Glossary

Agent: A machine (or container) that runs build steps for the controller. Agents carry labels, like linux or docker.; Jenkins: controller, agents and the Jenkinsfile
Anchor and alias: &name labels a node, *name reuses it elsewhere. The merge key <<: *name copies a mapping's keys into another mapping.; YAML: syntax and type guessing
Annotated tag: A tag object with the tagger's name and email, a date and a message. Made with git tag -a. Meant for releases. A lightweight tag is only a name pointing at a commit, meant for private or temporary labels.; Tags, versions and releases
App repo: Holds the code, the Dockerfile and the CI workflow. A push here builds an image.; Capstone: from git push to a paged alert
Argo CD Application: A Kubernetes object that says: take the manifests at this repo, revision and path, and keep them applied in this cluster and namespace.; GitOps: Git is the source of truth
Artifact: A file a job produces and hands to later jobs: a binary, a tarball, a test report.; Pipelines: running the deploy runbook on every push
Artifacts: Files a job produces and GitLab stores, like a build output or a report. Later stages in the same pipeline download them.; GitLab CI: stages, runners, cache and artifacts
Backend: Where the state is stored. Local by default. A remote backend, like an S3 bucket or HCP Terraform, lets the team share one state.; Terraform state, backends and modules
Batch size: How much change you ship at once. One commit is a small batch. A quarterly release is a huge one.; Small batches, fast feedback
Blameless postmortem: A written review of an incident that looks for contributing causes without blaming a person. It assumes everyone acted in good faith with what they knew.; Observability and incidents: page on what users feel
Block scalar: Multi-line text. | keeps the line breaks, > folds them into spaces. Add - (|-) to drop the final newline.; YAML: syntax and type guessing
Blue-green: Run the new version (green) beside the live one (blue), then switch the router. To roll back, you switch the router to blue again.; Deploy strategies: replacing the version in production
Branch: A movable pointer to one commit. Each new commit on the branch moves the pointer forward.; Branches, merge and rebase
Build cache: Saved layers from earlier builds. If an instruction and its inputs match, the builder reuses the layer instead of running it again.; The Dockerfile and its build cache
Cache: Files a job saves to speed up later runs, like downloaded packages. A job must still work when the cache is empty.; GitLab CI: stages, runners, cache and artifacts
CALMS: Culture, Automation, Lean, Measurement, Sharing. A checklist to see how far a team has really moved toward DevOps.; What DevOps is: dev and ops owning one service
Canary: Send a small share of real traffic to the new version, watch it, then increase step by step.; Deploy strategies: replacing the version in production
Cattle: Servers built by automation, all alike, designed so that any one of them can fail or be replaced without anyone noticing.; Pets vs cattle: replacing servers instead of repairing them
cgroup: Control group. A kernel feature that counts and limits what a group of processes uses: memory, CPU, I/O.; Containers and virtual machines
Change fail rate: The share of deployments that need immediate intervention afterwards, usually a rollback or a hotfix.; DORA metrics: is delivery getting better?
Change lead time: Time from a change being committed to version control to that change running in production.; DORA metrics: is delivery getting better?
