Glossary

149 terms from Cloud Deployment, in plain words, each with the chapter that teaches it.

Search the glossary

#

--allow-unauthenticated: A `gcloud run deploy` flag that makes the service's URL public so anyone can call it. The orders API needs it because it does its own logins instead of relying on Google credentials.
--cpu-boost: A Cloud Run setting that gives an instance extra CPU while it starts, which shortens cold starts for Kettle & Crane's API.
--max / --min (Cloud Run): Flags that set the most and fewest instances Cloud Run keeps. `--max 3` protects both the bill and the database's connection limit, and `--min 0` allows scale to zero.

A

A record: A DNS record that points a name at an IP address: A for IPv4, AAAA for IPv6. It is used where a CNAME isn't allowed, such as the apex domain.
action (GitHub Actions): A published, ready-made building block that a workflow step can use with `uses:`, such as checking out your code.
actionlint: A free checker for GitHub Actions workflow files. It catches mistakes in `deploy.yml` before you push it.
Alembic: The migration tool for SQLAlchemy. It records each database schema change as a numbered script, so tables can change safely after launch.
ALIAS record: A DNS record offered by some DNS hosts that behaves like a CNAME but is allowed at the apex domain.
Amazon CloudWatch: AWS's logs, metrics and alarms service, equivalent to Cloud Logging and Cloud Monitoring.
Amazon ECR: AWS's container registry, where the orders API's image would be stored on AWS. It is the equivalent of Artifact Registry.
Amazon RDS: AWS's managed PostgreSQL service, the equivalent of Cloud SQL.
Amazon Route 53 and ACM: Route 53 is AWS's DNS service and ACM (AWS Certificate Manager) issues HTTPS certificates. Together they handle the custom domain on AWS.
amd64: The 64-bit Intel-style processor type Cloud Run uses. Apple-silicon Macs are ARM, so images built there must be built with `--platform linux/amd64` or they won't start in the cloud.
apex domain: The bare domain with no subdomain in front, such as `kettlecrane.example`. DNS rules don't allow a CNAME here, so you use an A or ALIAS record.
ARN: AWS's full unique name for any resource, such as the role a GitHub workflow assumes.
Artifact Registry: Google Cloud's container registry, where Kettle & Crane stores its Docker images so Cloud Run can pull them.
autoscaler: The part of a platform that adds instances when load rises and removes them when it falls.
AWS (Amazon Web Services): Amazon's cloud platform, the largest of the major cloud providers. It offers services comparable to Google Cloud's, such as ECS for running containers and Lambda for serverless functions.
AWS App Runner: AWS's service closest to Cloud Run. It is closed to new customers as of October 2026, and AWS recommends ECS Express Mode instead.
AWS Budgets: AWS's budget and alert service, equivalent to Google Cloud budgets. Like them, it warns but doesn't stop spending.
AWS Secrets Manager: The AWS equivalent of Secret Manager, which stores secrets such as the database URL.

B

backup: A copy of data from before a mistake. It is what you restore from when bad data, not bad code, is the problem.
billing account: The Google Cloud object that holds your payment card. Each project is linked to one billing account, and its costs land there.
Blueprint: A `render.yaml` file in your repository that describes your Render services and databases, so the whole setup can be recreated from one file.
budget: A spending amount, such as Kettle & Crane's $25, that emails you at chosen percentages. It only warns and never stops spending.

