inside the remote Kubernetes cluster — mirroring cluster traffic, environment, and file access — for fast, realistic local development.
MLOpsApplying DevOps and platform practices to machine learning: automating the pipeline of data prep, training, deployment, monitoring, and retraining of models reliably and repeatably.
mTLS (mutual TLS)Two-way TLS where both client and server present and verify certificates, so each side proves its identity and traffic is encrypted — the basis of zero-trust service-to-service communication in a mesh.
MTTR (Mean Time To Restore / Recovery)A DORA metric: how long it takes to recover from a production failure. Lower is better; fast rollback and good observability shrink it.
Multi-Cluster Services (MCS)A Kubernetes API for exporting a Service from one cluster and importing it into others, so pods can discover and reach services across cluster boundaries as if they were local.
Multi-tenancySharing one platform or cluster among many teams safely, isolating them with namespaces, RBAC, quotas, network policy, or virtual clusters so they don’t interfere with each other.
Mutating webhookAn admission webhook that can modify an object before it’s stored — injecting a sidecar, adding labels, or defaulting resource limits. Runs before validating webhooks.
NamespaceA Kubernetes virtual partition that scopes names and provides a boundary for RBAC, quotas, and network policy — the lightest form of multi-tenancy, a “lane” on the shared road.
NetworkPolicyA Kubernetes resource that controls which pods may talk to which (ingress/egress rules), enabling default-deny, zero-trust networking; requires a CNI plugin that enforces it.
NodeA worker machine (VM or physical) in a Kubernetes cluster that runs pods, managed by the kubelet and a container runtime.
Node affinityScheduling rules that attract pods to nodes with certain labels (a GPU, a zone), either as a hard requirement or a soft preference.
OCI (Open Container Initiative)The standards body and specifications (image, runtime, distribution) that define portable container image and registry formats used across the ecosystem.
OCI artifactAny content — Helm charts, SBOMs, signatures, Wasm modules, policy bundles — stored and distributed through an OCI (container) registry, reusing image infrastructure for more than just images.
OOMKilledA container status meaning the kernel’s out-of-memory killer terminated it for exceeding its memory limit; the fix is usually raising the limit or fixing a memory leak.
OPA (Open Policy Agent)A CNCF-graduated general-purpose policy engine that evaluates rules written in Rego; in Kubernetes it powers Gatekeeper for admission control.
Open Application Model (OAM)A platform-agnostic specification for describing an application as components plus operational “traits,” separating what developers define from how operators run it — the model KubeVela implements.
OpenCostA CNCF specification and tool for measuring and allocating Kubernetes spend in real time by workload, namespace, and label — the open-source engine behind Kubecost.
OpenFeatureA CNCF open standard and SDK for feature flagging that gives a vendor-neutral API, so you can switch or combine feature-flag providers without rewriting application code.
OpenGitOpsA CNCF project that defines GitOps vendor-neutrally through four principles: declarative; versioned and immutable; pulled automatically; and continuously reconciled.
OpenTelemetry (OTel)A CNCF project and vendor-neutral standard (APIs, SDKs, and the Collector) for generating and exporting metrics, logs, and traces, so instrumentation isn’t locked to one backend.
OpenTofuAn open-source, community-driven fork of Terraform (under the Linux Foundation) that stays open-licensed; a drop-in infrastructure-as-code tool using the same HCL configuration.
OperatorA custom controller (usually paired with CRDs) that encodes how to run and maintain a specific application, automating its day-2 operations — the Operator pattern in practice.
Operator SDKA framework in the Operator Framework for building operators in Go, Ansible, or Helm, with scaffolding, testing, and packaging (including OLM bundles).
OTel CollectorThe OpenTelemetry Collector: a vendor-neutral pipeline (receivers → processors → exporters) that receives, processes, batches, and forwards telemetry to one or many backends.
Outer loopThe slower cycle that begins after a developer pushes code — CI, image build, security scans, deployment, and release — which a platform automates so it stays fast. Contrast the inner loop.