Changelog: A file listing the notable changes of each version, newest first, for the people who use your software.; Tags, versions and releases
Chart: A Helm package: a Chart.yaml, a values.yaml with defaults, and a templates/ folder of Kubernetes YAML with placeholders.; Helm: a package manager for Kubernetes
Cluster autoscaler: Adds nodes when pods are pending because no node has room for them, and removes nodes that sit underused.; Cluster management: upgrade without an outage
CODEOWNERS: A file mapping paths to people or teams. Owners are requested for review automatically when a PR, once out of draft, touches their files.; Pull requests, protected branches and CODEOWNERS
Commit: A snapshot of the whole project, named by its hash (by default SHA-1, 40 hex characters), with author, message and a pointer to its parent commit.; Git: snapshots, three areas and HEAD
Config repo: Holds the Helm values per environment. Argo CD watches it, and each commit here triggers a deploy.; Capstone: from git push to a paged alert
ConfigMap: An object holding plain settings as keys and values. Mounted as files or passed as environment variables. Not for secrets, and at most 1 MiB.; Config, health checks and resources
Configuration drift: Ad hoc changes to a server's configuration that nobody records. After enough of them, nobody can rebuild the server.; Pets vs cattle: replacing servers instead of repairing them
Container: A process (or a group of processes) the kernel isolates with namespaces and limits with cgroups. It runs on the host kernel.; Containers and virtual machines
Continuous delivery: Every change that passes the pipeline could go to production at any time. A human decides when.; Pipelines: running the deploy runbook on every push
Continuous deployment: Every change that passes the pipeline goes to production, with no human in between.; Pipelines: running the deploy runbook on every push
Controller: The Jenkins service itself: web UI, configuration, and the scheduler that decides where and when builds run.; Jenkins: controller, agents and the Jenkinsfile
Controller: A control loop that watches one kind of object and acts to bring the current state closer to the desired state.; Why Kubernetes: controllers and desired state
Current state: What is really running, reported in the object's status.; Why Kubernetes: controllers and desired state
Data source: A read-only lookup, like data "aws_ami" "ubuntu": find something that exists, without managing it.; Terraform: plan and apply
Dependency graph: Who must exist before whom. Terraform builds it from the references between blocks.; Terraform: plan and apply
depends_on: Start order between services. With condition: service_healthy, Compose waits for the dependency's healthcheck to pass.; Docker Compose: the whole stack in one file
Deployment: Manages ReplicaSets for you, and rolls out a new version by creating a new ReplicaSet and scaling the old one down.; Pods, Deployments and Services
Deployment rework rate: The share of deployments that someone made unplanned, because of an incident in production.; DORA metrics: is delivery getting better?
Desired state: What you asked for, written in an object's spec. For example: three replicas of this image.; Why Kubernetes: controllers and desired state
DevOps: A mix of culture, practices and tools that lets one organization deliver and run software fast and reliably. Dev and ops share the goal instead of passing work over a wall.; What DevOps is: dev and ops owning one service
DevOps team silo: The anti-pattern: a new team called "DevOps" placed between dev and ops. It adds a second wall and keeps dev and ops further apart.; What DevOps is: dev and ops owning one service
Digest: A sha256:... hash of the image content. Two images with the same digest have the same bytes. A digest cannot be moved to other content.; Registries, tags and digests
DNS record: A name to value mapping. A gives an IPv4 address, AAAA an IPv6 address, CNAME another name. The TTL says how long resolvers may cache the answer.; Networking: debug one layer at a time
Dockerfile: A text file of instructions (FROM, COPY, RUN, CMD...) that the builder runs top to bottom to produce an image.; The Dockerfile and its build cache
Drain: Mark a node unschedulable (cordon), so no new pods land on it, then evict its pods so they restart elsewhere. kubectl drain waits for each pod to stop gracefully.; Cluster management: upgrade without an outage
Drift: The live state in the cluster no longer matches Git. Argo CD shows the app as OutOfSync.; GitOps: Git is the source of truth
Engineering work: Work that needs human judgment and makes a lasting improvement: writing automation, fixing a root cause, improving monitoring.; Toil: finding and automating repetitive ops work
errexit (`set -e`): Stop the script when a command fails. It has exceptions: commands tested by if, while or until, any part of && or || but the last, anything negated with !, and, without pipefail, every command of a pipeline but the last.; Shell scripts that stop at the first error
Exit code: The number a process returns when it ends. 0 means success. Anything from 1 to 255 means failure, and the program chooses which number.; Exit codes, streams and systemd: how tools talk
Failed deployment recovery time: How long it takes to recover from a deployment that fails and needs immediate intervention.; DORA metrics: is delivery getting better?