C

CAA record: A DNS record listing which certificate authorities may issue certificates for your domain. It must include your host's CA.
canary release: Another name for a gradual rollout: sending a small share of real traffic to a new version first.
certificate authority: An organization that browsers trust to sign HTTPS certificates, such as Let's Encrypt or Google Trust Services.
CI/CD: CI tests every change automatically when it's pushed, and CD releases every change that passes. Together they make the pipeline from a push to a live release.
cleanup policy: Rules on an Artifact Registry repository that delete old images automatically, such as images older than 30 days while keeping the newest 5.
Cloud Armor: Google Cloud's protection service that can block abusive addresses before they reach your app. It needs the load balancer setup.
Cloud Build: Google's build service. `gcloud run deploy --source .` uses it to build your Dockerfile in the cloud.
Cloud Logging: Google Cloud's log store, which collects Cloud Run's output. The Logs Explorer is its search page.
Cloud Monitoring: Google Cloud's service for uptime checks, metrics and alert policies.
Cloud Run: Google's serverless container service. It runs your image, starts instances on demand, scales to zero, and bills only for use.
Cloud Run domain mapping: A free, Preview-status way to put your own domain on a Cloud Run service. Kettle & Crane uses it for `api.kettlecrane.example`.
Cloud Run job: A container on Google Cloud Run that runs a command to completion instead of serving requests. It is useful for one-off or scheduled tasks such as running database migrations with the same image, identity and secrets as the service.
Cloud Run service: Your app's permanent home on Cloud Run: a name, a URL and its settings. Each deploy adds a revision to it.
Cloud SQL: Google's managed database service. Google runs, updates and backs up the PostgreSQL server for you.
Cloud SQL Auth Proxy: A small program from Google that runs on your laptop and forwards a local port to your Cloud SQL instance over an encrypted, identity-checked connection.
Cloud SQL connection name: The identifier of a Cloud SQL instance in the form `PROJECT:REGION:INSTANCE`. It names the instance in `--add-cloudsql-instances` and in the `/cloudsql/` socket path.
CNAME record: A DNS record that points one name at another name, such as `api` pointing at `kettle-api.onrender.com`. It can't be used at the apex.
cold start: The short delay when the first request after a quiet spell has to wait for a new instance to start. It is the price of scale to zero.
commit SHA: A Git commit's unique ID. The pipeline pins actions to one and tags images with it, so you know exactly which code is running.
concurrency: How many requests one instance handles at the same time. Cloud Run's default is 80.
connection pool: A set of open database connections that an app reuses, because opening one is slow. Each instance has its own pool.
connection pooler: A service in front of the database that lets many app connections share a few database connections.
connection URL: A database's address and login in one string, such as `postgresql://user:pw@host/db`. On Cloud Run it points at a Unix socket instead of a host.
container registry: A server that stores container images so hosts can pull them. Google's is Artifact Registry.
CORS: The browser rule that only lets websites call your API from origins you list. Kettle & Crane's shop website has to be in `CORS_ORIGINS`.
curl -I: A command-line HTTP client. With `-I` it shows only the status line and headers, which is handy for checking HTTPS and redirects.

D

Dependabot: A GitHub feature that opens a pull request when a newer version of one of your dependencies exists. It keeps packages, the Dockerfile base image and actions up to date.
deploy: To run an app on an always-on computer, at a public address, with real data, so real users can use it.
deque: A list that is fast to add to at one end and remove from at the other. The login limiter uses one to hold the times of recent attempts.
dig: A command that asks DNS what a name points at, used to check your records. On Windows use `nslookup`.
DNS: The internet's phone book. It turns a name like `api.kettlecrane.example` into the address of a computer.
Docker Compose: A Docker tool that runs several containers together from one file. Here it runs the API and a PostgreSQL 17 database on your laptop.
Docker image: A packaged snapshot of your app and everything it needs. A container is a running image, and one running copy on a host is an instance.
Dockerfile: The recipe for building a container image of your app. Render and `docker build` both read it.
domain verification: Proving you own a domain before Google lets you map it, by adding a TXT record that Google Search Console asks for.
driver: The package a library uses to talk to a database. The orders API uses psycopg for PostgreSQL, hence `postgresql+psycopg://`.

E

ECS Express Mode: AWS's recommended Cloud Run-like service. ECS runs containers and Fargate runs them without servers to manage. It needs an image, a task execution role and an infrastructure role, and it creates an hourly-billed load balancer.
edition (Cloud SQL): Cloud SQL's Enterprise or Enterprise Plus level. For PostgreSQL 16 and later the default is the far costlier Enterprise Plus, so you must pass `--edition=enterprise`.
environment variable: A named value the operating system hands to a program. Hosts use them to pass in settings and secrets, so one image works everywhere.
ephemeral container storage: Files written inside a container last only as long as that container, so they vanish on every redeploy or restart. This is why production data belongs in a managed database, not a SQLite file.
expression (GitHub Actions): A `${{ ... }}` placeholder that GitHub fills in when a workflow runs, such as `github.sha` or `vars.DEPLOY_SA`.

F

Firebase Hosting: A Google service that can sit in front of Cloud Run to give it a custom domain, and can also serve a static website.
Fly.io and Railway: Platform-as-a-service hosts, like Render, that run your app for a price. Fly.io bills per second while a machine runs, and Railway charges a $5 monthly plan plus usage.
forecast: Google's projection of the month's final spend. A forecast alert warns you days before the money is spent.
free tier: Usage a provider gives free every month, such as Cloud Run's 2 million requests. It is separate from the one-off free trial credit.

