Glossary

This glossary defines security, infrastructure, and domain-specific terminology used throughout the Keystone Core documentation and codebase.

Security Terms

Attestation

The process by which an agent proves its identity and integrity to the control plane. Attestation methods include join tokens, cloud instance metadata, Kubernetes service account tokens, and TPM-based attestation.

Audit Mode

The v0.x → v1.0 policy posture: policies evaluate and emit audit records but never block requests. Enforcement (blocking on violation) graduates in v1.x. See POLICY-AUDIT.md .

Authentication

The process of verifying the identity of a user, agent, or service. Keystone Core supports multiple authentication methods including API keys, JWT tokens, mTLS certificates, and SPIFFE SVIDs.

Authorization

The process of determining whether an authenticated entity has permission to perform a specific action. Implemented via OPA (Rego) and CEL policy engines.

CA (Certificate Authority)

An entity that issues digital certificates. Keystone Core includes an embedded CA for issuing agent certificates and can integrate with external CAs.

CEL (Common Expression Language)

A non-Turing-complete expression language used for policy evaluation. Provides a simpler alternative to OPA/Rego for basic authorization rules.

Cipher Suite

A combination of cryptographic algorithms used to secure network connections. Includes algorithms for key exchange, authentication, encryption, and message authentication.

Credential

Secret information used for authentication, such as passwords, API keys, certificates, or tokens.

Defense in Depth

A security strategy that layers multiple independent security controls so that failure of one control does not compromise the entire system.

Encryption at Rest

Protection of data stored on disk through cryptographic encryption. Used for database contents, backups, and sensitive configuration files.

Encryption in Transit

Protection of data as it moves across networks through cryptographic protocols like TLS.

Fail Secure (Fail Closed)

A design principle where system failures result in a secure state (typically denying access) rather than granting access.

HMAC (Hash-based Message Authentication Code)

A cryptographic construction for verifying both data integrity and authenticity using a secret key and a hash function.

IAM (Identity and Access Management)

The framework of policies and technologies for ensuring that the right entities have appropriate access to resources.

Join Token

A one-time or limited-use secret used by agents to register with the control plane. Provides initial attestation before certificate issuance.

Lease (Secrets)

A time-bounded secret credential issued by a dynamic secrets backend (database, cloud IAM, PKI). Each lease has a TTL and a renewal / revocation API. Distinct from KV secrets, which have no lease semantics. See internal/secrets/leasedirectory.go.

Key Derivation Function (KDF)

A cryptographic function that derives one or more secret keys from a secret value such as a password. Examples include Argon2, scrypt, and PBKDF2.

Least Privilege

The security principle that entities should have only the minimum permissions necessary to perform their functions.

mTLS (Mutual TLS)

TLS authentication where both the client and server present certificates, providing mutual identity verification.

PSK (Pre-Shared Key)

A symmetric secret presented at NATS bootstrap to authenticate a new agent before it has been issued a SPIFFE SVID. Production PSKs are single-use and short-lived; dev mode permits static PSKs with a startup WARN to keep operators honest about the production posture.

OPA (Open Policy Agent)

A policy engine that evaluates policies written in Rego. Used for fine-grained authorization decisions.

RBAC (Role-Based Access Control)

An access control model where permissions are assigned to roles, and roles are assigned to users.

Rego

The policy language used by Open Policy Agent (OPA) for defining authorization rules.

Secret

Any sensitive data that should be protected, including passwords, API keys, certificates, encryption keys, and tokens.

SPIFFE (Secure Production Identity Framework For Everyone)

A set of standards for identifying and securing communications between services. Provides a universal identity format (SPIFFE ID) and certificate format (SVID).

SPIFFE ID

A URI that uniquely identifies a workload within a trust domain. Format: spiffe://trust-domain/path

SVID (SPIFFE Verifiable Identity Document)

A cryptographic document (X.509 certificate or JWT) that proves a workload’s SPIFFE identity.

TLS (Transport Layer Security)

A cryptographic protocol that provides privacy and data integrity between applications communicating over a network.

Token

A security artifact that represents identity or authorization claims. Can be short-lived (JWT) or long-lived (API key).

Transit (Secrets)

A secrets-engine surface for encryption-as-a-service: operators send plaintext, receive ciphertext; keys never leave the server. Supports encrypt / decrypt / sign / verify with named keys. See internal/secrets/transit.go.

Trust Boundary

A point in a system where the level of trust changes, requiring security controls such as authentication, authorization, and input validation.

Trust Domain

The administrative boundary within which SPIFFE identities are issued and validated. Corresponds to a PKI trust root.

X.509

The standard format for public key certificates used in TLS and SPIFFE.

Zero Trust

A security model that requires verification for every access request, regardless of network location or previous authentication.

Infrastructure Terms

Agent

A lightweight process that runs on managed nodes, communicating with the control plane to execute commands and apply state configurations.

Blueprint

A declarative composition of state modules + parameters + ordering, applied as a higher-level operation (“set up a web server”, “harden a host”). Blueprints can be applied, rolled back, and queried like state. Authored as YAML. See internal/blueprint/.

Bootstrap

The process of initializing a new Keystone Core deployment or registering a new agent, including certificate provisioning and initial configuration.

Cluster

A group of control plane servers working together for high availability, using etcd for consensus and distributed coordination.

Control Plane

The central management layer that coordinates agents, stores state, evaluates policies, and processes commands.