Fast-forward: A merge where the target branch has not moved since the split. Git just moves the pointer, no new commit.; Branches, merge and rebase
Feature flag: A switch in the code that turns a feature on or off without a deploy. A release toggle hides unfinished work.; Trunk-based development vs GitFlow
Feature flag: A switch in the code that turns a feature on or off without a new deploy. Deploying puts the code on the servers, and releasing turns the feature on for users.; Deploy strategies: replacing the version in production
Four golden signals: From the Google SRE book: latency, traffic, errors, saturation. If you can only measure four things on a user-facing system, measure these.; Observability and incidents: page on what users feel
GitFlow: A 2010 model with two permanent branches, master (often renamed main today) and develop, plus feature, release and hotfix branches.; Trunk-based development vs GitFlow
Handler: A task that runs only when another task notifies it and reports changed. Typical use: reload a service after its config changed.; Ansible roles: one folder per job
HEAD: Which ref you are on right now. Usually it holds a branch name like refs/heads/main; in detached HEAD it holds a commit hash.; Git: snapshots, three areas and HEAD
Healthcheck: A command the container runs on a schedule to say "I am ready". Its result is the container's health status.; Docker Compose: the whole stack in one file
HPA: HorizontalPodAutoscaler: adds or removes pods of a Deployment based on a metric, usually CPU use compared to the pods' requests.; Cluster management: upgrade without an outage
IAM user vs IAM role: A user has long-term credentials (a password, access keys). A role has none: whoever assumes it gets temporary credentials. People and apps should use roles.; AWS essentials: regions, networks, firewalls and roles
Idempotent: Running it twice gives the same result as running it once. A pipeline can safely retry an idempotent script.; Shell scripts that stop at the first error
Idempotent: Running it twice gives the same result as running it once. A good task reports ok when there is nothing to do.; Ansible: playbooks over SSH
Image: A read-only stack of filesystem layers plus settings (command, user, env). It never changes once built.; Containers and virtual machines
Immutable server: A server that is never modified once deployed. To change it, you build a new image and replace the server.; Pets vs cattle: replacing servers instead of repairing them
Immutable tag: An image tag that never moves, like sha-ad132f5. Unlike main or latest, it always means the same image.; Capstone: from git push to a paged alert
Index: Also called the staging area. A file inside .git that holds what will go into your next commit.; Git: snapshots, three areas and HEAD
Ingress: HTTP and HTTPS routing rules (host, path) from outside the cluster to Services. Does nothing on its own.; Ingress and persistent storage
Ingress controller: The proxy that reads Ingress objects and does the routing. You must install one. Creating an Ingress without one has no effect.; Ingress and persistent storage
Instruction: One line of the Dockerfile. FROM picks the base image, COPY adds files, RUN runs a command, CMD sets the default command.; The Dockerfile and its build cache
Inventory: The list of managed nodes, sorted into groups like [app] and [db]. Ansible always adds the groups all and ungrouped.; Ansible: playbooks over SSH
Jenkinsfile: A text file in the repo that defines the pipeline, reviewed and versioned like code.; Jenkins: controller, agents and the Jenkinsfile
Job and step: A job is a list of steps that run in order on the same runner. Jobs run in parallel unless one needs another.; GitHub Actions: a pipeline in the repo
Journal: The log store of systemd, run by journald. You read it with journalctl, filtered by unit, boot, time or priority.; Exit codes, streams and systemd: how tools talk
Key pair: A private key that stays with you and a public key you put on servers, in ~/.ssh/authorized_keys. Make one with ssh-keygen -t ed25519 -C "you@laptop".; SSH keys and secrets: keep them out of Git
Label and selector: A label is a key and value on an object, like app: guestbook. A selector is a query on labels, like "every Pod with app: guestbook and tier: frontend".; Pods, Deployments and Services
Layer: The set of filesystem changes one instruction makes. RUN, COPY and ADD add layers, CMD or EXPOSE only change settings.; The Dockerfile and its build cache
Mapping: Key and value pairs, key: value. Nesting is shown by indentation, with spaces only: tabs are not allowed for indentation.; YAML: syntax and type guessing
Matrix: A list of values that makes GitHub run the same job once per value, like three Node.js versions, without copying the job.; GitHub Actions: a pipeline in the repo