G

gcloud: Google Cloud's command-line tool. You use it to create projects, push images, deploy services and manage secrets.
GiB-second: The units Cloud Run bills in. A vCPU-second is one core busy for one second, and a GiB-second is one gibibyte (about 1.07 GB) of memory held for one second.
GitHub Actions: GitHub's service for running automated pipelines on your repository, described in YAML workflow files.
gradual rollout: Moving traffic to a new version in steps, such as 10% first, while watching for errors.

H

health check: An endpoint or test that reports whether an app works. Kettle & Crane's `/health` runs a database query and returns 503 on failure.
host: A company or service that runs your app for you, such as Render or Google Cloud.
Host addresses (127.0.0.1, 0.0.0.0): `0.0.0.0` means 'listen on every network interface', which a container needs so the host can reach it. `127.0.0.1` (localhost) accepts connections only from inside the same machine or container.
HTTP status codes: Three-digit replies that say how a request went: 200 OK, 3xx redirect, 401 Unauthorized (bad login), 403 Forbidden (not allowed), 404 Not Found, 429 Too Many Requests (limit reached, as with `--max` or the login limiter), 503 Service Unavailable (such as `/health` when the database is down), and 5xx for server faults.
HTTPS: HTTP over an encrypted TLS connection. It needs a certificate proving the server owns the name.

I

IAM: Google Cloud's system for who can do what. Every person and program has an identity, and identities are granted roles.
infrastructure as code: Describing servers, databases and settings in files you can review and reuse, like `render.yaml`. Terraform and OpenTofu do this for any cloud.
instance: One running copy of your container. There may be zero, one or many.
Internal and External Database URL: Render's two connection URLs for a database. The Internal one works only from Render services in the same region and is faster and private; the External one works from anywhere, such as your laptop, so treat it like a password.
IP allow list: A list of IP addresses permitted to connect to a database from outside. In `render.yaml` it limits who can use the External Database URL, and `/32` means exactly one address.

K

Kubernetes: An open-source system for running and managing containers at scale. It underlies many large platforms and is common at bigger companies.

L

least privilege: Giving each identity only the smallest set of permissions it needs, such as letting the app read just its three secrets.
liveness probe: A check that shuts down a running instance that stops answering. Don't point it at a health check that includes the database.
load balancer: A program that spreads incoming requests across instances. On AWS it bills every hour, even when idle.

M

managed database: A database server that the host runs, patches and backs up for you, such as Render Postgres or Cloud SQL.
max_connections: The hard limit on simultaneous connections a PostgreSQL server accepts. Maximum instances × connections per instance must stay below it.
middleware: Code that a web framework such as FastAPI runs around every request. It is commonly used for cross-cutting tasks like logging each request's status and duration.

N

Neon: A managed PostgreSQL provider with a free plan, mentioned as an alternative to Cloud SQL.

O

OIDC: The standard behind GitHub's identity tokens. On AWS you register GitHub as an OIDC identity provider to get keyless deploys.

P

PaaS: A host that runs your app on its own machines and handles HTTPS, restarts and deploys. Render is an example.
pg_dump / pg_restore: PostgreSQL tools that write a database to a file and load it back. They make backups that live outside the cloud account.
pipeline: The automated steps from a push to a running release: test, build, push and deploy.
point-in-time recovery: Restoring a database to any moment within a retention window, not just to last night's backup. In Cloud SQL you do it by cloning to a new instance.
PORT: The environment variable a host uses to tell your app which port to listen on. Render uses 10000 and Cloud Run 8080.
PostgreSQL: The open-source database the orders API uses in production, in place of SQLite.
Preview: A Google Cloud feature offered before general availability, with limited support. Cloud Run domain mapping is one.
production: The live copy of the app that real users depend on.
project (Google Cloud): A Google Cloud container for services, databases, secrets, permissions and costs. Its project ID must be unique worldwide.
psql: PostgreSQL's command-line client for connecting to a database and running SQL. For example, `SHOW max_connections;` reports how many connections the database allows.
pull request: A proposed change on GitHub, waiting for review. In the pipeline, pull requests run the tests but are never deployed.
pydantic-settings: The library that fills the app's `Settings` fields from environment variables of the same name, falling back to a `.env` file.

