Glossary
The words ElastiCluster uses, in plain terms. The console, the CLI, the API and this site use them the same way.
- Agent
- The small program, ecl-agent, that runs on every managed server. It dials out to the control plane, applies plans for the server and its databases, runs checks and reports status. Server management
- Approval
- A person’s decision to let a plan run. Approvals are bound to one exact version of the plan and are always made by people, never by tokens or AI assistants. Plans and approvals
- Autonomy level
- How much an AI assistant’s token may apply without a person, from observe (read only) and propose up to unrestricted. The effective level is the lowest of the token’s, the environment’s and the instance’s limits. AI and MCP
- Commit boundary
- The step in a forward-only change, such as a major upgrade, after which rolling back without losing data is no longer possible. Plans name it in advance.
- Control plane
- The ElastiCluster server: console, API, MCP server, planning, operations and state, in one container. It is not in the data path. How it works
- Data identity guard
- A marker in each database’s data directory. A database refuses to start on data that belongs to something else, or on an empty mount point after a disk failed to mount.
- Disruption
- What clients notice while a plan runs, from none, reload and connection reset to rolling, partial downtime, downtime and destructive.
- Drill
- An automatic test restore of a backup into throwaway containers, with checks and a measured restore time. A partial drill checks the latest full backup and a sample when the drill server is too small for everything. Backups and recovery
- Endpoint
- The address applications connect to, such as rw for the primary or ro for replicas, served by HAProxy on the members and optionally a virtual IP, so it follows failovers.
- Environment
- A policy scope inside a project, such as production, staging or development, with its own approval rules, AI limits, backup requirements and maintenance window.
- Fork
- A copy of a cluster restored from its latest backup into a new cluster that deletes itself after seven days unless extended.
- Four-eyes
- An environment rule that the person approving a plan must differ from the one who requested it; the owner of an AI token can never approve that token’s requests.
- Join token
- A short-lived secret, single-use by default, that lets a new server enroll. The server then waits for an admin’s approval.
- Kill switch
- An instance setting that stops all AI writes at once, or closes the MCP endpoint entirely.
- Maintenance window
- Days, hours and a time zone, such as sun 04:00-06:00 Europe/Berlin, when disruptive steps of approved plans are allowed to run.
- MCP
- Model Context Protocol, the open standard AI assistants use to call tools. ElastiCluster’s built-in MCP server lets assistants work with clusters within their limits. AI and MCP
- Member
- One cluster’s presence on one server, for example the primary or a replica.
- Operation
- The durable execution of a plan, made of steps. It pauses on failure, can be retried, skipped or aborted, and resumes after a control-plane restart.
- Plan
- A preview of one change: the diff, the ordered actions, the risk, the disruption and the estimated duration. Nothing changes a cluster without one, apart from a short list of small, audited direct actions. Plans and approvals
- Point-in-time recovery
- Restoring a database to a chosen moment by restoring a backup and replaying the transaction log up to that moment.
- Preflight
- Checks a server must pass before it takes a role, such as kernel settings, disks, time sync and connectivity; blocking failures stop it, warnings don’t.
- Project
- The boundary for access, quotas, credentials and notifications, usually one per team. Projects contain environments.
- Restore point
- A named marker created automatically before an operation changes data or configuration, so you can restore to just before it.
- Risk
- How dangerous a plan is: low, medium, high or critical. Risk decides who must approve it.
- Stale approval
- An approval that can no longer run because the cluster, its reservations or the policy changed after it was granted. It offers a re-plan instead.
- Sudo mode
- A short period after re-entering your password and a two-factor code, required for sensitive actions such as approving servers or revealing secrets.
- Witness
- A small server that only votes in a quorum (etcd for PostgreSQL, a Sentinel for Valkey) and holds no data.
- Write canary
- A tiny write through the real rw endpoint every 30 seconds that proves the cluster can actually accept writes.
Try the console before it ships
The interactive demo runs the whole console on simulated data. Trigger a failover, approve an AI assistant’s plan, restore a backup to a point in time. Nothing to install.