Glossary — the shared vocabulary

Quick lookup for the terms that recur across the learning modules — not where they’re taught. Each module grounds its terms in context as they come up; this is where you look one up later, with a link to the canonical doc and, per section, the module that teaches it. Terms specific to one subsystem live in that module’s own Reference; this covers the cross-cutting substrate and domain vocabulary.

The domain model — taught in the domain model

• Team — the owner: an SSO group plus an envelope. Owns Products; owns no infra itself.
• Product — a deployable a Team builds; maps to exactly one repo. Owns Services.
• Service — a single running component of a Product (a web frontend, an API).
• Environment — a Product at a Stage (= one namespace); the unit of deployment.
• Customer — an external consumer; a per-customer prod Environment is dedicated to one.
• Stage — a promotion rung (dev / test / staging / uat / prod) — not a place.
• Envelope — the bounds a Team declares: allowed tiers/stages and quota cap enforced at admission; budget currently audit-only (ADR-091 Phase C, not yet flipped to Enforce).
• Tier — the hardening/compliance level (standard, pci, hipaa, …); a floor, not a fixed level.

Kubernetes

• Cluster — the pool of machines Kubernetes runs apps on. (Kubernetes)
• Namespace — an isolated slice of a cluster; one Environment = one namespace. (Kubernetes)
• Pod — a running instance of your app (one or more containers). (Kubernetes)
• Custom resource (CR / CRD) — a record type the platform defines and the cluster stores + acts on. (Kubernetes)
• Admission — the checkpoint every resource crosses on its way into the cluster (the “bouncer at the door”). (Kubernetes)
• RBAC / RoleBinding — who may do what in the cluster. (Kubernetes)
• ServiceAccount — a pod’s in-cluster identity. (Kubernetes)

Crossplane — the provisioning engine — taught in the Environment API

• Composition — the recipe that turns one claim into its resources. (Crossplane)
• XRD — the schema that defines a custom claim type (e.g. XEnvironment).
• XR / claim — an instance of that type; your statement of desired state.
• Managed resource (MR) — one real thing Crossplane creates and continuously watches. (Crossplane)
• Provider — a plugin that lets Crossplane talk to an external API (AWS, Kubernetes).
• ProviderConfig — which credentials/role a provider uses.
• EnvironmentConfig — per-cluster constants injected into a Composition. (Crossplane)
• Reconcile / level-triggered — continuously driving actual state toward desired; why it self-heals. (Kubernetes)

AWS

• EKS — AWS’s managed Kubernetes; the clusters run on it. (AWS)
• ECR — AWS’s container image registry. (AWS)
• IAM — AWS identity & access (roles, policies). (AWS)
• Pod Identity — how a pod gets an AWS role via its ServiceAccount, no static keys. (AWS)

Platform tools

• Kyverno — the policy engine that enforces the rules at admission. (docs) taught in Policy & admission
• ArgoCD — the GitOps engine that syncs cluster state from git. (docs) taught in Delivery
• Cilium — the platform’s CNI (pod networking + the gateway). (docs)
• cosign — signs and verifies container images. (docs) taught in Supply chain