Content Index

A back-of-book topic index for the docs: find where a subject is covered, by keyword, including common synonyms.

Highlights

• This is an index, not a guide. Each entry points at a specific doc and section.
• Search it, don’t read it. Ctrl/Cmd-F on this page jumps straight to a keyword.
• Synonyms are included on purpose — look up “mTLS”, “secret naming”, “buildArgs” or “SSO” and you land in the right place.
• For a guided table of contents use docs/README.md instead.
• It is curated, not generated. Adding a doc or a major section means adding a line here.

Overview

Scan for the term you would search for. Entries are grouped A–Z by the word you are most likely to reach for, with cross-references where a subject has more than one common name.

For the narrative table of contents see docs/README.md; for the full grammar or reference of a feature, follow the links below into that feature’s own page.

How it works

1. Find your term in the alphabetical sections below.
2. Each line names the subject, then links to the doc and the exact section that covers it.
3. A “see” line is a synonym redirect — follow it to the canonical entry.
4. Several links on one line mean the subject is genuinely split across docs, listed in the order most people need them.

Configuration

Nothing here is configured — this page is a lookup surface. The maintenance rules:

1. When you add a doc, or a major section to an existing one, add a line here, so the subject stays findable.
2. Point at the section, not just the file. An entry that lands someone at the top of a 1,000-line reference has not done its job.
3. Add the synonyms you would have searched for, not only the term the doc happens to use.

A

• Access control / visibility (private vs org vs public) — Permissions, CDK: IAM Roles
• Admin UIs (pgAdmin, Mongo Express) — Env vars: Admin UIs
• AI pipeline generation (prompt → pipeline) — Developer Guide: AI Prompt, API: AI Generation, AI Plugins
• Ambient mesh — see Service mesh → Service Mesh
• API reference (REST endpoints) — API Reference
• Architecture / system diagram / data flow — Architecture Flow, Service topology
• Artifact passing between steps — CDK: Artifact Passing, Artifact & Registry Plugins
• Audit events / audit log / tamper-evidence — Audit Events, Integrity, Action catalog
• Application logs / log search / log download — Logs, Search syntax, Downloading, Masking
• Log tenancy (per-org isolation, _infra) — Logs: what you can see, Operating
• Authentication (login, JWT, OAuth) — Authentication & SSO, Env vars: Authentication
• Sessions, devices and machine credentials — Authentication: Sessions, devices and machine credentials, Authentication: Token claims, API: Account & Sessions
• AWS deployment — AWS Deployment, EC2, EKS
• AWS Marketplace (setup walkthrough) — Billing Providers: AWS Marketplace
• AWS Marketplace (metering, private offers) — Billing Discounts: Marketplace, Env vars: Marketplace metering

B

• Backups & disaster recovery — Deploy Operations: Backups & DR, RPO and RTO, What is NOT backed up
• Billing (plans, usage, credits) — Organization Benefits: Billing, Env vars: Billing
• Billing providers (Stripe / AWS Marketplace setup) — Billing Providers
• Build health (per-pipeline stage success rate + timing percentiles) — DORA Metrics: Build health
• Build queue (BullMQ / KEDA scaling) — Env vars: Build Queue, Mesh: Queues, KEDA & buildkit
• Build types (Dockerfile vs shared base) — Architecture: Build Types, Plugins: Build Types
• buildArgs (Docker build args, templatable) — Templates: build plugin with buildArgs
• BuilderProps (pipeline JSON shape) — CDK: BuilderProps Reference, Architecture: BuilderProps Structure
• BuildKit (rootless) / why rootless — Env vars: Why rootless BuildKit
• Bundles / add-on packs (seats, pipelines, API) — Billing Add-on Bundles

C

• Caching (server-side) — Env vars: Caching
• CDK construct / Infrastructure-as-Code — CDK Usage Guide, Infrastructure Plugins
• CLI (pipeline-manager) — Pipeline Manager (CLI), Command reference
• CodeBuild step configuration — Metadata Keys: CodeBuild Step
• CodeCommit source — CDK: CodeCommit
• CodePipeline configuration — Metadata Keys: CodePipeline
• CodeStar connection (GitHub/Bitbucket/GitLab) — CDK: CodeStar Connection
• Compliance / policy-as-code / rules — Compliance Service, Rule Schema, Enforcement
• Compute size (LARGE/MEDIUM) — Developer Guide: Custom Compute Size, Metadata Keys: Build Environment
• Cross-account deployment — CDK: Cross-Account Deployments
• Cron / scheduled operator audits, drift — Pipeline Manager: Schedule drift detection

