Glossary
71 terms that come up constantly in enterprise infrastructure conversations — defined properly, without the marketing gloss.
Cloud Computing
3 terms
Egress Cost
The charge cloud providers apply to data transferred out of their network — one of the primary mechanisms by which cloud lock-in is enforced financially.
Platform as a Service (PaaS)
A cloud delivery model that provides a managed platform — compute, networking, storage, middleware — so developers can build and deploy applications without managing underlying infrastructure.
Vendor Lock-In
The state of depending so heavily on a single vendor's products and services that switching becomes prohibitively expensive or technically complex.
Compliance
4 terms
Data Sovereignty
The principle that data is subject to the laws and governance of the country in which it is collected or stored — and the right of an organisation to maintain physical and legal control over its data.
DPDP Act 2023
India's Digital Personal Data Protection Act — the primary federal law governing collection, processing, storage, and transfer of personal data of Indian residents.
RBI Cloud Adoption Guidelines
The Reserve Bank of India's framework governing how regulated financial entities may adopt cloud computing — including data localisation, security, exit management, and vendor risk requirements.
SOC 2
A US-origin auditing standard for technology service providers, assessing controls related to security, availability, processing integrity, confidentiality, and privacy.
Engineering
5 terms
Cloud Native
An approach to building and running applications that exploits the advantages of the cloud computing delivery model — containers, microservices, dynamic orchestration, and continuous delivery.
DevOps
A set of practices combining software development and IT operations to shorten the systems development lifecycle and deliver software continuously and reliably.
GitOps
An operational model where Git is the single source of truth for infrastructure and application state — all changes happen through pull requests, not manual commands.
Infrastructure as Code (IaC)
Managing and provisioning infrastructure through machine-readable configuration files rather than manual processes or interactive configuration tools.
Observability
The ability to understand the internal state of a system by examining its external outputs — metrics, logs, and traces.
Infrastructure
8 terms
Air-Gapped Deployment
A system completely isolated from public networks — no internet, no external APIs, no cloud connectivity.
Bare Metal
Physical servers on which software runs directly — without a hypervisor or virtualisation layer between the software and the hardware.
Container
A lightweight, portable package containing an application and all its dependencies — isolated from the host operating system using Linux kernel features.
Disaster Recovery (DR)
The set of policies, tools, and procedures that enable an organisation to restore critical IT systems and data after a catastrophic event.
Hybrid Cloud
An architecture combining on-premise infrastructure with one or more public clouds — with workloads able to move between environments based on policy.
Kubernetes
An open-source container orchestration system that automates deployment, scaling, and management of containerised applications across a cluster of servers.
Object Storage
A storage architecture that manages data as objects — each with data, metadata, and a unique identifier — accessible via HTTP APIs rather than file system paths.
Private Cloud
A cloud computing environment operated exclusively for a single organisation — providing the flexibility and self-service of cloud computing on dedicated, controlled infrastructure.
Platform
2 terms
Cost Attribution
The practice of allocating infrastructure costs to the teams, applications, or tenants that generate them — enabling financial accountability in shared infrastructure.
Multi-Tenancy
An architecture where a single platform instance serves multiple independent organisations or business units, with strict isolation between tenants.
Security
6 terms
DevSecOps
An extension of DevOps that integrates security practices throughout the software development lifecycle — shifting security left so vulnerabilities are found at code time, not deployment time.
Mutual TLS (mTLS)
A security protocol in which both the client and the server authenticate each other's certificates before establishing a connection — unlike standard TLS where only the server authenticates.
Network Policy
Rules that govern which pods and services can communicate with each other in a Kubernetes cluster — implementing micro-segmentation at the application layer.
Role-Based Access Control (RBAC)
A method of restricting system access to authorised users based on their role within an organisation — users are assigned roles, and roles are assigned permissions.
Secrets Management
The secure storage, access, rotation, and auditing of credentials, API keys, certificates, and other sensitive configuration values used by applications and services.
Zero Trust Architecture
A security model that eliminates implicit trust — every user, device, and service must be verified continuously, regardless of network location.
More terms
41 further definitions, in brief.
- Admission Controller
- A Kubernetes plugin that intercepts API requests before persisting them — enforcing security policies, resource quotas, and platform standards.
- API Gateway
- A server-side component that acts as the entry point for all client requests — providing rate limiting, authentication, routing, and protocol transformation.
- Auto-scaling
- The ability of a platform to automatically add or remove compute resources in response to workload demand — without manual intervention.
- BFSI
- Banking, Financial Services, and Insurance — the regulated sector in India subject to RBI, SEBI, and IRDAI oversight, with specific data sovereignty and IT governance requirements.
- CERT-In
- The Computer Emergency Response Team of India — the national nodal agency for cybersecurity incident response, with mandatory 6-hour breach reporting requirements.
- CI/CD
- Continuous Integration and Continuous Delivery — the practice of automatically testing and deploying code changes, shortening the feedback loop from commit to production.
