Glossary

One-line definitions of the terms used throughout these docs.

Adopt (mode) — Reference a datastore or operator the user already created; use it but never manage its lifecycle. See Provenance.

Auto-wiring — The licensed capability where the operator provisions and injects credentials across components so you configure no cross-component secrets by hand. See Auto-Wiring.

Capability operator — An upstream operator the platform depends on (CloudNativePG, External Secrets, LiteLLM, …), installed by the operator from a bundled Helm chart.

Community edition — The free, license-less mode: full platform, one instance per type, manual wiring. The fallback when a license is absent or expired.

Established (CRD) — A CRD condition meaning the API server has registered the kind. The operator waits for this before creating resources of a new kind.

External (mode) — A datastore hosted outside the cluster; the operator installs no operator and only wires a connection secret.

Entitlements — The explicit features + quantitative limits carried in a license. There is no wildcard.

ESO — External Secrets Operator; pulls secrets from an external store (Key Vault, Vault, AWS, …) into Kubernetes Secrets.

Finalizer — A marker that lets the operator run cleanup (remove emitted CRs, uninstall owned releases) before a resource is deleted.

Guardrail — The Enterprise data-path proxy that enforces PII pseudonymization; enforced at runtime and fails closed without a valid entitlement.

Managed (mode) — The operator creates, owns, and garbage-collects the datastore custom resource.

Owned vs. adopted (release) — Owned releases carry the operator's ownership label and are upgraded/uninstalled by the operator; adopted releases were installed by someone else and are never touched.

Provenance — The rule that the operator never re-installs what you installed and never uninstalls what it doesn't own. See Provenance.

Ref-counting — Tracking how many resources need a capability operator, so it is uninstalled only when none do (and only if owned).

Secrets backend — ESO or Sealed Secrets, selected by SecretsManagement.

Stack — The optional, licensed umbrella resource that bundles and auto-wires a curated set of components.

Type × mode — A datastore's backend implementation (type) and its provenance (mode). See Core Concepts.

Workload — The actual running thing (a LiteLLM instance, a Postgres cluster), expressed as upstream CRs or a workload Helm release — as opposed to the capability operator that reconciles it.