Glossary and conventions
This glossary explains terms used when editing and administering Viking sites. Follow the linked guides
for operational steps; a definition alone is not a setup procedure. Example
hostnames, namespace names, IDs and version strings must be replaced with your
own values. Commands are normally run from repository root unless a guide says
otherwise. :8080 is a listen address, not a browser URL.
Website and authoring terms
| Term | Meaning in Viking |
|---|---|
| CMS (content management system) | The authenticated backend and browser editor used to create a site |
| Frontend | Public Go static file server, distinct from the browser editor's JavaScript |
| Operator / controller | Kubernetes application that watches desired Website resources and reconciles infrastructure |
| Publisher | CMS-integrated engine that generates a static release from saved source |
| Draft / source | Saved editable content on private storage; browser changes are unsaved until committed |
| Preview | Private rendering for review; it does not activate public content |
| Release | Completed generated site directory, normally named with a six-digit sequence such as 000001 |
| Activation | Moving the current-release pointer during publish or rollback |
| Atomic rename | One filesystem operation replacing a directory entry; a reader sees one pointer or the other |
| Snapshot | A fixed set of source/settings/assets used for one publish; a storage-provider snapshot is a separate backup mechanism |
| Rollback | Reactivating a retained public release without changing editable drafts |
| Retention | Number of old releases kept after safe cleanup; zero is the default |
| Asset / media | Uploaded bytes and metadata, with a generated ID and URL |
| Raw object | Descriptive page linked to an unchanged file served as a download attachment |
| Theme | Shared native templates, styles and optional bundled assets around page content |
| Layout / shared part | A theme's page template / reusable template fragment such as a header |
| Binding / slot | Placeholder filled with a value such as page content, site title or navigation |
| Block | Insertable piece of visual page/template content |
| Index / repeater | Generated listing of URI children / a styled template expanded for matching pages or raw objects |
| Package / plugin | Local ZIP containing a renderer or block pack; theme ZIPs use their own manifest |
| Markdown | Plain-text formatting language used for source pages; Visual and Source modes edit the same content |
| HTML / CSS | Languages for document structure / visual styling; unsafe content is sanitized |
| GrapesJS / Tiptap | Browser engines for visual HTML/theme editing / visual Markdown editing |
| SPA (single-page application) | Browser UI built as static JavaScript/CSS files and served by the CMS |
| SEO | Search-engine metadata such as document title and description, not a guarantee of ranking |
| WXR | WordPress's XML export format; import creates Markdown drafts |
| WASI / Wasm | WebAssembly System Interface / WebAssembly; renderer packages run as bounded WASI commands in the CMS |
Kubernetes and storage terms
| Term | Meaning |
|---|---|
| Cluster / namespace | Kubernetes installation / scope grouping resources within it |
| kubectl / context | Kubernetes command-line client / selected cluster and credential configuration |
| Custom resource / CRD | Domain-specific object such as Website / the definition that installs its schema in Kubernetes |
| Spec / status / generation | Desired settings / observed results / monotonically increasing spec revision indicator |
| Reconcile | Compare desired and actual resources, then create/update/remove managed state |
| Pod / Deployment / replica | Running container group / desired workload and rollout manager / one instance of that workload |
| Service / ClusterIP | Stable internal traffic destination for selected pods / a cluster-internal virtual address |
| Ingress / IngressClass | HTTP hostname/path routing resource / selection of the ingress controller implementing it |
| DNS | Maps website hostnames to the reachable ingress address; configured outside Viking |
| TLS / certificate | Encrypted authenticated transport / identity and public-key material used to establish it |
| cert-manager / Issuer / ClusterIssuer | Optional certificate automation / namespaced issuer settings / cluster-scoped issuer settings |
| PVC / PV | PersistentVolumeClaim requests storage / PersistentVolume represents the provisioned storage |
| StorageClass / CSI | Storage provisioning configuration / Container Storage Interface used by drivers |
| RWX / RWO | ReadWriteMany allows multi-node shared mounts / ReadWriteOnce generally restricts writable mounting to one node |
