Appendix A: Glossary and Diagram Index
Appendix A: Glossary and Diagram Index
← Previous: 13. Evolution | Index | Next: Appendix B →
A.1 Terms
| Term | Definition |
|---|---|
| Arc SSH | SSH over the Azure Arc relay, authenticated by Entra via the AADSSHLoginForLinux extension; invoked with az ssh arc |
AADSSHLoginForLinux | Arc extension that validates Entra-issued certificates, evaluates the two Azure login roles, provisions the local account, and places active admins in aad_admins |
| Administrator Login | Azure role Virtual Machine Administrator Login: login with full sudo |
| User Login | Azure role Virtual Machine User Login: login without sudo |
| PIM | Entra Privileged Identity Management: eligible assignments activated just-in-time with MFA, justification and optional approval |
| Machine class | Grouping of hosts by role (uat, prod, erp, data, k8s, pve, infra) carried as the Arc tag pn_class |
| Tier | One of Admin, Operator, Editor, Deployer, Viewer — an Entra group with a defined Azure role and on-host meaning |
pn-access | The per-host synchronisation agent that reconciles Linux groups and account lifecycle with Entra using the host's managed identity |
pn-deploy | The wrapped deploy action executed as the deploy service user; the only path to Docker for humans |
dc | Shell alias mapping familiar docker compose usage onto pn-deploy for the current project |
deploy (service user / group) | The service account that owns Docker access and reads .env; the group that grants write access to /srv/pnats |
| Managed identity | The Arc host's system-assigned Azure identity, used to read Graph without stored secrets |
| Break-glass | The single per-host root key in Key Vault for use when Entra or Arc is unavailable; alerted on use |
| Access-map | The runbook listing person→class→tier, break-glass locations and automation identities (required by STD-IDENT-001) |
| Authorization ceiling | RFC-IAM-0001 principle: Entra group membership is the maximum any downstream system may grant |
| Fail-safe | The agent's rule of making no change when it lacks an authoritative answer |
pam_wheel | PAM module used here to deny su to everyone by requiring membership of an empty group |
sudoreplay | Tool that replays sudo I/O logs |
A.2 Diagram Index
| Diagram | Location |
|---|---|
| System overview (two planes) | 3.1 |
| Trust boundaries | 3.4 |
| Login and elevation sequence | 3.5 |
| Synchronisation and decommissioning sequence | 3.6 |
| Account lifecycle state diagram | 9.2 |
A.3 Abbreviations
| Abbreviation | Expansion |
|---|---|
| AMA / DCR / DCE | Azure Monitor Agent / Data Collection Rule / Data Collection Endpoint |
| JIT | Just-in-time |
| MFA | Multi-factor authentication |
| PVE | Proxmox Virtual Environment |
| RG | Azure resource group |
| UPN | User principal name |
| VDS | Virtual dedicated server (Contabo) |
Document Navigation
| Previous | Index | Next |
|---|---|---|
| ← 13. Evolution | Table of Contents | Appendix B → |
End of Appendix A