Glossary

Glossary: terms around Clusterward and Kubernetes on Scaleway

Short definitions of the terms used in the cockpit, the guide and the product pages, each with a link to the detailed page. Alphabetical, in four blocks.

Getting started All features

Terms

A to Z

A

Access between environments: Lets another environment on the same cluster call an isolated environment’s services by their internal address (“Who else may call in”). Clusterward adds the rules on both sides and keeps them in step.More on Networking & ingress →
Access review: The regular look through every user and API token with role, application scope, 2FA and last activity, signed on the compliance page. Person, time, counts and a SHA-256 of the access list are recorded; the cycle is between 30 and 365 days.More on the compliance page →
Account on hold: The state of a workspace while a payment is due or after the contract ended: applications keep running, the cockpit is read-only, signing in and the data export stay available.More on pricing →
Add-on: A component that Clusterward installs and updates on a cluster: ingress controller, cert-manager, Reflector, metrics-server, External Secrets Operator and the DNS webhook for Scaleway DNS. Versions come from a maintained catalog with Kubernetes compatibility information.More on Cluster updates →
Adopting a record: Putting an existing DNS record of a registered zone under Clusterward’s management. It is then changed like its own, for example during a cutover, but never deleted at the provider.More on DNS & certificates →
AI assistant: A program such as Claude, Cursor or VS Code that talks to Clusterward through the Model Context Protocol. It reads almost everything the cockpit shows, runs routine tasks such as deploys or backups if you allow it, and changes settings with a third switch – always only with the rights of its role.More on AI assistants →
Annex A control: One of the 93 controls in Annex A of ISO/IEC 27001:2022, for example A.8.13 “Information backup”. The compliance page names the number and name for every check; your own Statement of Applicability then shows how your company covers the control.More on the compliance page →
API token: Access for scripts and CI pipelines, sent as a Bearer header. Carries a role (never Administrator), an application scope and a lifetime of 30 to 365 days or unlimited; users, roles, tokens and the SQL console stay closed to it. It appears in the audit log under its own name. Ticked “Usable by AI assistants (MCP)”, it can connect an AI assistant too.More on Security & access →
App catalog: Templates for ready-made applications, maintained and live-tested by Clusterward – so far WordPress and Uptime Kuma. A few fields are enough: the application, a database (where needed), a disk with daily snapshots, the domain and the certificate are created; afterwards it is an ordinary application.More on the app catalog →
Application: A project in the cockpit: a repository with builds, environments and services. Applications can be organized into groups, for example per customer.More on Deployments →
Audit log: The record of every change in the workspace, with person or API token, time, action and object – including every SQL console query and change. Secret values never appear in it, only their type or name. Entries are deleted automatically after 12 months; the data export keeps a longer record.More on Security & access →

B

Backup: A copy that can be restored: automatic snapshots and individual backups of databases, nightly bucket backups with Object Lock, snapshots of volumes, dumps and bucket archives from offboardings. A restore always goes alongside: a database into a new database, a bucket into a new bucket; a volume restore replaces the disk only after a safety snapshot.More on Backups →
Backup evidence: A CSV file with every bucket backup, restore and restore test of a period, with times, results and who started it – via “Download evidence…” on the S3 page or as a report of the compliance page.More on S3 backups →
Basic auth: Password protection for a host at the ingress level. The credentials come from an environment variable of the service; if it is missing, the deployment aborts.More on Networking & ingress →
Bring your own cloud (BYOC): An operating model in which the software comes as a service and the infrastructure stays in the customer’s own cloud account. With Clusterward, clusters, databases and buckets are created in your Scaleway account and billed by Scaleway directly; Clusterward provisions, maintains and upgrades them.More on bring your own cloud →
Bucket: An S3 bucket on Scaleway Object Storage, private or public, with a bucket policy and optionally a dedicated IAM key for the application.More on Object Storage →
Bucket backup: The nightly copy of a bucket into a backup bucket with Object Lock, ideally in a Scaleway project of its own and another region. Only what changed is copied; each night makes a restore point, kept 30 days by default. Once the backup target exists, it is on for every bucket.More on S3 backups →
Build: The description of how an image is produced from the application’s repository: branch, Dockerfile, image name and tag, built in the cluster without a Docker daemon or by GitHub Actions. A Git service references a build.More on Deployments →