- Cluster
- A group of machines (nodes) that run containerised workloads under Kubernetes orchestration — sharing a control plane and networking fabric.
- CNI Plugin
- Container Network Interface — the Kubernetes networking plugin responsible for assigning IP addresses to pods and enforcing network policies.
- Data Localisation
- The legal requirement that data about a country's citizens must be stored and processed within that country's borders — codified in India by RBI, SEBI, and DPDP Act provisions.
- Dynamic Secrets
- Short-lived credentials generated on demand for each application session and automatically revoked when no longer needed — eliminating the risk of long-lived credential compromise.
- eBPF
- Extended Berkeley Packet Filter — a Linux kernel technology that allows programs to run safely in kernel space, used for high-performance networking, security, and observability.
- Encryption at Rest
- Encryption of stored data so it cannot be read without the correct cryptographic key — protecting against physical theft, unauthorised storage access, and data centre intrusions.
- Encryption in Transit
- Encryption of data as it moves between systems — using TLS to ensure it cannot be intercepted or read in transit across networks.
- Failover
- The process of automatically switching to a secondary system when the primary system fails — a core component of high availability and disaster recovery.
- Fintech
- Financial technology — companies using technology to deliver financial services, typically subject to RBI and/or SEBI regulation when operating in India.
- GPU Compute
- Graphics Processing Unit-based computing — used for massively parallel workloads including ML training, inference, scientific simulation, and rendering.
- Helm Chart
- A package manager for Kubernetes — a Helm chart is a collection of files defining a Kubernetes application, making it easy to deploy and manage complex applications.
- High Availability (HA)
- A system design that ensures a high level of operational continuity — typically achieved through redundancy, failover mechanisms, and geographic distribution.
- Identity Provider (IdP)
- A system that creates, maintains, and manages identity information and provides authentication services to relying applications.
- ISO 27001
- An international standard for information security management systems — widely recognised in enterprise procurement and required by many regulated sector contracts in India.
- JSON Web Token (JWT)
- A compact, self-contained token format for securely transmitting claims between parties — widely used for API authentication and session management.
- Latency
- The time delay between a request being made and a response being received — a critical performance metric for interactive applications and financial transaction systems.
- Load Balancer
- A device or software component that distributes incoming network traffic across multiple backend servers to ensure no single server becomes a bottleneck.
- Namespace
- A Kubernetes mechanism for isolating groups of resources within a cluster — used for multi-tenancy, environment separation, and resource quota management.
- Node
- A worker machine in a Kubernetes cluster — can be a physical server or virtual machine — that runs application workloads as pods.
- OPA (Open Policy Agent)
- A general-purpose, open-source policy engine used to enforce fine-grained authorisation policies across cloud-native environments.
- OpenAPI
- A standard, language-agnostic specification for RESTful APIs — enabling automated documentation, code generation, and API testing.
- Pod
- The smallest deployable unit in Kubernetes — typically containing one container plus optional sidecar containers sharing a network namespace and storage.
- Policy as Code
- The practice of expressing security and governance policies as machine-readable code — enabling version control, automated testing, and consistent enforcement.
- Quota (Resource Quota)
- Kubernetes resource quotas limit the total resources a namespace can consume — preventing any single team or tenant from monopolising cluster capacity.
- RBAC
- Role-Based Access Control — a method of regulating access based on the roles of individual users within an organisation.
- Replica
- A copy of a pod running simultaneously — Kubernetes maintains a specified number of replicas for each deployment, restarting them if they fail.
- SEBI Cloud Framework
- SEBI's guidelines on cloud adoption for regulated market infrastructure and intermediaries — requiring data localisation, vendor risk management, and operational resilience for Indian capital market entities.
- SLA (Service Level Agreement)
- A contract defining the minimum level of service — availability, response time, support hours — that a provider guarantees to deliver.
- SPIFFE
- Secure Production Identity Framework for Everyone — an open standard for machine identity in dynamic infrastructure, issuing short-lived cryptographic identities to workloads.
- Stateful Application
- An application that stores session information or persistent data between interactions — databases, message queues, and ML model servers are stateful applications.
- Terraform
- An open-source Infrastructure as Code tool that enables declarative definition and provisioning of infrastructure across cloud and on-premise environments.
- TLS (Transport Layer Security)
- A cryptographic protocol providing encrypted, authenticated communication over networks — the successor to SSL and the basis for HTTPS.
- Uptime
- The proportion of time a system is operational and available — typically expressed as a percentage. 99.9% uptime allows 8.7 hours of downtime per year; 99.99% allows 52 minutes.
- Vulnerability Scanning
- Automated inspection of software, containers, and infrastructure for known security weaknesses — a core component of DevSecOps and platform security posture.
- Workload
- Any application or process running on infrastructure — a database, a web server, an ML training job, a batch processing pipeline.