Owner referenceA field linking a Kubernetes object to the parent that created it, enabling cascading deletion (garbage collection) — delete the owner and its owned objects go too.
Paved roadThe internal name (popularized at Netflix) for the golden path: the supported, well-lit way to do something that most teams should take by default.
Pending podA pod stuck in Pending because it hasn’t been scheduled — usually no node has enough resources, or taints/affinity/PVC binding block it. A Cluster Autoscaler or Karpenter may add capacity.
PersistentVolume (PV)A cluster resource representing a piece of real storage (a disk, an NFS share, a cloud volume), provisioned statically or dynamically via a StorageClass.
PersistentVolumeClaim (PVC)A namespaced request for storage (size, access mode, class) that binds to a PersistentVolume; pods mount PVCs to get durable storage.
Platform as a productTreating the internal platform like a product — with developers as its customers, plus discovery, a roadmap, adoption metrics, and support — not a one-off project or a ticket queue.
Platform engineeringThe discipline of designing and building internal self-service platforms (IDPs) and golden paths that reduce cognitive load and let product teams ship software safely and fast.
Platform Engineering Maturity ModelA CNCF framework that grades an organization’s platform practice across aspects (investment, adoption, interfaces, operations, measurement) from provisional to optimizing, to guide improvement.
Platform orchestratorA tool at the core of an internal platform that takes a developer’s app request and orchestrates the workflows and infrastructure to fulfill it (for example Kratix, Humanitec, or Score-driven systems).
Platform teamIn Team Topologies, the team that builds and runs the internal platform as a product, providing self-service tools and golden paths that reduce other teams’ cognitive load.
PodThe smallest deployable unit in Kubernetes: one or more co-located containers that share network and storage and are scheduled together.
Pod Disruption Budget (PDB)A policy that limits how many pods of an app can be voluntarily disrupted at once (e.g. during a node drain), protecting availability during maintenance.
Pod Security Admission (PSA)The built-in Kubernetes admission controller that enforces the Pod Security Standards (privileged, baseline, restricted) per namespace via labels — the successor to PodSecurityPolicy.
Pod Security Standards (PSS)Three predefined security profiles — Privileged, Baseline, and Restricted — that define how locked-down a pod must be; Pod Security Admission enforces them per namespace.
Policy as codeExpressing governance rules (security, cost, compliance) as version-controlled, testable code enforced automatically by engines like OPA/Gatekeeper or Kyverno, instead of manual review.
PreemptionWhen the scheduler evicts lower-priority pods to make room for a pending higher-priority pod that otherwise can’t be placed — driven by PriorityClass values.
Preview environmentA temporary, disposable environment spun up per pull request (e.g. via an Argo CD ApplicationSet PR generator) so a change can be reviewed live before it merges.
PriorityClassA Kubernetes object that assigns a priority to pods; higher-priority pods can preempt (evict) lower-priority ones when the cluster is short on resources.
Progressive deliveryReleasing changes gradually and safely — canary, blue/green, feature flags — with automated metric analysis and rollback, rather than switching all users at once.
PrometheusThe CNCF-graduated de-facto Kubernetes monitoring system: it scrapes metrics from targets, stores them as time series, and queries them with PromQL. The second project to graduate from the CNCF, after Kubernetes.
Prometheus OperatorA Kubernetes operator that manages Prometheus, Alertmanager, and related config through CRDs like Prometheus, ServiceMonitor, and PrometheusRule, so monitoring is declarative.
PromQLPrometheus Query Language: the functional language for selecting and aggregating time-series data to build graphs, alerts, and recording rules.
ProvenanceVerifiable metadata describing how an artifact was built (source, builder, steps), used to prove a build’s integrity; SLSA defines provenance formats for supply-chain security.
Provider (Crossplane)A Crossplane plugin that teaches the control plane how to talk to an external API (AWS, GCP, Azure, GitHub, etc.), adding the Managed Resource types it can provision.
PruneIn GitOps, deleting live cluster resources when their manifests are removed from Git, so Git deletions become real deletions rather than orphaned objects.