D

• Databases (Postgres, Mongo, Redis config) — Env vars: Databases
• Deploy plugins (cloud, k8s, serverless) — Deploy Plugins
• Deployment modes (public vs private) — AWS Deployment: Deployment modes
• Deploy operations runbook — Deploy Operations
• Disaster recovery (RPO, what is NOT backed up) — Deploy Operations: What the data tier actually is, RPO and RTO, What is NOT backed up, Enabling the EKS backup CronJob
• Developer guide / getting started (dev) — Developer Guide, Five ways to create a pipeline
• Developer portal (catalog ownership, scorecards) — Developer Portal
• Plugin ecosystem — publishing (publishers, listings, publish requests, trust tiers, Verified) — Plugin Publishing, Plugins: Publishing to the ecosystem, Architecture: Publishing, Runbook: Ecosystem moderation
• Discounts / promo codes / referrals — Billing Discounts, Promotions
• Docker registry (config, tags) — Env vars: Docker Registry, Registry audit events
• Delivery report for a manager (scheduled, frozen snapshot) — Stakeholder Reports
• DORA metrics (deploy freq, lead time, MTTR, CFR) — DORA Metrics, Performance levels
• Drift detection (CloudFormation stacks) — AWS Deployment: Drift Detection

E

• EBS volume / expanding storage — AWS Deployment: Expanding EBS Volume
• EC2 deployment — AWS Deployment: EC2
• EKS deployment — AWS Deployment: EKS, EKS vs other k8s targets
• Egress (external, allow-any) — Service Mesh: External egress
• Email / SES (sending, bounces, sandbox) — Notifications: Platform outbound email, SES on the AWS targets, AWS Deployment: Email (SES), Env vars: Email
• EMAIL_ENABLED is off (invitations, verification, submissions silently do nothing) — Notifications: Symptoms
• Event reporting / setup-events (EventBridge → SQS → Lambda) — Onboarding: Set up event reporting, AWS: EventBridge Reporting
• Encryption (per-team secret, KMS) — Metadata Keys: Encryption, Env vars: Multi-team secret encryption
• Environment variables (full reference) — Environment Variables
• Error handling / typed errors / error catalog — Error Handling Convention, Template error catalog
• Exemptions (compliance waivers) — Compliance: Exemptions

F

• Failure behavior (fail / warn / ignore) — Developer Guide: Failure Behavior Options
• Feature tiers (developer/pro/team/enterprise) — Docs: Feature Tiers, Organization Benefits
• Filters (template | default, | number, | bool, | json) — Templates: Filters

G

• GitHub source / token — CDK: GitHub, Samples: GitHub source token
• Golden-path templates (reusable starters) — Developer Portal: Golden-path templates, Templates: Golden pipeline templates
• Grafana (operator dashboards) — Deploy Operations: Operator consoles
• Grammar (template syntax) — Templates: Grammar

I

• IAM roles (pipeline / step / action, OIDC) — CDK: IAM Roles, Metadata Keys: IAM Role, Samples: IAM Role Levels
• Impersonation (sysadmin view-as-user, read-only) — Permissions: Impersonation, Audit: admin.impersonate.start
• Impersonation policy (consent, open, emergencies only) — Permissions: Administrator access policy
• Image signing (plugin images, cosign, digest pinning) — Plugins: Supply Chain, Architecture: Plugin Upload & Build, Env vars: Plugin-image signing, Runbook: Plugin-signing key
• Incident reporting setup (admin UI, self-serve token, per-org window) — Admin UI, Getting a token, Per-org window
• Incident webhook — Alertmanager adapter (native payload) — Alertmanager adapter
• Incident webhook (PagerDuty/Datadog/Alertmanager → automated CFR + MTTR) — Incident Webhook, Correlation window
• Infrastructure plugins (CDK synth, multi-region) — Infrastructure Plugins
• Initialize platform (post-deploy) — AWS Deployment: Initialize the Platform, Docs: Post-Deploy
• Interpolation (mixed literal + ``) — Templates: Grammar, plugin pipeline.* interpolation
• Isolation (multi-team / per-org) — Architecture: Multi-Team Isolation, Plugins: Multi-Organization Isolation
• Istio — see Service mesh → Service Mesh (Istio Ambient)

K

• KEDA (autoscaling the build queue) — Service Mesh: Queues, KEDA & buildkit
• Kiali (Istio mesh console) — Service Mesh: Kiali
• Kubernetes deploy plugins — Deploy Plugins: Kubernetes