C

Capacity overview: The Infrastructure → Monitoring page: one card per Scaleway project with clusters (CPU and memory, used and requested), nodes, managed database instances and load balancers, re-read live every 15 seconds. It only needs the view permission for Operations. Next to it, the “Services” and “Uptime” views show every service and every uptime check over the last 24 hours.More on Logs & monitoring →
Certificate watcher: The daily run that checks every wildcard certificate and reports one with less than 14 days left or without Ready status to the subscribed channels, once per day. Per-host Let’s Encrypt certificates are not part of it.More on Notifications →
Change not applied yet: A saved setting or variable that only takes effect with the next rollout; the service page then shows a notice with “Restart now”. Restart applies it without a new build – saving alone changes nothing in the cluster.More on Deployments →
Change preview: The first step of every change in the SQL console: the statement runs inside a transaction that is rolled back and reports how many rows it would change. Only “Apply changes” runs exactly that statement; without a preview there is no change.More on the SQL console →
Chart disk: A disk that a Helm chart creates itself, for example for a built-in database. Clusterward shows it on the Helm service, backs it up via snapshot and restores it.More on Volumes →
Chart secret: A write-only secret of a Helm service. The values reference it with ${secret.NAME}; Clusterward inserts the value only at deploy time.More on Secrets →
Circuit breaker: A cap on connections and pending requests to a service with Envoy Gateway. Protects an overloaded application instead of continuing to flood it.More on Networking & ingress →
Cluster: A Kubernetes cluster (Scaleway Kapsule) in your Scaleway project, on which the environments run. Clusterward creates it with a private network, no public node addresses and a locked-down API, or connects an existing one via kubeconfig.More on Cluster provisioning →
Compliance pack: A ZIP with all six reports of the compliance page for a period, a README.txt with the status of every check and SHA256SUMS over every file – so it can later be shown that nothing was changed.More on the compliance page →
Compliance page: The “Compliance” menu item in the cockpit: live checks for access, backup, logging, network and change, each with its control from ISO/IEC 27001:2022 Annex A, plus reports as CSV and the security settings in force. It only reads; every check links the page where you change things.More on the compliance page →
Configuration check: The comparison between what is defined in the cockpit and what is running in the cluster: “matches”, “differs”, “missing” or “not managed” in the cockpit.More on Deployments →
Connected assistant: An AI assistant a person connected with their own login, Claude as a connector, say. It acts as that person, at most with their rights; “Connected assistants” in the account menu shows it and disconnects it at once.More on AI assistants →
Cutover: Moving a service from one ingress controller to another: both load balancers serve the hosts with valid certificates, Clusterward moves its own DNS records and completes the switch one hour after every host points to the new address. A running cutover can be aborted.More on DNS & certificates →

D

Data export: The entire configuration of a workspace as a JSON file, under “Settings → Security” (“Export your data”). Passwords, keys and secret values are never included.More on Security →
Data import: Bringing existing data in via “Import data”: schema and data of an external PostgreSQL or MySQL database (same engine) into a managed database, as a job in the cluster while the app is paused; or the objects of an external S3 bucket into one of your own buckets – copied and overwritten, never deleted. If a Helm chart owns the database, the import stops its workloads; if the source admits only known addresses, it allows the cluster’s outbound address.More on Managed databases →
Deployment: The rollout of a service into its environment: build, registry check, server-side apply of the objects, health check. Runs in the background; the progress is shown in the cockpit.More on Deployments →
Diagnostic: A ready-made check in the SQL console, such as largest tables, unused indexes or blocking. Each one says what the read-only login cannot see.More on the SQL console →
DNS record: An entry in a DNS zone that points a host name at an IPv4 address (A) or at another host name (CNAME). Clusterward creates records for your services’ hosts itself; you add more on the zone page. Only its own or adopted records are ever changed or deleted.More on DNS & certificates →
DNS zone: A domain hosted at Cloudflare or Scaleway DNS that is registered in the cockpit with a verified token or IAM key. Only in registered zones does Clusterward create records automatically; it compares them with the provider every hour and only changes its own or adopted records. On the zone page you can also add A and CNAME records, which Clusterward then manages.More on DNS & certificates →
Domain: A hostname on a service. It is routed to the service through the cluster’s ingress controller, gets a TLS mode, and can instead redirect to another target with a 301 or admit only certain source addresses. In a registered zone, Clusterward creates the DNS record itself.More on DNS & certificates →
Dump: The backup of a database before an offboarding, as a pg_dump or SQL file in the workspace’s backup bucket, with configurable retention. Without a successful dump, nothing is deleted.More on Managed databases →

