Glossary¶
Terminology used throughout the chapters. Job, variable and resource names remain in English so they can be located directly in the repositories.
| Term | Meaning in this project |
|---|---|
| Agent for Kubernetes | In-cluster agent connecting GitLab and sharing contexts with authorized projects. |
| Artifact | File retained by a job, such as a JAR or report. Not synonymous with a published image. |
| Bootstrap | Initial preparation of accounts, permissions, credentials and resources that enable automation. |
| CI/CD | Continuous integration and delivery/deployment through jobs and rules. Infrastructure applies remain manual here. |
| Commit SHA | Git revision identifier; also used here as an image tag and manifest commit message. |
| Container Registry | Registry where application images are published and retrieved. |
| Desired state | Intended resource state expressed in manifests or IaC configuration. |
| Digest | Image content hash; pins specific content even when a tag can change. |
| Drift | Difference between declarations, recorded state and actual resources. |
| EKS / GKE | AWS and Google Cloud Kubernetes services, respectively. |
| Environment | Distinguish the IaC ENVIRONMENT parameter, cloud target and GitLab environment object. |
| HCL | Language used to describe Terraform/OpenTofu configuration. |
| HTTP backend | Backend storing IaC state through an HTTP API; GitLab is used here. |
| IaC | Infrastructure as code: versioned configuration of resources and dependencies. |
| Ingress | Kubernetes HTTP/HTTPS routing object requiring a compatible controller. |
| IRSA | Association of a Kubernetes ServiceAccount with an IAM role in EKS; used by specific AWS controllers. |
| Merge request | Reviewable change proposal in GitLab. Its existence does not imply mandatory approval in every pipeline. |
| OpenTofu | IaC executor used in the reviewed pipeline. The project retains Terraform-style configuration structure. |
| Plan / apply | Calculation of changes and their application. A saved plan can become stale. |
| Private Service Access | Private connection used by Cloud SQL with the VPC through Service Networking. |
| RDS / Cloud SQL | Managed database services used for MySQL on AWS and GCP. |
| Resource group | GitLab mechanism excluding concurrent jobs with the same key; distinct from a cloud resource group. |
| Root module | IaC directory initialized and applied as one unit with its own state. There are eight here. |
| Secret | Kubernetes object for sensitive values; its access and persistence need controls. |
| State | Record connecting declared and managed resources. It is not an application data backup. |
| Workload Identity | GKE workload identity mechanism; enabling the pool does not complete every application binding. |
Important distinctions¶
Two providers do not imply one application distributed across them. Each deployment uses its own cluster and database; no cross-cloud data synchronization or failover is implemented.
Manifests in Git do not by themselves provide continuous reconciliation. This project pushes delivery from an application job through the agent. No controller automatically repairs every divergence from Git.
A successful pipeline does not equal a verified service. Its scope depends on jobs and policies: rollout waits and subsequent functional checks are absent here.
Describe Terraform and OpenTofu precisely. The thesis uses Terraform for the approach and modules; the reviewed executor is OpenTofu, also mentioned in the thesis.
See architecture, state and quality for details.