PulumiAn infrastructure-as-code platform that lets you define cloud resources using general-purpose programming languages (TypeScript, Python, Go, C#) instead of a domain-specific config language.
RAG (Retrieval-Augmented Generation)An AI pattern that retrieves relevant documents (often from a vector database) and feeds them to a language model as context, so answers are grounded in your own up-to-date data.
Rancher FleetA GitOps engine (from Rancher/SUSE) built for managing deployments across large fleets of Kubernetes clusters from a single Git-driven control point, at scale.
RayAn open-source framework for scaling Python and AI workloads across a cluster — distributed training, tuning, data processing, and serving — often run on Kubernetes via KubeRay.
RBAC (Role-Based Access Control)The Kubernetes authorization model that grants permissions to subjects (users, groups, ServiceAccounts) through Roles/ClusterRoles and RoleBindings/ClusterRoleBindings.
Readiness probeA Kubernetes health check that decides whether a container is ready to receive traffic; if it fails, the pod is removed from Service endpoints but not restarted. Contrast the liveness probe.
ReconcileTo run one pass of the control loop: observe desired and actual state, compute the difference, and take action to make actual match desired.
ReconciliationThe continuous process by which a controller drives actual state toward desired state, over and over — the engine of GitOps, operators, and Crossplane.
Recording ruleA Prometheus rule that precomputes an expensive or frequently used PromQL expression on a schedule and saves it as a new time series, speeding up dashboards and alerts.
RED methodAn observability method for request-driven services: for each service track Rate (requests per second), Errors, and Duration.
RegoThe declarative policy language of Open Policy Agent, used to write the rules that Gatekeeper enforces as admission policies.
ReplicaSetA Kubernetes controller that keeps a specified number of identical pod replicas running; you rarely create one directly, since a Deployment manages ReplicaSets for you.
ResourceQuotaA Kubernetes object that caps the aggregate resources (CPU, memory, object counts) a namespace can consume — a key multi-tenancy guardrail so one team can’t starve others.
Reverse Conway maneuverDeliberately structuring your teams to match the software architecture you want, so Conway’s Law works in your favor rather than against you.
Right-sizingAdjusting resource requests/limits and instance types to match actual usage, eliminating waste from over-provisioned workloads — a core FinOps practice.
RoleA namespaced RBAC object listing allowed verbs on resources within one namespace, granted to subjects via a RoleBinding.
RoleBindingAn RBAC object that grants the permissions in a Role (or ClusterRole) to specific subjects within a namespace.
RollbackReturning a workload to a previous known-good version after a bad release; in GitOps it’s reverting a commit, in Argo Rollouts it’s aborting a canary.
Rolling updateA deployment strategy that gradually replaces old pods with new ones a few at a time, keeping the service available throughout.
Rook / CephRook is a CNCF operator that runs Ceph — a distributed storage system — inside Kubernetes, providing self-managing block, file, and object storage from cluster disks.
SBOM (Software Bill of Materials)A machine-readable inventory of every component and dependency in a piece of software (formats like SPDX or CycloneDX), used to track and audit supply-chain risk.
ScaffolderBackstage’s engine that executes Software Templates — it takes user input, generates a new repository from a skeleton, and runs setup steps to bootstrap a paved project.
ScoreAn open, platform-agnostic, developer-centric workload specification: you describe your app once in score.yaml and it’s translated to Kubernetes, Helm, or Compose.
Sealed SecretsA tool (a controller plus the kubeseal CLI) that encrypts a Secret to a cluster-specific key, so the ciphertext is safe to commit to Git; only the in-cluster controller can decrypt it.
Secret (Kubernetes)A Kubernetes object for sensitive data (passwords, tokens, keys); base64-encoded, not encrypted by default, so it’s paired with tools like Sealed Secrets or the External Secrets Operator.
SeldonA platform for deploying, scaling, and monitoring machine-learning models on Kubernetes, turning trained models into managed inference services with routing, explainability, and metrics.