E

Environment: A namespace on exactly one cluster, such as the staging or production environment of an application, with its own services, variables and hosts. The namespace name is set once and never changes.More on Deployments →
Envoy Gateway: An alternative ingress controller alongside ingress-nginx (and Traefik), based on the Kubernetes Gateway API. A service on the Envoy class is rendered as a Gateway with HTTPRoutes; all services share one proxy fleet and one load balancer.More on DNS & certificates →
External Secrets Operator: A Kubernetes operator that syncs secrets from external sources such as the Scaleway Secret Manager into the cluster. In Clusterward, it is an add-on, selectable per cluster as the delivery method.More on Secrets →

H

Health check: The wait after a rollout until the pods are ready (“Readiness timeout” in the cockpit): two minutes by default, configurable per service; Helm services always wait up to five minutes. If it expires, the rollout counts as not ready in time, but it keeps running in the cluster. A rollout is healthy only once every instance of the new version is ready and the old ones are gone.More on Deployments →
Helm template: A Helm chart in the cockpit’s template library, in numbered versions that cannot change once saved. A Helm service pins one version; a new version changes nothing that runs until services are moved to it.More on Deployments →

I

IAM key: An API key of a Scaleway project. Stored as a provisioning profile or S3 provider, it is verified before saving, encrypted and never shown again.More on Cluster provisioning →
Image digest: The unique fingerprint of a container image (sha256). Clusterward rolls out images from the cluster’s Scaleway registry by digest, so that a moving tag like latest doesn’t decide what runs; Helm charts and images from other registries run by tag.More on Deployments →
Image registry: The private store for a cluster’s built images: a Scaleway Container Registry namespace in the cluster’s project, created during provisioning. Builds push with a key of their own that may only use the registry, never with the provisioning profile’s key.More on Cluster provisioning →
Ingress class: Determines which ingress controller serves a host. A service can pin a class or follow the cluster’s default class.More on DNS & certificates →
Ingress controller: The component in the cluster that receives web traffic on its load balancer and hands each request to the right service by hostname. Clusterward installs ingress-nginx and, on request, Envoy Gateway or Traefik as well; each controller has its own Scaleway Load Balancer.More on Networking & ingress →
Internal address: The address a service answers at inside the cluster, such as http://svc-<id>.<namespace>.svc.cluster.local. The service’s Port card shows it with a copy button; that is how another app calls the service without a domain.More on Networking & ingress →
Invitation: How a new user gets access: a link by email with which they set their own password. They set up 2FA on their first sign-in.More on Security →
IP allowlist: The address ranges from which a workspace can be reached, checked before sign-in. Recognizes Cloudflare addresses and prevents you from locking out your own address.More on Security & access →
Isolated environment: An environment with network policies: only the cluster’s ingress controllers and its own pods get in, and the nodes’ metadata service stays out of reach. The policies follow the installed controllers; with the “Manage” level the isolation can be removed again. Exceptions for other environments on the same cluster are allowed with “Who else may call in” in the same dialog.More on Security & access →

K

Kapsule: Scaleway’s managed Kubernetes. Clusterward provisions Kapsule clusters with private nodes and an API allowlist, or connects existing ones via kubeconfig.More on Cluster provisioning →
Kubeconfig: The access file for a Kubernetes cluster. When a cluster is connected, it is verified and stored encrypted; for provisioned clusters, Clusterward replaces the admin token with the operator identity.More on Cluster provisioning →