R

rate limit: A cap on how often something may happen. The login limiter allows 5 attempts per username per minute and answers 429 with a `Retry-After` header.
region: A group of data centers in one area, such as `us-west1` (Oregon). Keep the app and database in the same region.
registrar: A company that sells and registers domain names.
Render: A platform-as-a-service host that builds and runs your app, for example from a Dockerfile in a GitHub repository. It charges fixed monthly prices per instance, which makes costs predictable.
repository variable: A non-secret setting stored on GitHub for workflows, read with `vars.`, such as `WIF_PROVIDER`.
revision: A frozen copy of one image plus one set of settings in a Cloud Run service. Every deploy or settings change adds one, and old ones stay for rollbacks.
role: A named bundle of permissions in IAM, such as `roles/cloudsql.client`.
rollback: Sending traffic back to a previous version. It fixes bad code but not bad data.
rotate: To replace a secret with a new value, on a schedule or right away if it may have leaked.
runner: The fresh virtual machine that runs a GitHub Actions job.

S

scale to zero: Running no instances when there is no traffic, so you pay nothing for compute. The cost is a cold start on the next request.
scale up / scale out: Scaling means matching capacity to demand. Scale up uses a bigger instance, and scale out uses more instances.
schema migration: A change to the structure of database tables, such as adding a column. Make migrations additive so old code keeps working, and run them with a tool like Alembic, for example as a Cloud Run job.
secret: Any setting that would let someone in if they saw it, such as `SECRET_KEY`, the partner key or the database password. Keep secrets out of code and Git.
Secret Manager: Google Cloud's encrypted store for secrets. It controls who can read each one and keeps every version.
secret version: Each change to a secret in Secret Manager creates a numbered version. Pinning a version, such as `:1`, means a new version only reaches the app when you deploy.
serverless: A style where you never see the servers. The host starts instances when requests arrive and stops them when they don't, and you pay only for use.
service account: An identity for a program rather than a person. The app runs as `kettle-api-runtime` and the pipeline as `kettle-deployer`.
service account key: A JSON file that works like a never-expiring password for a cloud service account. If it leaks, anyone can use it until it is found and revoked, so short-lived credentials such as Workload Identity Federation are safer.
service container: A container, such as PostgreSQL, started alongside a CI job so the tests can use it.
shared-core machine: A small database machine that shares a processor with other customers. It exists only in the Enterprise edition and has no uptime guarantee.
SIGTERM: The signal a host sends before stopping an instance, so it can finish its requests. Cloud Run allows 10 seconds.
smoke test: A quick check you run right after a deploy. `check_live.py` calls `/health` and exits with an error if the API isn't healthy.
spend cap: A budget setting for some services, including Cloud Run, that pauses new usage when the cap is reached. Enforcement isn't instant, so set it well above normal spend.
SQLAlchemy: The Python database library under SQLModel. It needs a driver name in the URL, such as `postgresql+psycopg://`.
SQLite: A database stored in a single file. It is fine locally but loses data inside a container that gets replaced.
staging service: A second copy of the service, with its own small database and secrets, where each release is tried before production.
standard output / standard error: The two streams a program writes text to. Hosts collect them as your app's logs.
startup probe: A Cloud Run check that must pass before an instance gets traffic. Pointing it at `/health` stops a broken revision from ever serving.
structured log: A log line written as one JSON object with named fields, such as `severity` and `message`, so Cloud Logging can search it.
subdomain: A name under a domain, such as `api.kettlecrane.example`.

T

tag (image): A label after a colon in an image name that names a version, such as `:v1` or a commit SHA.
TLS certificate: A file proving a server owns a name, needed for HTTPS. Render and Cloud Run issue and renew them automatically once DNS points at them.
TTL: How many seconds other computers may cache a DNS answer. Lower it before changing an important record.
two-step verification: Requiring a second proof besides a password when signing in. Turn it on for every account that can change production.

U

Unix socket: A file-like connection point between programs on one machine. Cloud Run reaches Cloud SQL through one under `/cloudsql/`.
uptime check: A check that calls your URL from several places on a schedule. An alert emails Sam and Alex when it fails.

V

validator: A method that checks or changes a setting as it's loaded. The one in `config.py` rewrites `postgresql://` URLs to `postgresql+psycopg://`.
vCPU: One virtual processor core.
virtual machine: A slice of a big server that behaves like a computer of your own. It gives full control and full responsibility, and you pay for every hour it exists.
volume (Docker): Storage Docker keeps outside a container so data survives when the container is replaced.

W

workflow: A GitHub Actions pipeline defined in a YAML file under `.github/workflows/`. It has jobs, and each job has steps that run commands or use actions.
Workload Identity Federation: A way to swap an outside token, such as GitHub's, for short-lived Google Cloud access, so no service account key is stored anywhere.

Z

zero-downtime deploy: A release where the old version keeps serving until the new one passes its health check.