Merge commit: A commit with two parents, written by a three-way merge: the two branch tips plus their common ancestor.; Branches, merge and rebase
Minimal base image: A base with little or nothing besides what the app needs: scratch (empty), distroless (no shell, no package manager), or a slim variant.; Small, safe images
Module: A small program that does one job, like dnf, service or copy. Ansible copies it to the managed node and runs it there.; Ansible: playbooks over SSH
Module: A folder of Terraform code you call with a module block. Your own folder is the root module, and the ones you call are child modules.; Terraform state, backends and modules
Multi-stage build: A Dockerfile with several FROM lines. Early stages build, the last stage copies only the result with COPY --from. Build tools stay behind.; Small, safe images
Namespace: A kernel feature that gives a process its own private copy of one resource: process IDs, network stack, mount points, hostname, users.; Containers and virtual machines
Namespace: A named folder for resources inside one cluster. Names must be unique inside a namespace, not across them. Nodes and PersistentVolumes are cluster-wide, not in any namespace.; Namespaces and RBAC: sharing a cluster between teams
Node: A worker machine. Its kubelet makes sure the Pods assigned to it are running.; Why Kubernetes: controllers and desired state
Non-root user: A USER line so the app does not run as UID 0. Without one, in your Dockerfile or in the base image, the default user in a container is root.; Small, safe images
nounset (`set -u`): Treat an unset variable as an error. A non-interactive shell prints a message and exits.; Shell scripts that stop at the first error
Overhead: Admin work not tied to running the service: meetings, HR paperwork, goal setting. You still have to do it, and it does not count as toil.; Toil: finding and automating repetitive ops work
PersistentVolume (PV): A piece of storage in the cluster (a cloud disk, an NFS share), with a life of its own, independent of any Pod.; Ingress and persistent storage
PersistentVolumeClaim (PVC): A request for storage: a size and an access mode. Kubernetes binds it to a matching PV.; Ingress and persistent storage
Pet: A server treated as unique and indispensable, built and fixed by hand. When it goes down, the team drops everything to save it.; Pets vs cattle: replacing servers instead of repairing them
Pinning: Referring to an image by an exact version, ideally by digest (myapp@sha256:...), so every pull gets the same image.; Registries, tags and digests
pipefail: A pipeline returns the status of the rightmost command that failed, not just the status of the last command. Off by default.; Shell scripts that stop at the first error
Plan: terraform plan: compare the configuration with what exists, and list the changes. It changes nothing.; Terraform: plan and apply
Playbook: A YAML file with one or more plays. A play maps a group of hosts to a list of tasks. Each task calls one module.; Ansible: playbooks over SSH
Plugin: An add-on installed on the controller. Git, JUnit reports, credentials and the pipeline itself are all plugins.; Jenkins: controller, agents and the Jenkinsfile
Pod: The smallest thing Kubernetes runs: one or more containers that share a network and storage, always placed on the same node.; Pods, Deployments and Services
PodDisruptionBudget (PDB): A rule for one app: how many of its pods must stay up (minAvailable) or may be down (maxUnavailable) during a voluntary disruption like a drain.; Cluster management: upgrade without an outage
Port: A number that picks one listening program on a host. On Linux, by default, a process needs root or the CAP_NET_BIND_SERVICE capability to bind a port below 1024.; Networking: debug one layer at a time
Probe: A check the kubelet runs on a container: an HTTP GET, a TCP connect, a gRPC call or a command.; Config, health checks and resources
Promotion: Moving the same image from staging to production by changing one value in Git, never by rebuilding it.; Capstone: from git push to a paged alert
Protected branch: A branch with rules: by default no force push and no deletion, plus optional rules like required reviews and checks.; Pull requests, protected branches and CODEOWNERS
Pull deploy: An agent running in the cluster watches Git and applies changes itself. CI never touches the cluster.; GitOps: Git is the source of truth
Pull request: A request to merge one branch into another, with the diff, the discussion, the reviews and the CI results in one place.; Pull requests, protected branches and CODEOWNERS
Rebase: Replaying your commits on top of another branch. Same changes, new commits with new hashes.; Branches, merge and rebase
