Glossary

This glossary defines common terms used across Karios documentation.

AIO (all-in-one): Deploy role in which one node runs every role on a single chassis — control plane, storage, and compute. Needs two or more disks. Contrast Management only.
Audit stream: Per-node K-Shield feature that forwards the node’s audit logs to a configured SIEM endpoint.
BMC: Baseboard Management Controller used for out-of-band server control such as power, console, and firmware access.
BMO: Bare Metal Orchestration. Taking a physical server with a reachable BMC through to a working Karios node, and returning it to inventory afterwards. Run from K-Forge.
CAT I: Highest-severity security finding in K-Shield workflows. Treat as critical priority.
CAT II: High-severity security finding in K-Shield workflows. Address after CAT I items.
CAT III: Lower-severity security finding in K-Shield workflows. Track and remediate after higher-risk items.
CIDR: Classless Inter-Domain Routing notation for describing IP ranges, for example 10.0.1.0/24.
CIS: Center for Internet Security benchmark guidance used for hardening checks.
Cloud-Init: First-boot VM initialization mechanism for configuration and automation.
CNI: Container Network Interface used by Kubernetes to attach networking to pods.
Control Center: The Karios web UI. Operators use it to manage compute, storage, networking, Kubernetes, security, and bare-metal lifecycle after the install completes and the node reboots.
cosign: An artifact-signing standard. Karios signs every update and plugin bundle with it, and each node verifies the signature before the bundle is installed.
CRUSH: The Ceph data-placement algorithm that decides where replicas or erasure-coded chunks are stored.
CSI: Container Storage Interface used by Kubernetes to provision and attach storage volumes.
daemon: Long-running background service process, for example mon, mgr, osd, mds, or rgw in Ceph-based workflows.
DCIM: Data Center Infrastructure Management inventory and facility-tracking system for devices, racks, sites, and cabling.
Deploy role: Chosen on the installer’s Target Disk step. Sets what a node runs — either AIO (all-in-one) or Management only — and determines the minimum disk count.
DRS: Dynamic Resource Scheduling for workload placement and balancing.
EVPN: Ethernet VPN control-plane technology used with VXLAN overlays.
fio: Flexible I/O Tester used to benchmark storage performance with controlled read and write workloads.
FIPS 140-3: U.S. cryptographic-module security standard; K-Shield scores managed nodes against a FIPS 140-3 profile.
FSAL: File System Abstraction Layer used by NFS services to expose backend file systems.
FSID: Unique Ceph cluster identifier shared by all daemons in the same cluster.
Golden image: The install log’s name for the Karios platform image. The installer bundle calls the same file the golden VM template. See Platform image.
IOMMU: Input/Output Memory Management Unit used for device isolation, passthrough, and some virtualization features.
IPAM pool: The range, defined by a start and end address, that future nodes may claim on a network role. Distinct from the node’s own management address.
IPMI: Intelligent Platform Management Interface, a common management protocol exposed by many BMC implementations.
K-Store: The in-product catalogue for optional Karios features. Plugins are installed from K-Store -> Plugins; platform releases are listed under K-Store -> Updates.
K-Trace: Karios’s built-in security operations (SOC) console: it collects security events from sensors, raises detections, opens and tracks incident cases, and enriches them with threat intelligence.
k3s: A lightweight, self-managed Kubernetes distribution offered on the Karios Kubernetes dashboard. Karios provisions ordinary VMs, installs k3s, and returns a kubeconfig. See k3s on Karios.
k8s: Shorthand for Kubernetes; on Karios it refers to the managed Kubernetes service (as opposed to the lightweight k3s). See Kubernetes on Karios.
Kubeconfig: The file kubectl uses to authenticate to a cluster’s API endpoint. Download it from a cluster’s Access tab (k3s) or Access details (managed Kubernetes).
Kubernetes: Open-source container orchestration platform. Karios offers two distributions on the Kubernetes dashboard: the managed k8s service and the lightweight self-managed k3s.
LACP: Link Aggregation Control Protocol for bundling multiple physical links into one logical path.
Management only: Deploy role in which a node runs only control-plane services and databases — no local virtual machines and no storage workload. Runs on a single disk. Contrast AIO (all-in-one).
mTLS: Mutual TLS — both sides of a connection present a certificate. Shown on the online update source when the cluster is authorised to reach the release server.
MTU: Maximum Transmission Unit, the largest frame size a network interface sends without fragmentation.
NIST: U.S. National Institute of Standards and Technology. Often referenced for security control and hardening guidance.
OOB: Out-of-band management path, for example BMC access, independent of workload traffic.
overcommit: Practice of assigning more logical CPU or memory capacity to workloads than is physically present on a host or cluster.
PG (Placement Group): A data-placement unit used by Ceph to distribute and recover objects across OSDs.
Platform image: The Karios .qcow2 image delivered to the node from a second machine when the install pauses at 96%. Also called the template in the installer bundle, and the golden image in the install log — all three refer to the same file. Not to be confused with VM Template.
Prometheus: Time-series monitoring system that collects metrics and evaluates alert rules.
PromQL: Prometheus Query Language used to graph, filter, and alert on Prometheus metrics.
PXE: Preboot Execution Environment used for network boot and bare-metal provisioning workflows.
RADOS: The underlying distributed object store used by Ceph.
RBAC: Role-Based Access Control for permission and scope management.
RBD: RADOS Block Device, Ceph virtual block storage used for disk images.
ReBAR: Resizable BAR, a PCIe feature that can improve access to some GPUs or accelerators when supported and validated.
RGW: RADOS Gateway daemon that provides S3- and Swift-compatible object-storage endpoints.
RMS: Release Management Service. The Karios component that fetches platform update bundles, verifies their signature and checksum, and applies them component-by-component.
RPO: Recovery Point Objective, the maximum acceptable data-loss window.
RTO: Recovery Time Objective, the maximum acceptable service-restoration window.
SCAP: Security Content Automation Protocol standard used by security scanning baselines.
SIEM: Security Information and Event Management platform used to aggregate, correlate, and alert on security events.
SR-IOV: Single Root I/O Virtualization, which exposes virtual functions from one physical PCIe device to multiple workloads.
SSVM: Image Storage VM used for image, template, and snapshot transfer operations. The backend acronym still expands to Secondary Storage VM.
STIG: Security Technical Implementation Guide, the hardening baseline K-Shield scans managed nodes against (for example the FIPS 140-3 profile).
SVM (AMD): AMD Secure Virtual Machine virtualization setting, also known as AMD-V, required for hardware-assisted virtualization on AMD CPUs.
System VM: A virtual machine the platform runs for itself rather than for a workload. Karios starts two automatically, a Console Proxy and a Secondary Storage VM; both must reach Running for an install to be complete.
vdev: A ZFS virtual device — the grouping of physical disks (single, mirror, raidz1 and so on) that determines a pool’s redundancy. Fixed when the pool is created.
VM Template: A prebuilt, ready-to-use operating system image registered in Control Center -> Storage -> VM Templates and used to provision virtual machines. Unrelated to the Platform image delivered during installation.
VNI: VXLAN Network Identifier used to distinguish overlay segments.
VRF: Virtual Routing and Forwarding instance used to isolate routing tables on the same network device.
VTEP: VXLAN Tunnel Endpoint that encapsulates and decapsulates VXLAN traffic.
WAL/DB device: Separate fast storage device used by Ceph BlueStore to hold write-ahead log and metadata database data for an OSD.