L

Lockout: Sign-in protection on two levels: five failed attempts lock an account for 15 minutes, except from addresses the user has signed in from before; 20 failed attempts from one address within 15 minutes block that address for an hour, for a day if it happens again. Addresses on the IP allowlist are never blocked.More on Security →

M

Managed database: A Scaleway RDB instance for PostgreSQL or MySQL, which Clusterward creates with a private endpoint only. Databases with their own role per service are created on it.More on Managed databases →
MCP (Model Context Protocol): The open standard AI assistants use to reach the tools and data of other programs. Clusterward is an MCP server: switched on per workspace, its address is under Settings → Security → AI assistants.More on AI assistants →

N

Namespace: The Kubernetes space that holds an environment’s objects. Its name is set once when the environment is created and never changes, even when things are renamed; the operator identity writes only in namespaces Clusterward manages.More on Deployments →
Needs you: The list on the dashboard with everything that needs you right now – failed deploys, sites that are down, failed backups and pipeline runs, expiring certificates, the access review, configuration differences and waiting restarts or commits – grouped into “Broken now”, “This week” and “Ready to ship”, each with the button that deals with it.More on Logs & monitoring →
Network settings: Timeouts, retries, rate limits, CORS, basic auth and further rules per service, described once and translated for nginx and Envoy. Every field shows the controller’s default.More on Networking & ingress →
Node pool: A group of identical worker nodes in a Kapsule cluster. On provisioned clusters, a pool can be set to a fixed size or an autoscaling range in the cockpit, another pool with a different node type added, or one removed; a pool’s node type is fixed, and the last pool stays.More on Cluster updates →
Notification channel: A webhook (Slack, Teams or your own endpoint) or an email address that receives the events it subscribes to, such as failed deployments, sites that are down or expiring certificates. Webhooks can be signed with HMAC; every delivery is logged on the channel.More on Notifications →

O

Object Lock: An S3 lock that protects an object version from deletion until a date. In governance mode only an administrator of the project can remove a copy earlier, in compliance mode nobody can – not even the provider. Clusterward uses it for the bucket backups.More on S3 backups →
Offboarding: Tearing down a customer: first a dump of every database and an archive of every non-empty bucket, then the pipeline in reverse. An error during the backup stops everything before anything is changed.More on Tenant pipelines →
Operator identity: A ServiceAccount in the cluster that, from Kubernetes 1.30, reads the cluster without secrets and writes only in the namespaces it manages for the environments; admission policies enforce this. It never writes cluster roles or CRDs. Rotatable from the cockpit; replaces the admin token.More on Security & access →
Origin certificate: A self-signed certificate that Clusterward issues on Envoy Gateway for hosts in TLS mode “No TLS” behind the Cloudflare proxy. It is enough for Cloudflare’s “Full” mode and avoids error 525; “Full (strict)” and direct visitors need Let’s Encrypt or a wildcard.More on Networking & ingress →
Outbound address: The public IPv4 address a cluster connects out through – its nodes have none of their own. A database that admits only known addresses allows it for an import; the import dialog shows it with a copy button.More on databases →

P

Pipeline: An ordered list of blocks (“Onboarding pipelines” in the cockpit) that Clusterward runs for every new customer: database, domain, bucket, environment, workload. With preflight, retry and rollback.More on Tenant pipelines →
Plan & limits: The page in the account menu with the workspace’s plan: how many clusters and applications it includes and how many are in use, plus the account state. A limit only blocks new clusters or applications; it never stops anything.More on pricing →
Pool claim: Node capacity declared for a purpose on a cluster Clusterward created: Clusterward creates a dedicated node pool for it, scales it and deletes it. Ephemeral claims scale to zero and release themselves after an idle time without “Touch (keep alive)”; a node label and taint make the pool exclusive. Image builds can run on a claim too and keep it alive while they do.More on pool claims →
Preflight: The check before an onboarding starts: database names against the instance, hosts against all domains, buckets via HEAD. A conflict blocks the start; an inconclusive check triggers a warning.More on Tenant pipelines →
Previous run: The output of a container before its last restart. After a crash, that is usually where you’ll find the cause; the current log starts fresh.More on Logs & monitoring →
Provisioning profile: The verified IAM key of a Scaleway project in which Clusterward may create clusters, databases and registries. Every cluster remembers its profile.More on Cluster provisioning →
Provisioning source: A registered application that Clusterward polls for onboarding and offboarding requests. That way, your software orders its own customers; there is no inbound machine access.More on SaaS vendors →
Proxy protocol: The Scaleway Load Balancer option that passes the real client address to the ingress controller. Enabled by default for new clusters; a prerequisite for access lists and per-visitor login limits.More on Cluster provisioning →

