Glossary

The following are common terms used in the SC//Reliant™ platform documentation. Platform terms are listed first, followed by networking and firewall terms.

Platform terms

Customer code

A customer code, also sometimes referred to as a client code is the three letter ID for your SC//Reliant platform account. It is visible in the SC//Reliant Platform Manager and is used in the hostnames of the nodes in your environment.

Distributed Replicated Block Device (DRBD)

Distributed Replicated Block Device or DRBD is a distributed system for replicating storage. It is used to mirror the data between storage devices. When you run highly available virtual machines on the SC//Reliant platform, we use DRBD to replicate the storage devices between the physical hosts.

Edge Virtual Desktop Interface (EVDI)

We refer to the virtualization of virtual machines as EVDI. This is mostly used to virtualize Point Of Sale (POS) terminals. We use a combination of Remmina, an open-source remote desktop client for Linux and POSIX-based systems, and VirtualHere, a software solution that enables USB-over-IP functionality, allowing you to access USB devices remotely over a network (Wi-Fi or Ethernet) as if they were plugged directly into your computer, to both display the virtual machine console and passthrough USB peripherals.

Fencing

Fencing is the process of isolating a failed or unresponsive node from a cluster so that it can't access shared resources or corrupt data. In SC//Reliant clusters, fencing is performed by STONITH (Shoot The Other Node In The Head), which powers off or resets the unresponsive node.

Identity Provider (IdP)

An Identity Provider (IdP) is a system that creates, maintains, and manages user digital identities, acting as a centralized authentication service for applications and websites. Examples of IdPs are Jumpcloud, Google, Microsoft Entra, and Okta.

Kernel-based Virtual Machine (KVM)

Kernel-based Virtual Machine or KVM is a virtualization module that was introduced to the Linux kernel as of version 2.6.20 that allows the kernel to function as a hypervisor. KVM works together with QEMU, which is an acronym for Quick Emulator, that emulates a computer's processor and hardware. This pair functions together as a Type-1 hypervisor and is sometimes referred to collectively as KVM/QEMU. For the purposes of this documentation we will refer to all Linux infrastructure used for creating virtual machines as simply KVM.

Linux Containers (LXC)

Linux Containers or LXC is an operating-system-level virtualization method for running multiple isolated Linux systems (containers) on a control host using a single Linux kernel. The Linux kernel provides the cgroups functionality that allows limitation and prioritization of resources (CPU, memory, block I/O, network, etc.) without the need to start any virtual machines. It also has a namespace isolation functionality that allows complete isolation of an application's view of the operating environment, including process trees, networking, user IDs, and mounted file systems.

Logical Volume Management (LVM)

Logical Volume Management or LVM is a tool for managing disk storage space.

Maintenance mode

Maintenance mode is a cluster-wide setting that suspends Pacemaker's resource management. While it is on, workloads stay where they are and Pacemaker does not react to resources stopping or failing. It does not disable fencing. See Operating the cluster.

Node

A node refers to a physical host, is a member of a node group, and can consist of one or more virtual nodes.

Node group

A node group is a logical grouping of nodes that share a common set of characteristics and settings. We associate a type with each node group. The following are the available node group types.

• Regular - This is for physical nodes outside the management plane.
• Virtual - This is for virtual nodes, such as KVM virtual machines or Docker containers.
• Server - This is for nodes in the management plane or thin clients.

OpenID Connect (OIDC)

OpenID Connect (OIDC) is an open, interoperable authentication protocol built on top of the OAuth 2.0 framework. It allows client applications (relying parties) to verify the identity of an end-user based on authentication performed by an authorization server (OpenID Provider).

Pacemaker/Corosync

Corosync is an open source program that provides cluster membership and messaging capabilities, often referred to as the messaging layer, to client servers.

Pacemaker is an open source cluster resource manager (CRM), a system that coordinates resources and services that are managed and made highly available by a cluster.