Ref: A name for a commit. A branch like main is a ref, refs/heads/main, that holds one commit hash. Often it is a small file of that name; after git gc it can sit in .git/packed-refs instead.; Git: snapshots, three areas and HEAD
Region and Availability Zone (AZ): A Region is a separate geographic area, like eu-west-1. Each Region has several isolated locations called AZs, named like eu-west-1a.; AWS essentials: regions, networks, firewalls and roles
Registry: A server that stores and serves images: Docker Hub, GitHub Container Registry (ghcr.io), your cloud's registry, or one you host. Each image name in it, like ghcr.io/acme/myapp, is a repository.; Registries, tags and digests
Release: One install of a chart in a cluster, with its own name. Install the same chart twice, you get two releases.; Helm: a package manager for Kubernetes
Release artifact: The built output users install: a package, a binary, a container image. Built once from the tagged commit.; Tags, versions and releases
Request and limit: The request is the CPU and memory the scheduler reserves for a container. The limit is the most it may use: over the CPU limit it is throttled, over the memory limit it may be OOM killed.; Config, health checks and resources
Required status check: A CI job that must end successful, skipped or neutral before the PR can merge.; Pull requests, protected branches and CODEOWNERS
Resource: One thing Terraform manages, like resource "aws_instance" "app_server": a type, a local name, and its arguments.; Terraform: plan and apply
Revision: A numbered version of a release. Every install, upgrade or rollback adds 1. The first is always 1.; Helm: a package manager for Kubernetes
Role: A folder with a known layout (tasks/, handlers/, defaults/, vars/, templates/, files/, meta/). Ansible loads each main.yml for you.; Ansible roles: one folder per job
Role / ClusterRole: A list of allowed verbs (get, list, create, delete...) on resources. A Role lives in one namespace. A ClusterRole is cluster-wide.; Namespaces and RBAC: sharing a cluster between teams
Role defaults: defaults/main.yml: the variables a user of the role is expected to change, at the lowest precedence. Almost any other variable overrides them.; Ansible roles: one folder per job
RoleBinding / ClusterRoleBinding: Gives a Role to subjects: users, groups or service accounts. A RoleBinding grants inside its own namespace, even when it points at a ClusterRole.; Namespaces and RBAC: sharing a cluster between teams
Rolling update: Replace copies a few at a time. There is no downtime, and old and new versions serve users at the same moment.; Deploy strategies: replacing the version in production
Rotation: Replacing a secret with a new one and revoking the old one. After a leak, rotating the secret makes the leaked value useless.; SSH keys and secrets: keep them out of Git
rules: Conditions that GitLab checks when it creates the pipeline. They decide if a job is added to the pipeline, and how (for example when: manual).; GitLab CI: stages, runners, cache and artifacts
Runbook: Written steps for a recurring task or alert: "log in to X, run this, check the output, restart Y if...". Someone who can program reads it as pseudocode.; Toil: finding and automating repetitive ops work
Runner: The machine that runs a job. GitHub-hosted runners are fresh virtual machines (Ubuntu, Windows, macOS). You can also host your own.; GitHub Actions: a pipeline in the repo
Runner: The GitLab Runner program that picks up jobs and runs them. On GitLab.com you can use hosted ones, on your own GitLab you install and manage them.; GitLab CI: stages, runners, cache and artifacts
Scalar: A single value. Unquoted (plain), the parser picks its type: string, number, boolean or null. A quoted scalar is always a string.; YAML: syntax and type guessing
Secret: Anything that grants access: a password, a token, a private key, an API key. If it leaks, someone else can act as you.; SSH keys and secrets: keep them out of Git
Secret: Like a ConfigMap, for sensitive values. By default stored unencrypted in etcd. Values in data are base64, which hides nothing.; Config, health checks and resources
Security group: A stateful firewall attached to an instance. It has allow rules only. A new one has no inbound rules, so nothing gets in until you add one.; AWS essentials: regions, networks, firewalls and roles
Self-heal: Argo CD option: when the live state drifts from Git, sync again on its own. Off by default.; GitOps: Git is the source of truth
Semantic versioning: MAJOR.MINOR.PATCH: MAJOR for incompatible changes, MINOR for new backward compatible features, PATCH for backward compatible bug fixes.; Tags, versions and releases
Service: One component of the app in compose.yaml (web, backend, db). Compose runs one or more containers for it.; Docker Compose: the whole stack in one file