Q

Query plan: The path the database chooses for a query. The SQL console draws it with EXPLAIN as a tree and marks the most expensive step; on PostgreSQL, EXPLAIN ANALYZE shows real rows and times.More on the SQL console →
Query runner: A small pod in the cluster through which the SQL console reaches databases on the private network. It starts with the first query; the console shows whether it runs and how much CPU and memory it needs.More on the SQL console →

R

Rate limit: A limit on requests per client address per second or minute. Burst and open connections are limited by ingress-nginx only; scoping to address ranges and counting per header value, such as an API key, by Envoy Gateway only.More on Networking & ingress →
Ready-made prompt: A ready-made instruction for the AI assistant, such as “Diagnose a failed deploy” or “Backup check”. Clusterward brings twelve; they only read and change nothing.More on AI assistants →
Recovery code: One of ten one-time codes that stand in for the authenticator if your phone is lost. They are shown once, after 2FA has been set up.More on Security →
Restart: Re-applies the current image with the current configuration, without rebuilding the image. The way to activate changed environment variables.More on Deployments →
Restore: The way back: a database from a backup into a new database, a bucket from a restore point into a new bucket or as a single file, a volume from a snapshot, a service to an earlier version.More on Backups →
Restore point: A bucket’s state from one backup night: a list of every object with exactly the copy that belongs to that night. It turns into a new bucket or the download of a single file, as long as the retention keeps it.More on S3 backups →
Restore test: The monthly proof that a bucket backup comes back: Clusterward reads a sample back from the latest restore point and compares size and checksum. A test only reads; “Test restore” starts one right away, and a failure is reported.More on S3 backups →
Role: A permission matrix of areas and levels (“View”, “Operate”, “Manage”) that every user and every API token holds together with an application scope. The fixed “Administrator” role has everything; nobody grants more rights than they hold, and only an administrator changes or deletes an administrator.More on Security & access →
Rotation: A secret gets a new value as a new version. Clusterward detects versions in the Secret Manager and restarts the service on request.More on Secrets →

S

S3 provider: A Scaleway project for Object Storage, registered in the cockpit through its IAM key – the key decides which project buckets are created in. It is checked with ListBuckets before saving, stored encrypted, and can mint dedicated keys per bucket when it holds IAM Manager rights.More on Object Storage →
Saved query: A SQL console query saved for you or the whole workspace, optionally with :name parameters that are bound when it runs.More on the SQL console →
Scaleway DNS: Scaleway’s DNS service (Domains & DNS). Clusterward manages zones there as it does at Cloudflare, with an IAM key that may only do DNS – without a proxy, with a 300-second TTL.More on DNS & certificates →
Secret: An environment variable that can only be overwritten once saved. No interface returns its value, and the audit log records only its name.More on Secrets →
Secret Manager: Scaleway’s managed service for versioned secrets. Registered in the cockpit as a “Secret store”, it is where Clusterward creates secrets, organized by app, environment and service.More on Secrets →
Service: The deployable unit in an environment: an application from a build (optionally with its own database), a scheduled job or a Helm chart, with port, resources, scaling, domains, variables and volumes depending on the kind. Plain container-image services exist only from older setups.More on Deployments →
Setup guide: The checklist on a new workspace’s dashboard: connect a Scaleway project, create a cluster, add a domain, object storage and its backups, Secret Manager, notifications, the first app. The steps tick themselves off as soon as what they ask for exists.More on getting started →
Setup password: The protection of a new site from the app catalog until its installer has completed: the username “setup” and a password from the run page. “Open to everyone” removes it.More on WordPress →
Snapshot: A backup of the storage behind a volume – a chart disk too – as a Scaleway Block Storage snapshot: on a schedule, via “Snapshot now”, and automatically before the data is deleted and before a restore.More on Volumes & snapshots →
SQL console: The query window under “Infrastructure” for PostgreSQL and MySQL: one statement per query, with its own read login and in a read-only transaction – each prevents writes on its own. If the workspace allows changes, each one runs as a change preview first. Every query and every change stays in the audit log for 12 months.More on the SQL console →
Sticky session: Binds a visitor’s requests to the same instance, via a cookie or, with Envoy, via a header.More on Networking & ingress →