L

• Language plugins / version managers — Language Plugins
• Lead notes on a report (the summary a manager reads first) — Stakeholder Reports: Why it is not just “the dashboard, emailed”
• Lead time (DORA) — DORA Metrics: How each metric is defined
• LEAN mode (trim footprint — minikube & ec2) — Service Mesh: LEAN mode

M

• Metadata keys (all scopes) — Metadata Keys, Scope Levels
• Monitoring plugins — Monitoring Plugins
• mTLS (mutual TLS between services) — Service Mesh: mTLS posture
• Multi-region strategies (sequential/parallel/canary) — Infrastructure Plugins: Multi-Region
• Multi-team / RLS context — Env vars: Multi-team RLS context

N

• Network / VPC configuration — CDK: VPC and Network, Metadata Keys: Network
• Notifications (email, Slack, webhooks, in-app) — Notifications, Platform: outbound email, Alertmanager and ops-team Slack, Alert destinations, Symptoms, Compliance: Notifications, Notification Plugins, Developer Guide: Slack Notifications
• Notification preferences (per user, ecosystem email opt-outs) — Notifications: Per-user preferences

O

• OAuth / social login — Authentication: OAuth social login, Env vars: OAuth
• OIDC (enterprise SSO, IAM role trust) — Authentication: Per-org SSO, CDK: Role Types
• SAML 2.0 (enterprise SSO) — Authentication: SAML 2.0, Runbook: rotating the IdP signing certificate
• Onboarding a new organization (initial login → PAT → events) — Onboarding
• Organizations / teams / hierarchy — Docs: Organizations, Organization Benefits, Permissions: Teams

P

• Pagination & limits — Env vars: Pagination & Limits, API: Common Query Parameters
• Access key (pb_pat_…, the CLI/automation credential) — Onboarding: Create an access key, Authentication: Access keys, Pipeline Manager: auth
• Permissions / RBAC / roles — Roles & Permissions, Permission catalog
• Pipeline creation (5 ways) — Developer Guide: Five Ways, Docs: Creating Pipelines
• Plugins (catalog, categories, structure) — Plugin Catalog, Categories, by type: AI · Artifact · Deploy · Infrastructure · Language · Monitoring · Notification · Quality · Security · Testing
• Plugin contract (requiredMetadata / requiredVars / metadataTypes) — Templates: Plugin contract
• Policies (compliance) — Compliance: Policies
• Provenance (SLSA, BuildKit mode=min) — Plugins: Supply Chain
• Private vs public deployment — AWS Deployment: Deployment modes
• Promotions / referrals — Billing Discounts: Promotions

Q

• Quality plugins (lint, format, coverage) — Code Quality Plugins
• Quotas & rate limiting — Env vars: Quotas & Rate Limiting

R

• Redis (config, sentinel, HA) — Env vars: Redis
• Registry (Docker image registry, tag copy/delete) — Env vars: Docker Registry, Registry audit events
• Reporting (execution & plugin reports) — AWS Deployment: Report API, API: Reporting Endpoints
• Roles — RBAC (org permissions) — Roles & Permissions; Roles — IAM (AWS) — CDK: IAM Roles
• Rule schema (operators, computed fields) — Compliance: Rule Schema

S

• SBOM (plugin image SPDX, signed attestation, download) — Plugins: Supply Chain, API: Plugin Service
• Samples (pipeline templates + CDK examples) — Samples, Loading Samples
• Scheduled pipelines (cron/EventBridge) — CDK: Scheduled Pipelines
• SCIM (directory provisioning, Okta / Entra) — Authentication: SCIM 2.0 provisioning, API: SCIM 2.0, Permissions: SCIM is a scope, not a permission, Audit: SCIM provisioning
• Scopes (compliance / metadata scope levels) — Compliance: Scopes, Metadata: Scope Levels
• Secrets — usage & injection — CDK: Secrets Management, Plugins: How Secrets Work, Env vars
• Service token (store-token, JWT in Secrets Manager) — Onboarding: Store the service-account keys, AWS: Store Service Credentials
• Secret naming convention (pipeline-builder/{orgId}/{name}) — Plugins: Naming Convention
• Secrets — rotation runbook — Secret Rotation (per-secret: JWT, refresh, at-rest master key + re-encryption tool, alert relay, registry signing key, plugin-signing key), Deploy Operations: Secret rotation (databases, Mongo keyfile)
• Slack alert delivery (ops-team channels) — Notifications: Alertmanager and ops-team Slack, Env vars: Ops-team Slack alert delivery (SLACK_CRITICAL_WEBHOOK_URL / SLACK_WARNING_WEBHOOK_URL; the deploy refuses to start on a placeholder)
• Security notifications for plugins (N30 / N31, external address, webhook) — Notifications: Plugin security notifications
• Security plugins (SAST, SCA, secret detection) — Security Plugins
• Self-references (pipeline.json cross-refs) — Templates: pipeline-level self-references
• Service mesh (Istio ambient, mTLS, AuthZ) — Service Mesh, also AWS / Ops
• Session invalidation (token revocation) — Permissions: Session invalidation
• SSE / Server-Sent Events — Env vars: Server-Sent Events
• SSO (single sign-on) — see OAuth / OIDC / SAML 2.0 / SCIM → Authentication & SSO
• Stages and steps — CDK: Stages and Steps
• Storage requirements (disk sizing) — AWS Deployment: Storage (EC2), Storage (EKS)
• Stripe (billing provider setup) — Billing Providers: Stripe, Env vars: Stripe
• Synth-time templating — see Templates → Templates: How it works