Working together, Corosync enables servers to communicate as a cluster, while Pacemaker provides the ability to control how the cluster behaves.

Payment device

A payment device is an endpoint device that may facilitate payment transactions, such as Verifone MX915/MX925/M400. Payment devices are located and listed within a store. Variations of these devices are dictated by the payment device type.

Payment device type

This term refers to the type of payment device in a store. A payment device can be used to define any array of device types found in or in relation to a store.

Porter

Porter is a command-line tool that converts a VMware virtual machine into a KVM virtual machine in QCOW2 format on an SC//Reliant host. See Porter overview.

Property Reference

A property reference is used to specify a value as a variable. On the SC//Reliant platform, when defining node group property values we often use property references so that the property value can be defined at the node level. On the node group, you define which Node Properties to associate with the nodes in the node group.

Quick Emulator (QEMU)

Quick Emulator or QEMU works together with KVM. QEMU emulates a computer's processor and hardware. It pairs with KVM to function as a Type-1 hypervisor. See Kernel-based Virtual Machine (KVM) for more details.

REdge

REdge is a web interface that runs on an SC//Reliant node. It is a front end for the SC//Reliant Virtual Controller (RVC) that lets you view and control the node's virtual machines, containers, cluster status, Puppet runs, and maintenance tasks from a browser. See Using REdge.

Reliant Query Language (RQL)

Reliant Query Language or RQL is the query language used to search for resources in SC//Reliant Platform Manager and to define saved filters. See Using Saved Filters.

Remote Job Execution (RJE)

Remote Job Execution or RJE is the service that runs commands on a node from a remote location, without signing in to the node. The SC//Reliant API and SC//Reliant Platform Manager use it to start jobs, such as Puppet runs, on nodes. See Remote Job Execution (RJE).

Saved filter

A saved filter is an RQL query stored under a name in SC//Reliant Platform Manager so that it can be reapplied later. Saved filters can also be used to target jobs, such as Puppet runs, at the set of nodes that match them. See Using Saved Filters.

SC//Reliant Local Status Indicator (RLSI)

The SC//Reliant Local Status Indicator or RLSI is a web console that is installed on your edge devices that provides local status indicators and basic administration functions. Most of these admin functions use the SC//Reliant Virtual Controller under the covers.

SC//Reliant Platform Manager

SC//Reliant Platform Manager (RPM) is the web console that allows you to access and manage your SC//Reliant platform resources.

SC//Reliant Virtual Controller (RVC)

The SC//Reliant Virtual Controller or RVC is a daemon and command-line tool used to manage your virtualized instances on the SC//Reliant platform. REdge and the SC//Reliant Local Status Indicator (RLSI) are web consoles you can use to perform many of the administrative functions that RVC provides.

Service Provider (SP)

A Service Provider (SP) is a system, application, or website that provides services to users and relies on an external, trusted authority (the IdP) to authenticate those users. In the context of the SC//Reliant platform, the SC//Reliant platform is the Service Provider.

Standby

Standby is a Pacemaker node state that makes a node ineligible to run cluster-managed resources. Placing a node on standby moves its workloads to the other node in the cluster and stops its DRBD resource. See Operating the cluster.

STONITH

STONITH, short for Shoot The Other Node In The Head, is the fencing mechanism used by SC//Reliant clusters. When a node stops responding, the surviving node uses STONITH to power off or reset it. See Fencing and Disabling fencing during maintenance.

Virtual node

A virtual node refers to either Docker containers or KVM virtual machines. When we refer to the physical edge security device that is hosting the virtual nodes, we refer to them as a physical node or physical host.

Networking and firewall terms

Plain-language definitions for the networking and firewall terms used throughout SC//Reliant documentation. For more information, see Networking overview.