T

Tenant: A customer of your application, created by a pipeline run – depending on the pipeline with its own database, buckets, domains, services or its own environment – with a lifecycle from onboarding to offboarding.More on Tenant pipelines →
Tenant inputs: The values a tenant was onboarded with, such as name, domain or plan. The tenant page shows them, and “Edit inputs…” changes the changeable ones after the onboarding.More on tenant pipelines →
Tenant version: What a tenant runs on: the pinned template version of its chart services or the deployed commit of its application. The tenant list shows who is behind, and “Update to the newest version…” brings one tenant up to date.More on tenant pipelines →
TLS mode: The per-domain choice of where the certificate comes from: “Let’s Encrypt (per host)” via HTTP-01, a shared “Wildcard certificate”, or “No TLS” when TLS ends earlier, for example at the Cloudflare proxy. With many customer subdomains, the wildcard avoids Let’s Encrypt’s weekly limit.More on DNS & certificates →
Two-factor authentication (2FA): Required for every sign-in to the cockpit: after the password, a six-digit code from an authenticator app (TOTP). It is set up on the first sign-in; ten one-time recovery codes stand in for a lost phone.More on Security & access →

U

Undeploy: Removes a service’s objects from the cluster – ingress, deployment, service and secrets, or the Helm release – while the configuration stays in the cockpit. Volumes are kept; a service can only be deleted after it has been undeployed.More on Deployments →
Uptime check: An external HTTPS check of a domain, anywhere from every minute to every 15 minutes. After two failures, the site counts as unreachable and a message goes out to your channels. Tenant pipelines create them for every new tenant after its first healthy rollout.More on Logs & monitoring →
Uptime Kuma: A status and uptime monitor with status pages that Clusterward brings into your cluster from the app catalog – without a database, with a disk and daily snapshots.More on Uptime Kuma →
Usage: The history of a service’s CPU, memory and instances from 15 minutes to 30 days, as a share of the limit, with the request and restarts – for Helm services too. Clusterward records it itself every minute.More on Logs & monitoring →

V

Variable bus: The values that pipeline blocks publish, such as a database URL or hostname, and that later steps resolve only at execution time. Passwords never appear in the run.More on Tenant pipelines →
Volume: A persistent storage volume of a service on Scaleway Block Storage, with mount path, size and storage class – also per tenant from a pipeline environment step. A service with a volume runs exactly one instance; the volume survives undeploy and can only grow.More on Volumes & snapshots →

W

Wildcard certificate: A *.<domain> certificate for every subdomain one level down – a.example.com, not a.b.example.com. When Clusterward manages it, it is issued via DNS-01 for a registered zone, also covers the zone itself and is mirrored into every namespace. Avoids the Let’s Encrypt limit when you have many customer subdomains.More on DNS & certificates →
Workspace: Your own, separated part of the Clusterward control plane: its own database, its own data key, its own backup bucket, its own address. Everything you create belongs to this workspace alone.More on workspaces →

Missing a term?

The terms follow the language used in the cockpit. How they fit together in everyday work is shown in the Getting started guide; the differences from other tools are explained in the comparisons with Qovery and DIY.

See the terms in the cockpit

In the demo, we show workspace, pipeline, tenant and cutover on a real cluster instead of in a glossary.

Book a demo