Self-healA GitOps setting where the reconciler automatically reverts any drift (out-of-band changes) back to the state declared in Git, so manual edits don’t stick.
Service (Kubernetes)A stable virtual IP and DNS name that load-balances traffic to a changing set of pods selected by labels, decoupling clients from individual pod IPs.
Service meshA dedicated infrastructure layer (Istio, Linkerd) that manages service-to-service communication — mTLS, traffic routing, retries, telemetry — usually via proxies, without changing app code.
ServiceAccountA Kubernetes identity for workloads (not humans); pods use it to authenticate to the API server and, via RBAC, to be granted least-privilege permissions.
ServiceMonitorA Prometheus Operator CRD that declaratively tells Prometheus which services/endpoints to scrape and how, so adding monitoring is just applying a manifest.
Shift-leftMoving checks (security scans, tests, policy) earlier in the lifecycle — into the IDE and CI — so problems are caught before deployment, not after.
ShowbackReporting each team’s cloud and Kubernetes cost back to them for visibility, without actually billing them. Contrast chargeback.
SidecarA helper container running alongside the main app container in the same pod, sharing its network and lifecycle — the classic way a service mesh injects a proxy.
SigstoreAn open-source project for signing, verifying, and proving the provenance of software artifacts (cosign, Fulcio, Rekor), enabling keyless signing and a public transparency log.
SkaffoldA Google open-source command-line tool that automates the build-push-deploy inner loop for Kubernetes, watching source and continuously redeploying for fast local development.
SLA (Service Level Agreement)A formal, often contractual promise to customers about a service level (e.g. 99.9% uptime) with consequences if missed — typically looser than the internal SLO that guards it.
SLI (Service Level Indicator)A quantitative measure of a service’s behavior, such as the proportion of requests served successfully and quickly — the raw signal an SLO is set on.
SLO (Service Level Objective)A target for an SLI over a window (e.g. 99.9% of requests succeed per 30 days) — the objective that defines “reliable enough” and generates the error budget.
SLSA (Supply-chain Levels for Software Artifacts)A security framework (pronounced “salsa”) of graded levels and requirements for build integrity and provenance, hardening the software supply chain against tampering.
Snowflake serverA hand-tuned, one-of-a-kind server whose exact configuration nobody can reproduce — the anti-pattern GitOps and immutable infrastructure exist to eliminate.
Software CatalogBackstage’s central inventory of all software (services, libraries, APIs, resources) and their owners, so developers can discover what exists and who runs it.
Software TemplateA Backstage scaffolder template that, from a short form, generates a new repository wired with CI, manifests, and docs — the golden path turned into a one-click action.
SOPSAn open-source tool (originally from Mozilla) that encrypts values inside YAML/JSON files (leaving keys readable) using KMS/age/PGP, so config with secrets can live in Git; Flux can decrypt it on apply.
SPACE frameworkA model for measuring developer productivity across five dimensions — Satisfaction, Performance, Activity, Communication, and Efficiency — so it isn’t reduced to a single misleading number.
SpanA single named, timed operation within a trace (e.g. a database call); spans nest and link to form the tree of a distributed request.
SPIFFE (Secure Production Identity Framework For Everyone)A CNCF open standard that gives each workload a cryptographic identity (a SPIFFE ID and SVID document), enabling secure, mutually-authenticated service-to-service communication without shared secrets.
SpinKubeAn open-source project for running Spin-based WebAssembly (Wasm) applications natively on Kubernetes, scheduling lightweight Wasm modules alongside or instead of containers.
SPIRE (SPIFFE Runtime Environment)The reference implementation of SPIFFE: it attests workloads and issues them short-lived identity documents (SVIDs), acting as the identity provider behind zero-trust service authentication.
Spot instanceSpare cloud capacity offered at a steep discount that the provider can reclaim with little notice; great for fault-tolerant, interruptible workloads to cut cost, risky for stateful ones.
StatefulSetA Kubernetes workload for stateful apps that gives pods stable identities and stable per-pod storage, with ordered, predictable deployment and scaling — used for databases and queues.