Core networking

• IP address — the unique numerical address (for example, 192.168.1.10) that identifies a device on a network, similar to a mailing address.
• Network address — the address that identifies an entire network rather than a single device (for example, 192.168.1.0 for the 192.168.1.0/24 network). It's never assigned to a device.
• Netmask — defines how many devices can exist on a given network by marking which part of an IP address is the "network" portion and which part is the "device" portion.
• Gateway — the address a device sends traffic to when the destination isn't on its own local network — the "exit door" toward other networks or the internet.
• DHCP — the service that automatically hands out IP addresses (and related settings like gateway and netmask) to devices as they join a network, so they don't need to be configured by hand.
• TCP vs. UDP — the two main ways data travels over a network. TCP confirms delivery and keeps data in order (used for things like payment transactions); UDP sends data without confirmation, trading reliability for speed (used for things like live video).
• NAT (Network Address Translation) — the mechanism that lets many devices on a private network share a single public IP address, and that redirects incoming traffic to the correct internal device.

VLANs and segmentation

• VLAN (Virtual Local Area Network) — a way to split one physical network into multiple logically separate networks, so devices on one VLAN can't reach devices on another without passing through a router. SC//Reliant uses VLANs to keep payment, back-office, guest, and management traffic apart on the same physical wiring.
• Segmentation — the general practice of separating different types of traffic (payment, guest, corporate, and so on) so that a problem or intrusion on one network can't spread to another. VLANs are the mechanism; segmentation is the goal.
• Egress allow-listing — a "deny by default" outbound policy where only pre-approved destinations (management endpoints, payment gateways, vendor update servers, and similar) can be reached from the network, rather than allowing all outbound traffic and blocking known-bad destinations.

WAN and connectivity

• WAN (Wide Area Network) — the connection between the store and the outside world (the internet or a central office), as opposed to the LAN, which is the network inside the store.
• SD-WAN (Software-Defined WAN) — a way of managing WAN connections (including which provider or transport is used) through software rather than manual device configuration. SC//Reliant works with any SD-WAN provider or can act as its own router when no separate SD-WAN appliance is present.
• Failover — automatically switching from a primary internet connection to a backup (and, if needed, a second backup) when the primary stops responding, then switching back once it recovers.

Firewall and security

• Firewall — a system that filters network traffic based on defined rules, deciding what's allowed to pass and what's blocked. SC//Reliant enforces firewall rules using the Linux kernel's built-in firewall (iptables/Netfilter).
• Firewall policy / rule — a policy is the full set of firewall rules applied to a store or node group; a rule is one specific instruction within that policy (for example, "allow traffic from the POS network to the payment gateway on port 443").
• PCI DSS — the Payment Card Industry Data Security Standard, the set of requirements (including firewall and network segmentation requirements) that any system handling card payments must meet.

VPNs and secure tunnels

• VPN (Virtual Private Network) — an encrypted tunnel over the public internet that lets two networks or devices communicate as if they were directly and privately connected.
• TLS VPN — the type of encrypted tunnel used to connect a store's SC//Reliant node to the customer's cloud environment for day-to-day operational data.
• IPsec VPN — a different, typically hardware-based, encrypted tunnel technology; on SC//Reliant this is used for the permanent link between a customer's corporate headquarters and Scale Computing's management environment.
• VPC / VNet (Virtual Private Cloud / Virtual Network) — a private, isolated section of a cloud provider (AWS or Azure) reserved for a single customer's environment, reachable only through that customer's dedicated VPN.
• Terminating — where a VPN tunnel "ends" and the data inside it is unpacked back into ordinary, usable traffic.
• Edge Platform — the physical SC//Reliant node(s) running inside the store.

Content filtering and guest access

• ICC (Internet Content Control) — the platform's optional URL/category-based web filtering feature, which can block browsing to specific sites or categories of sites.
• AUP (Acceptable Use Policy) portal — a "splash page" that a device must accept before it's allowed to browse the internet on a given network, commonly used on guest WiFi.
• Guest WiFi — a wireless network kept fully separate (via VLAN) from payment and operational networks, intended for customer or visitor internet access.