T

• Teams (org → team hierarchy, seats) — Docs: Teams, Permissions: Teams
• Teardown (destroy a deployment) — AWS: EC2 Teardown, Deploy Operations: Teardown
• Templates — syntax (``, vars, scopes) — Template Syntax, Scope reference
• Templates — golden pipeline (starters) — Templates: Golden pipeline templates
• Testing plugins (unit, e2e, load, smoke) — Testing Plugins
• Timeouts (build, upload chain) — Env vars: Timeouts
• TLS (certs, renewal) — AWS: EC2 TLS, EKS TLS Renewal
• Troubleshooting — AWS Deployment, Service Mesh, Templates

V

• Variables / vars (pipeline-level template variables) — Templates: Scope reference, pipeline-level self-references
• Version management (plugin versions) — Plugins: Version Management
• VPC / network — CDK: VPC and Network

---

Documents at a glance

Document	Covers
README	Narrative TOC — getting started, guides, key concepts
api-reference	REST endpoints per service, query params, response format
architecture-flow	End-to-end flows: plugin build, pipeline create, synth, execution
audit-events	Audit action catalog, integrity, sensitive-data scrubbing
authentication	OAuth social login, per-org enterprise SSO (OIDC or SAML 2.0), JIT + SCIM provisioning
aws-deployment	EC2 & EKS deploy, public/private modes, SES, reporting
billing-bundles	Stackable add-on packs raising pooled caps
billing-discounts	Discount codes, promotions, referrals, Marketplace offers
billing-providers	Stripe + AWS Marketplace setup walkthroughs (keys, webhooks, entitlements, metering)
cdk-usage	BuilderProps, sources, IAM, VPC, secrets, cross-account
compliance	Policy-as-code rules, scans, enforcement, exemptions
content-index	This page — keyword/topic index
deploy-operations	Ops runbook: preflight, secrets rotation, backups, teardown
runbooks/secret-rotation	Per-secret rotation runbooks + the secret_rotation_previous_set metric and alert
runbooks/access-key-cutover	Issuing personal access keys and provisioning the three machine credentials an AWS install needs
developer-guide	Five ways to create a pipeline, plugin cut-and-paste patterns
developer-portal	Catalog ownership, golden-path templates, scorecards
plugin-publishing	Publisher profile, listings limits, publish requests, accept-or-edit metadata, review and auto-approval, pause
runbooks/ecosystem-moderation	Ecosystem Manager runbook: queue, SLAs, two-person approval, rules, takedown, re-sign
dora-metrics	Deploy freq, lead time, MTTR, change-fail rate, build health
stakeholder-reports	Scheduled manager-facing reports: frozen snapshots, review/publish, recipients, share links
incidents-webhook	Incident webhook → automated post-deploy CFR + real MTTR
environment-variables	Every env var by subsystem
error-handling	Typed AppError convention
metadata-keys	All aws:cdk:* and step/pipeline metadata keys
notifications	Email, Slack, webhooks and the in-app inbox — operator switches, org settings, symptom table
onboarding	New-org walkthrough: initial login → org → members → access key → store-token → setup-events → first pipeline
organization-benefits	Value story, orgs/teams/billing, impact by role
permissions	RBAC model, permission catalog, enforcement, sessions
pipeline-manager	CLI install, commands, workflows
plugins/README	Plugin catalog, secrets, structure, versioning
samples	Language pipeline templates + CDK examples
service-mesh	Istio ambient, mTLS, L4 authorization, egress
templates	`` synth-time templating, scopes, filters, golden templates