# Omega Cloud -- Glossary (TEMPLATE)

TEMPLATE NOTE (removed before delivery): fields written as {{THIS}} are filled
in by us per client.

Plain-language definitions of the terms used across your document pack. Each
guide gives you a workflow; this is the shared reference for what the pieces
are. Terms are grouped, not alphabetized, so related ideas sit together.

## Your tenancy

- Domain: your private, isolated boundary on the platform. Nothing inside it is
  visible to any other client, and vice versa. Your whole tenancy lives in one
  domain.
- Project: a container for resources (servers, networks, volumes, clusters)
  inside your domain, with its own quota. You are delivered one production
  project.
- Quota: the capacity envelope for a project -- how many instances, cores, how
  much memory, how many load balancers and floating IPs you may hold at once.
  Requests beyond quota are refused; changing it is a request to your account
  contact, not self-service.

## Your accounts (authoritative details in the Handover Pack)

- `{{TENANT_SHORT_NAME}}-domain-admin`: manages your team's users, projects, and
  role grants inside your domain. Identity work only, not workloads.
- `{{TENANT_SHORT_NAME}}-cluster`: the only account that creates and deletes
  Kubernetes clusters, using its password. It owns the cluster SSH keypair.
- `{{TENANT_SHORT_NAME}}-svc`: the automation account. All scripted and day-to-day
  work authenticates as this account's application credential.
- Application credential: a scoped, revocable secret tied to the `-svc` account.
  Automation uses it instead of a password; it can be revoked without touching
  the account. It cannot create Kubernetes clusters.

## Networking

- External network (`provider-ext`): the shared network that carries traffic to
  and from the outside world. You attach floating IPs from it.
- Floating IP: a routable address you allocate from the external network and
  attach to a server or load balancer to make it reachable. It counts against
  your quota even while unattached, so release ones you are not using.
- Network / subnet / router: your private network, the address range on it, and
  the device that connects it to the external network. You create these inside
  your project.
- Security group: a set of firewall rules controlling what traffic reaches your
  servers.
- Load balancer: distributes traffic across several backends behind one address.
  A Kubernetes LoadBalancer Service creates one automatically (see below).

## Compute and images

- Instance (server): a virtual machine in your project.
- Flavor: a machine size (CPU, memory, disk). You choose one when creating a
  server or a cluster; list them with `openstack flavor list`.
- Image: the operating-system or Kubernetes image a server or cluster boots
  from. The platform provides shared base images.
- Keypair: the SSH key used to reach servers. For clusters, the keypair is owned
  by the `{{TENANT_SHORT_NAME}}-cluster` account.

## Kubernetes

- Cluster template: the recipe (image, flavors, network driver, options) a
  Kubernetes cluster is built from. On this platform, templates must use the
  calico network driver, and must not set the Public or Hidden flag.
- Kubernetes cluster: a managed set of control and worker nodes running in your
  project. You create it once and deploy into it many times.
- kubeconfig: the certificate-bearing file that grants access to a cluster's
  Kubernetes API. Treat it like a password.
- LoadBalancer Service: a Kubernetes Service that asks the platform for a real
  load balancer and floating IP, so an app inside the cluster is reachable from
  outside. Each one draws a load balancer and a floating IP from your quota.
- Ingress controller: a single LoadBalancer Service that routes to many internal
  Services by hostname or path -- one load balancer instead of many.

## Access and trust

- API endpoint: the address your tools authenticate against (the identity
  service). Your specific URL is in the Handover Pack.
- Dashboard: the web console for your tenancy. Its URL is in the Handover Pack.
- Region: the named location your resources live in; some commands take it.
- CA bundle: the certificate file that lets your tools trust the platform's TLS
  certificates. Point your tools at it; never disable certificate verification.
- Catalog: the platform's own list of service endpoints. Discover endpoints from
  it (`openstack catalog list`) rather than hardcoding them.
- Secrets / certificates store: where you keep application secrets and TLS
  certificates for your project, referenced by your load balancers and apps.

For anything not defined here, or a change to your tenancy, contact
{{ACCOUNT_CONTACT}}.