CI/CD
CI/CD stands for Continuous Integration and Continuous Delivery (or Deployment). It names the automated pipeline that builds, tests, and ships software, where CI merges and verifies changes on a shared mainline and CD keeps every passing change releasable (delivery) or releases it automatically (deployment).
IaC
IaC means Infrastructure as Code: defining servers, networks, and cloud resources in version-controlled declaration files (Terraform, Pulumi, CloudFormation, Ansible) rather than manual console operations, so environments are reproducible and reviewable.
DORA
DORA is the DevOps Research and Assessment program, whose research defines four key delivery-performance metrics - deployment frequency, lead time for changes, change failure rate, and time to restore service - used to benchmark engineering organizations.
MTTR
MTTR is Mean Time to Recovery (or Restore): the average time to restore service after a production failure. It is a DORA stability metric and is often more impactful on user-perceived reliability than reducing failure frequency.
SLA
SLA stands for Service Level Agreement: a contractual commitment to a customer about service performance (for example uptime), usually with penalties for breach. It is the external promise, looser than the internal SLO that engineering targets.
SLO
SLO stands for Service Level Objective: an internal target for an SLI over a window (for example 99.9% success over 30 days). It defines the reliability bar the team commits to and the threshold at which the error budget runs out.
SLI
SLI stands for Service Level Indicator: the measured signal (latency, error rate, availability) that an SLO sets a target for. A good SLI is a ratio of good events to valid events that tracks user happiness.
OCI
OCI is the Open Container Initiative, the standards body that defines the container image format, runtime, and distribution specifications. "OCI image" and "OCI registry" mean container artifacts that conform to these vendor-neutral specs.
OTel
OTel is the common short name for OpenTelemetry, the CNCF vendor-neutral standard and SDK set for generating and exporting telemetry - traces, metrics, and logs - so observability data is not locked to one backend.
CNCF
CNCF is the Cloud Native Computing Foundation, the Linux Foundation body that hosts and governs projects such as Kubernetes, Prometheus, Argo, and OpenTelemetry, and defines what "cloud native" tooling looks like.
K8s
K8s is the numeronym for Kubernetes (K, eight letters, s), the dominant container orchestrator. It is written this way in tooling, chat, and configuration to save typing the full name.
Pod
A Pod is the smallest deployable unit in Kubernetes: one or more tightly coupled containers that share a network namespace and storage, scheduled together on one node. Most workloads run one main container per Pod, sometimes with sidecars.
YAML
YAML ("YAML Ain't Markup Language") is the indentation-based, human-readable data format used to declare most CI/CD pipelines and Kubernetes manifests. Its sensitivity to indentation and implicit typing (the "Norway problem" where no becomes false) is a frequent source of config bugs.
SBOM
SBOM is a Software Bill of Materials: a machine-readable inventory of all components and dependencies in a build, in a standard format such as SPDX or CycloneDX, used for vulnerability impact analysis and supply-chain compliance.
SAST
SAST is Static Application Security Testing: analyzing source or binaries without running them to detect vulnerability patterns. It runs early and broadly but yields false positives, and is paired with the dynamic counterpart DAST.
DAST
DAST is Dynamic Application Security Testing: probing a running application from the outside with crafted requests to find runtime vulnerabilities. It has few false positives but covers only exercised paths, complementing SAST.
SCA
SCA is Software Composition Analysis: scanning a project's third-party and open-source dependencies for known vulnerabilities (CVEs) and license issues, typically against a database like the GitHub Advisory or NVD. It is the engine behind tools like Dependabot and Snyk.
CVE
CVE stands for Common Vulnerabilities and Exposures: a publicly catalogued security flaw with a unique identifier (for example CVE-2021-44228, Log4Shell). Pipelines fail builds when dependency scans find CVEs above a severity threshold.
SLSA
SLSA (pronounced "salsa") is Supply-chain Levels for Software Artifacts, a framework of graded requirements for build integrity and provenance that hardens a project against supply-chain tampering. Higher levels demand verifiable, non-falsifiable build provenance.
DRY Run
A dry run executes a command in a preview mode that reports what would change without applying it - terraform plan, kubectl apply --dry-run, helm diff. It is the safety check that lets reviewers see the effect of an infrastructure change before it lands.
RBAC
RBAC is Role-Based Access Control: granting permissions to roles and assigning roles to users or service accounts, rather than to individuals directly. In Kubernetes and CI systems it scopes what pipelines, operators, and humans can do, supporting least privilege.
GHA
GHA is the common shorthand for GitHub Actions, GitHub's built-in CI/CD system where workflows are YAML files under .github/workflows/ triggered by repository events. "Action" also refers to a reusable step published in the marketplace.
TTL
TTL means Time To Live: the lifespan after which a cached or temporary item is considered stale and refreshed or evicted. In CI/CD it governs build-cache freshness, DNS records during cutovers, and ephemeral environment teardown.
VM
VM is a Virtual Machine: a full guest operating system virtualized on a hypervisor, heavier and slower to start than a container but more strongly isolated. CI runners and some workloads run on VMs; containers run inside them.
PR
PR is a Pull Request (Merge Request, MR, in GitLab): the proposed change that CI validates and reviewers approve before it merges to the mainline. The PR is the central unit of code review and the natural place to run "shift-left" checks.
Rolling Update
A rolling update is a deployment strategy that replaces instances of the old version with the new one a few at a time, keeping the service available throughout. Kubernetes Deployments do this by default using maxSurge and maxUnavailable to bound the pace.
WIP
WIP means Work In Progress, often used as a WIP: PR prefix or a limit in Kanban. Limiting WIP - fewer changes in flight - is a lean principle that shortens lead time and is foundational to flow-based delivery.
MTBF
MTBF is Mean Time Between Failures: the average operational time between one failure and the next. In modern DevOps it is de-emphasized relative to MTTR, because in complex systems fast recovery is more achievable than preventing all failures.
Blast Radius
Blast radius is the scope of damage a failure or bad change can cause. Progressive delivery (canary, feature flags, cell-based architecture) exists to shrink the blast radius so a defect affects a small fraction of users before it is caught.
Toil
Toil is the SRE term for manual, repetitive, automatable operational work that scales with service size and adds no enduring value. Reducing toil through automation is a core SRE objective, freeing engineers for engineering rather than firefighting.