| Reclaim policy | What backing storage does when its claim is released; separate from Viking retaining PVC objects |
| Symlink / hard link | Filesystem path pointing to another path / another directory entry holding the same file bytes |
| fsync / directory sync | Requests durability of file bytes / directory entries through filesystem sync operations |
| UID/GID / fsGroup | Filesystem user/group IDs / Kubernetes volume group-permission setting |
| RBAC / ServiceAccount | Role-based access control / workload identity for Kubernetes API calls |
| Role / ClusterRole / binding | Namespaced permissions / cluster-wide permission definition / assignment of permissions to an identity |
| Owner reference / finalizer | Kubernetes ownership/garbage-collection relation / cleanup gate before object deletion completes |
| Secret / ConfigMap | Kubernetes credential/configuration object / non-secret configuration object; base64 is not encryption |
| Leader election / Lease | Choosing one active controller / Kubernetes lock resource used for that coordination |
| Recreate / rolling update | Stop old workload before replacement / replace replicas progressively |
| NetworkPolicy | Network restrictions enforced by a supporting cluster plugin; configured through cluster policy |
| Port-forward | Temporary local connection to a selected pod's port through Kubernetes; Ctrl+C stops it |
Authentication and HTTP terms
| Term | Meaning |
|---|---|
| Origin / hostname / path | Scheme+host+port / DNS name / URL portion such as /about/; a path alone is not a full URL |
| OAuth2 / OIDC / IdP | Authorization protocol / OpenID Connect identity layer / external identity provider |
| Client / callback | Registered application using the IdP / URL receiving the login response |
| Confidential / public client | Client with a secret / client without one using the supported PKCE login flow |
| PKCE / state / nonce | Login code-exchange binding / request-response flow binding / token replay binding |
| Scope / role / audience | Requested token capability/claims / membership used by Viking permission gates / intended token recipient |
| Issuer / subject | Provider's identity identifier / account identifier within that provider; together identify a principal |
| JWT / JWKS / introspection | Signed structured token / provider signing-key set / provider endpoint for checking opaque tokens |
| Bearer token | Explicit HTTP credential in Authorization; anyone holding it can use it while valid |
| Cookie / session | Browser-stored value / authenticated interaction state, encrypted and signed by Viking |
| CSRF | Cross-site request forgery; browser mutations require session-bound token protection in addition to authentication |
| CSP / sanitization | Content Security Policy restricting browser execution/resources / removing unsupported unsafe markup |
| MIME / Content-Type | Media type identifying bytes, such as image/png / header conveying it |
| Attachment | Response disposition asking the browser to download rather than render inline |
| ETag / conditional request | Representation validator / request that may reuse cached content when the validator matches |
| Range request | Request for selected file bytes; frontend supports one byte range, not multipart ranges |
| Cache-Control / CDN | HTTP caching instructions / optional external content-delivery cache, not installed by Viking |
| Liveness / readiness | Whether a process is alive / whether its specific component checks allow traffic |
| Metrics / scrape / histogram | Numeric telemetry / collecting its endpoint / bucketed counts and durations |
| Cardinality | Number of distinct metric label combinations; unbounded user input must not create unrestricted series |
| Build version / release ID | Application identity stamped in a binary / numbered generated website content; they are independent |
| CI / artifact / image digest | Continuous integration / output saved between jobs / immutable container-content identifier |
Reading notation and size limits
GET /api/pages/{id} means replace {id} with a returned page ID; do not include
braces literally. A filesystem example <asset-id> means a generated identifier,
not a directory actually named with angle brackets. Uppercase YOUR_* values
are placeholders, not usable configuration. Shell $VARIABLE values must be set
in that shell before running the example. A command remaining in the foreground
needs another terminal for concurrent checks.
KiB and MiB mean 1024 and 1048576 bytes. Kubernetes Gi storage quantities mean
1024 cubed bytes. 1h and 30s are durations, not timestamps. JSON timestamps
are server-generated UTC values where the API uses time fields. Numeric API
status codes describe success/failure; do not infer success solely from an
error-free browser page or a response body you have not checked.