Drift

The difference between the declared (desired) state and the actual state of a managed system.

Edge Agent

An agent deployed in environments with intermittent connectivity, capable of operating autonomously with local state caching.

Embedded NATS

NATS server running in-process with the control plane for simplified deployment without external dependencies.

Fencing

A clustering safety mechanism preventing split-brain. When a cluster member loses quorum or detects it has been deposed as leader, it self-fences — refuses writes — until quorum is re-established. Implemented via etcd epoch + lease watch in internal/cluster/fencing.go.

GitOps

Integration with GitOps deployment tooling (ArgoCD, Flux, raw GitHub/GitLab). Two surfaces: inbound webhooks that observe deploys + drive verification, and rollback executors that issue revert PRs / call ArgoCD or Kubernetes APIs when verification fails.

etcd

A distributed key-value store used for cluster coordination, leader election, and distributed locking.

Heartbeat

A periodic message sent by agents to the control plane to indicate health and connectivity.

High Availability (HA)

A system design that minimizes downtime through redundancy, automatic failover, and distributed operation.

JetStream

NATS’s built-in persistence layer providing at-least-once and exactly-once message delivery with stream storage.

Leaf Node

A NATS connection mode where agents connect to a local NATS server that relays messages to the main cluster.

NATS

A lightweight, high-performance messaging system used for all control plane to agent communication.

Membership

The set of currently-known cluster members and their roles (leader / follower / learner). Membership changes (add / remove / transfer) flow through the etcd consensus layer.

Proxy Agent

An agent that manages devices unable to run native agents, using protocols like SSH, SNMP, or WinRM.

Quorum

The minimum number of cluster members that must agree for distributed operations to proceed (typically majority).

Runbook

A sequenced operational workflow with conditional branches that runs against one or more agents (backup, failover, incident response). Steps are typed (command / state / blueprint / wait); the engine persists execution status for status / list / audit queries. Authored as YAML. See internal/runbook/.

Saga

A long-running transaction pattern where each step has a compensating action. The state Runner uses saga semantics when applying state — failure mid-apply rolls back already-applied steps via their compensations. See internal/statemgmt/runner_saga.go and pkg/saga/.

State

The declared configuration for a managed system, expressed as a collection of state modules with their parameters.

State Module

A unit of configuration that manages a specific aspect of a system (e.g., file, package, service, user).

Supercluster

A NATS deployment spanning multiple geographic regions connected via gateways for global agent management.

Targeting

The process of selecting which agents should receive a command or state application, using glob patterns or filter expressions.

Protocol Terms

gRPC

A high-performance RPC framework used for the client API (CLI tools communicating with control plane).

OTLP (OpenTelemetry Protocol)

The standard protocol for transmitting telemetry data (metrics, logs, traces) in cloud-native environments.

REST

Representational State Transfer, an architectural style for web APIs. Used for webhook receivers and external integrations.

SNMP (Simple Network Management Protocol)

A protocol for managing and monitoring network devices. Keystone Core proxy agents support SNMPv2c and SNMPv3.

SSH (Secure Shell)

A protocol for secure remote access and command execution. Used by proxy agents for managing Unix/Linux systems.

Webhook

HTTP callback. Keystone Core has two flavors: inbound webhooks (:8081/webhooks) receive events from GitHub / GitLab / Flux / ArgoCD and drive GitOps verification + rollback; outbound webhooks POST audit / state / event records matching an operator-registered filter to external URLs. See internal/gitops/webhook/ (inbound) and internal/webhook/outbound/ (outbound).

WebSocket

A protocol for full-duplex communication over a single TCP connection. Reserved for potential future agent firewall-traversal transport (deferred to v2.x+); v0.x agents connect over NATS .

WinRM (Windows Remote Management)

A Microsoft protocol for remote management of Windows systems. Used by proxy agents for Windows device management.

Development Terms

Capability

A permission granted to a module that controls what operations it can perform (file system, network, execution, etc.).

CEL Expression

A filter expression using Common Expression Language syntax for targeting agents or filtering events.

Module

An extension that provides additional state management or execution capabilities, running in a sandboxed environment.

Naming: kscore vs keystone-core

Two names appear deliberately, by scope:

• kscore — runtime / on-disk identity: binaries (kscore-server, kscore-agent, kscorectl, kscore-*), config and data directories (/etc/kscore, /etc/kscore/agent.yaml, /var/lib/kscore, /var/lib/kscore-agent, /var/log/kscore), the systemd units (kscore-server.service, kscore-agent.service), and the dedicated system user/group (kscore).
• keystone-core — project / brand identity: the project name, the repository, the Go vanity module (go.keystone-core.io/keystone-core), the domain (keystone-core.io), release-artifact names (keystone-core_<version>_<platform>.tar.gz), the maintainer address, the # Managed by keystone-core markers written into managed system files, and the gitops-rollback commit author.

New code follows this split. When in doubt: if a human types it or a URL contains it, it is usually keystone-core; if the OS stores or runs it, it is kscore.

Policy

A set of rules that govern authorization decisions, written in Rego (OPA) or CEL.

Reactor

An event-driven automation that executes actions in response to specific events based on filter conditions.

Requisite

A dependency relationship between state modules (require, watch, prereq, onchanges) that controls execution order.

Starlark

A Python-like configuration language used for writing modules. Executes in a secure sandbox.

WASM (WebAssembly)

A portable binary format for executable code. Used for running modules in a secure, sandboxed environment.

Abbreviations