Status conditionA standard entry in a resource’s .status.conditions (type, status, reason, message) reporting an aspect of its state (e.g. Ready=True), which controllers set and others read.
StorageClassA Kubernetes object describing a “class” of storage (the provisioner and its parameters) that enables dynamic provisioning of PersistentVolumes on demand.
Stream-aligned teamIn Team Topologies, a team aligned to a single flow of work — a product, service, or user journey — that owns it end to end; the primary team type the platform exists to support.
Supply chain securityProtecting the path from source code to running artifact — signing images, generating SBOMs, scanning for vulnerabilities, verifying provenance, and enforcing it all at admission.
SveltosAn open-source tool for declaratively deploying and managing Kubernetes add-ons and applications across many clusters, selecting target clusters by labels and templating what each one gets.
SyftAn open-source tool (from Anchore) that generates an SBOM from a container image or filesystem, listing packages and dependencies for scanning or auditing.
Sync waveIn Argo CD, an annotation-based ordering that groups resources into waves so they’re applied in a defined sequence during a sync (e.g. CRDs before the workloads that use them).
TAG (Technical Advisory Group)A CNCF working group of domain experts — covering areas such as security, observability, and application delivery — that provides guidance, reviews projects, and produces white papers for the community. The exact TAG lineup and names are reorganised periodically by the CNCF Technical Oversight Committee.
TaintA key/value marker on a node that repels pods unless they carry a matching toleration; used to reserve nodes (GPU, system) for specific workloads.
Team APIIn Team Topologies, the explicit, documented way other teams interact with a team — its services, docs, support channels, and expectations — treating a team like a product with a clear interface.
Team TopologiesA model (Skelton & Pais) of four team types — stream-aligned, platform, enabling, complicated-subsystem — and three interaction modes (collaboration, X-as-a-Service, facilitating); it frames the platform team as a product-minded team that offers its platform X-as-a-Service — distinct from the separate “enabling team” type.
TechDocsBackstage’s docs-as-code feature that builds and serves technical documentation (written in Markdown next to the code) inside the developer portal.
TektonA Kubernetes-native CI/CD framework (a Continuous Delivery Foundation project) where pipelines and tasks are CRDs and each step runs in a container — declarative, cloud-native build/test/deploy pipelines.
TelepresenceA CNCF tool that connects a locally running service into a remote Kubernetes cluster, intercepting traffic to it, so you can develop and debug one service against the real cluster.
TempoA Grafana Labs distributed-tracing backend that stores large volumes of traces cheaply in object storage and integrates with Grafana, OpenTelemetry, and the Jaeger/Zipkin formats.
TerraformHashiCorp’s widely used infrastructure-as-code tool that provisions cloud resources from declarative HCL and tracks them in state — an alternative or complement to Crossplane.
Thinnest Viable Platform (TVP)Team Topologies’ advice to start a platform as small as possible — sometimes just a wiki page or a thin wrapper — and grow it only as real developer demand proves it out.
TiltA developer tool that automates the inner loop of multi-service Kubernetes development, watching files and rebuilding/redeploying live, with a dashboard showing build and runtime status.
TimoniA package manager for Kubernetes that uses the CUE language to define, validate, and bundle application configuration and deploy it as versioned modules — a typed alternative to Helm.
ToilManual, repetitive, automatable operational work that scales with load and has no lasting value (an SRE term) — the “Ticket Swamp” a platform is built to drain.
TolerationA pod setting that lets it be scheduled onto nodes with a matching taint; tolerations and taints work together to steer or restrict placement.
Topology spreadScheduling constraints (topologySpreadConstraints) that distribute a workload’s pods evenly across failure domains like zones or nodes, improving availability.
Trace contextThe propagated identifiers (trace ID, span ID, flags) — standardized by W3C Trace Context — passed between services so spans from one request can be stitched into a single trace.
TracesRecords that follow one request as it travels across services, made of linked spans — the third observability pillar, produced with OpenTelemetry and viewed in Jaeger or Tempo.
