devops-infra-helm-charts-gcp/claude/10-glossary-and-references.md

Per AI Blitz Plan §claude. Layer: 1. Repo: devops-infra-helm-charts.

10 — Glossary and references

Short definitions for the terms that recur in this repo's docs, and outbound links for deep dives.

Glossary

Argo CD — GitOps continuous-delivery controller. Reconciles a cluster's actual state to a Git-declared desired state. Each cluster runs its own Argo CD instance; each Argo CD instance hosts a set of Application objects.

Application (Argo) — A single deployable unit. Points at a Git repo + path + revision + chart-and-values config, and a destination (cluster + namespace). In our setup, the source path is in this repo; the Application manifest itself is in the sister repo.

ApplicationSet — A controller-side template that fans out one Application per cluster (or per cluster × app). Used in the sister repo to express "deploy victoria-metrics-agent to every prod cluster" once instead of N times.

BU (Business Unit) — Meesho-internal grouping that owns a cluster. Encoded in the cluster name: k8s-<bu>-prd-ase1[c]. Examples: central, supply, demand, dataengg, ml-platform.

Autopilot (GKE) — Google's managed-node-pool flavour of GKE. Scheduling primitives are different from standard GKE — uses cloud.google.com/compute-class instead of dedicated: taints. The repo has three Autopilot clusters: k8s-central-prd-ase1, k8s-dsgpu-prd-ase1, k8s-shared-int-ase1. See ./02-cluster-fleet.md.

ESO (External Secrets Operator) — In-cluster operator that reads ExternalSecret CRs and materializes Kubernetes Secret objects from a remote backend (GCP Secret Manager, Vault). The mechanism that keeps secret values out of this repo. See ./06-secrets-and-identity.md.

ComputeClass — A GKE Autopilot CR that describes a node-pool selection policy (machine family, accelerators, spot eligibility). Workloads target a ComputeClass via nodeSelector."cloud.google.com/compute-class": <name>. CRs live as raw sidecars in helm-overrides/<cluster>/<app>/computeclass/.

fullnameOverride — A Helm values key consumed by most charts to fix the resource name prefix. Load-bearing — Service DNS names, PVC bindings, ConfigMap references all key off it. Never change for a live release. See ../docs/global/SANCTITY_RULES.md.

Sister repo — Meesho/devops-infra-argo-config. Owns the Argo Application / ApplicationSet manifests that point at paths in this repo. See ../docs/global/coding-guidelines/argocd.md.

External Secrets — short for the External Secrets Operator (above), or the ExternalSecret CR it consumes.

Blue-green sibling — A second chart directory under helm-templates/ (-green, -vX.Y.Z, -latest, -old) that exists alongside the stable chart to support a phased migration. Both can be live simultaneously. See ../wiki/analyses/ADR-A2-blue-green-sibling-pattern.md.

helm-overrides — Top-level dir holding per-cluster × per-app values overlays (<cluster>/<app>/custom-values.yaml) and raw-manifest sidecars. The agent-edited surface.

helm-templates — Top-level dir holding cached / forked upstream charts. Mostly read-only. Edits silently fork unless intentional.

Manual sync — Argo syncPolicy.automated is unset; reconciliation requires a human Sync click in the Argo UI. The default for prod infra. See ../wiki/analyses/ADR-A5-manual-sync-default-for-infra.md.

Workload Identity — GKE feature that binds a Kubernetes service account to a Google service account via the iam.gke.io/gcp-service-account annotation. Replaces long-lived JSON service-account keys.

TruffleHog — Pre-commit secret scanner. Active and blocking on this repo. Never bypass.

Layer 1 / Layer 3 — Agent authority classification from the AI Blitz Plan. Layer 1 = agent-writable (this repo, mostly). Layer 3 = refuse and redirect (repository.yaml edits, production endpoint probes). See ../docs/global/AGENT_BOUNDARIES.md.

References — internal

• Repo-root CLAUDE.md — authoritative facts list.
• ../docs/architecture.md — full deploy lifecycle and gotchas.
• ../wiki/entities/DevOps Infra Helm Charts.md — entity model.
• ./09-common-tasks.md — task index.

References — external

• Sister repo (Argo Application manifests): github.com/Meesho/devops-infra-argo-config
• AI Blitz Plan — internal Confluence; ask the primary owner for the current link.
• Argo CD — argo-cd.readthedocs.io, chart at github.com/argoproj/argo-helm
• Contour — projectcontour.io, chart at github.com/bitnami/charts/tree/main/bitnami/contour
• VictoriaMetrics — docs.victoriametrics.com, charts at github.com/VictoriaMetrics/helm-charts
• HashiCorp Vault — developer.hashicorp.com/vault, chart at github.com/hashicorp/vault-helm
• KEDA — keda.sh, chart at github.com/kedacore/charts
• Kyverno — kyverno.io, chart at github.com/kyverno/kyverno/tree/main/charts
• External Secrets Operator — external-secrets.io
• GKE Autopilot ComputeClass — cloud.google.com/kubernetes-engine/docs/concepts/autopilot-compute-classes