Service: A stable name and virtual IP in front of a changing set of Pods. Default type is ClusterIP, reachable only inside the cluster.; Pods, Deployments and Services
Service account: An identity for a program, not a person. Each namespace gets one named default, and a pod that names none runs as it.; Namespaces and RBAC: sharing a cluster between teams
Short-lived branch: A branch that lives hours, at most a day or two, then merges and is deleted.; Trunk-based development vs GitFlow
Silo: A team that works for its own goal, with its own tools and words, and talks to other teams only through tickets.; What DevOps is: dev and ops owning one service
SLO and error budget: An SLO is a target, like 99% of requests succeed and are fast. The error budget is what is left: 1% may fail. The burn rate says how fast you spend it.; Observability and incidents: page on what users feel
SNI: Server Name Indication: the client sends the host name inside the TLS handshake, so one IP can serve many certificates.; Networking: debug one layer at a time
ssh-agent: A process that holds your unlocked keys in memory, so you type the passphrase once per session, not once per login.; SSH keys and secrets: keep them out of Git
Stage: Everything from one FROM to the next. You can name it with AS builder and build only up to it with --target.; Small, safe images
Stage: One step of the pipeline, like build, test or deploy. Jobs in the same stage can run in parallel. The next stage waits for this one to pass.; Pipelines: running the deploy runbook on every push
State: The record of which real object belongs to which block. A JSON file, terraform.tfstate by default. Never edit it by hand.; Terraform state, backends and modules
State lock: If the backend supports locking (and it is turned on), Terraform takes it automatically on every operation that could write state. A second apply waits or fails instead of writing over the first.; Terraform state, backends and modules
stdout and stderr: Two output streams: stdout (file descriptor 1) for results, stderr (file descriptor 2) for errors and messages. stdin (descriptor 0) is the input.; Exit codes, streams and systemd: how tools talk
Symptom vs cause: The symptom is what is broken for users ("HTTP 500s"). The cause is why ("database refuses connections"). Page on symptoms, use dashboards to find causes.; Observability and incidents: page on what users feel
Tag: A human name for one version, like 1.4.2 or latest. Tags are mutable: a push can point the same tag at a new image.; Registries, tags and digests
Template: A Jinja2 file (.j2) where Ansible replaces {{ nginx_worker_processes }} with the value for each host. The template module renders it onto the server.; Ansible roles: one folder per job
The Three Ways: Gene Kim's three principles behind DevOps: flow, feedback, and continual experimentation and learning.; Small batches, fast feedback
TLS certificate: A file that proves a server owns a name. The client checks that the name matches the URL, that a trusted CA signed it, and that it has not expired.; Networking: debug one layer at a time
Toil: Work tied to running a production service that tends to be manual, repetitive, automatable, tactical (interrupt-driven and reactive), leaves no lasting improvement, and grows with the size of the service. A task does not need all six traits to be toil.; Toil: finding and automating repetitive ops work
Trunk: The one shared branch everybody merges into, usually main.; Trunk-based development vs GitFlow
Unit: A file that tells systemd how to run something. A .service unit says which command to start, as which user, and what to do when it exits.; Exit codes, streams and systemd: how tools talk
Value stream: Every step a change goes through, from idea to running in production for users.; Small batches, fast feedback
Values: The settings fed into the templates. Defaults come from values.yaml, overrides from -f file.yaml or --set key=value.; Helm: a package manager for Kubernetes
Volume: Storage that outlives the container. A named volume (db-data) survives docker compose down. down -v removes it.; Docker Compose: the whole stack in one file
VPC and subnet: A VPC is your private network, like 10.0.0.0/16. A subnet is a slice of it that lives in exactly one AZ. Public if its route table sends traffic to an internet gateway, private if not.; AWS essentials: regions, networks, firewalls and roles
Work in progress (WIP): Work that someone has started and not finished. A WIP limit caps how many items can be in one step at the same time.; Small batches, fast feedback
Workflow: One YAML file in .github/workflows/. It says when to run (on:) and what to run (jobs:).; GitHub Actions: a pipeline in the repo