TrivyA popular open-source Aqua Security scanner for container images, filesystems, and IaC, finding vulnerabilities, misconfigurations, and secrets, and able to generate SBOMs.
USE methodAn observability method for resources: for each resource track Utilization, Saturation, and Errors — complements the request-focused RED method.
Validating webhookAn admission webhook that inspects an object and accepts or rejects it without changing it — e.g. Gatekeeper denying a pod that violates policy.
values.yamlThe default configuration file of a Helm chart: the parameters (image tags, replica counts, resources) that fill in the chart’s templates and that you override per environment or release.
Vector databaseA database that stores data as high-dimensional embeddings and finds items by similarity, powering semantic search and Retrieval-Augmented Generation (RAG) for AI applications.
VeleroAn open-source tool for backing up and restoring Kubernetes cluster resources and persistent volumes, and migrating them between clusters — disaster recovery for the cluster state itself.
Virtual cluster (vCluster)A lightweight, isolated Kubernetes control plane running inside a namespace of a host cluster, giving a team its own “cluster” (own API server, own CRDs) for stronger multi-tenancy than a bare namespace.
vLLMA high-throughput open-source engine for serving large language models efficiently, using techniques like PagedAttention to boost GPU utilization during inference.
VolcanoA CNCF batch-scheduling system for Kubernetes designed for AI/ML and HPC workloads, adding gang scheduling, queues, and fair-share that the default scheduler lacks.
Volume snapshotA point-in-time copy of a PersistentVolume’s data, taken through the CSI VolumeSnapshot API, used for backups or to clone data into a new volume.
VPA (VerticalPodAutoscaler)A Kubernetes component that recommends or automatically sets a workload’s CPU/memory requests based on usage, right-sizing pods. Contrast the replica-scaling HPA.
WASI (WebAssembly System Interface)A standardized set of APIs that lets WebAssembly modules access system resources (files, network, clocks) safely outside the browser, making server-side and edge Wasm portable.
wasmCloudA CNCF application platform for building and running distributed applications from WebAssembly components that connect through a capability-based runtime, across cloud and edge.
WasmEdgeA CNCF lightweight, high-performance WebAssembly runtime optimized for edge, serverless, and AI workloads, able to run Wasm apps outside the browser with low overhead.
WebAssembly (Wasm)A portable, sandboxed binary instruction format that runs code at near-native speed in a tiny, secure runtime; increasingly used server-side and at the edge as a lighter alternative to containers.
Workload identityGiving each workload its own verifiable identity (via a ServiceAccount tied to a cloud IAM role, or SPIFFE) so it can authenticate to services without embedded static credentials.
X-as-a-ServiceOne of Team Topologies’ three interaction modes, where one team consumes something another team provides “as a service” with minimal collaboration — the model a platform team aims for.
Zero trustA security model of “never trust, always verify”: every request is authenticated and authorized regardless of network location, with least privilege and encrypted (mTLS) traffic everywhere.
🐿️ Nutty’s workshop · 10 min

Quiz yourself on ten random terms. Scroll to any spot, cover the definitions with your hand, and read just the bold words — say the one-sentence meaning out loud before you uncover it. Then flip it: read a definition and name the term. The ones you fumble are your study list. If you can round-trip both ways on GitOps, canary, XRD, error budget, mTLS, and mutating webhook, you’re in good shape.

⌁ Note

This glossary is deliberately broad — it spans every exam domain, CNPE’s and CNPA’s alike, so not every term will show up on your test. Watch the near-identical pairs: desired vs actual state, liveness vs readiness probe, showback vs chargeback, Role vs ClusterRole, validating vs mutating webhook, OPA/Gatekeeper vs Kyverno. Those pairs are exactly what a good exam question is built to separate, so learn them together. When a term first appears in a lesson, jump back here to lock in the one-sentence version.

Where to go next

☺ Like you’re 10: A dictionary tells you what a word means. These pages show you the thing itself.

A definition is a starting point, not understanding. When a term here matters to you, go and meet it properly: