Glossary

Definitions of LakeSail terms used throughout the Platform Guide.

A

Account type. A property of a member: managed means the organization controls the user's profile; external means the user manages it. See Members.

Active (status). For a cloud account, the connection was verified. For a session, the runtime can accept client traffic. Networks, clusters, and cloud catalogs use Deployed instead.

B

Bring-your-own VPC. Connecting LakeSail to a VPC you already manage. LakeSail currently provisions networks for you. See Manage networks.

C

Catalog. A connection to table metadata, such as AWS Glue, Iceberg REST, Unity Catalog, OneLake, or Hive Metastore. A catalog does not copy data or grant access to the underlying files. See Connect a catalog.

Cloud catalog. AWS Glue catalog infrastructure that LakeSail provisions in your AWS account. Each cloud network includes a default cloud catalog. Manage it under Settings → Cloud Catalogs.

Channel (notification). A delivery destination for notifications: email, Slack, webhook, PagerDuty, or Rootly. See Notifications.

Cloud account. A trust relationship between LakeSail and an AWS account you own. It uses an IAM role with a scoped trust policy that LakeSail can assume when needed. See Security & IAM.

Cluster. A Kubernetes cluster LakeSail provisions inside a network. Jobs, sessions, and notebooks run here. A cluster has management nodes for system services and compute nodes for workloads. See Set up a cluster.

Compute nodes. Cluster nodes that run jobs, sessions, and notebooks. Workload sizing comes from a compute profile. Compute nodes are separate from management nodes.

Compute profile. A named, reusable bundle of compute and engine settings, including execution mode, driver and worker sizing, libraries, environment variables, and catalogs. Jobs, sessions, and notebooks run with a compute profile. Called a workload config in the API. See Compute profiles.

Concurrency policy. What happens when a scheduled job starts while a previous run is still active: skip, allow up to a maximum, or replace. See Scheduling.

Cron expression. A standard 5-field cron string, such as 0 2 * * *, that defines when a scheduled job runs. See Scheduling.

D

Default catalog. The available catalog Sail uses when SQL does not include a catalog name. Each network's default AWS Glue catalog is available automatically unless you customize a workload's catalogs.

Deployed (status). The latest provision or update succeeded. Applies to networks, clusters, and cloud catalogs. It does not show whether a resource can run workloads now; check Readiness.

Draft. An in-progress version of a job. Editing creates a draft while the published version remains active. Publishing the draft makes it the new live version. See Defining jobs.

Driver / worker. Sail roles used in cluster execution mode. The driver coordinates the runtime; workers perform distributed execution. Both are sized through a compute profile. See Compute profiles.

E

Execution mode. How a compute profile shapes the Sail engine: standalone uses one pod, while cluster uses a driver and separate workers. See Compute profiles.

External ID. A random secret in the cloud account's IAM trust policy. LakeSail must present it to assume the role, which prevents confused-deputy attacks. See Security & IAM.

I

IdP (Identity Provider). An external service, such as Okta, Microsoft Entra ID, or Google Workspace, that authenticates users through SSO. See Single sign-on.

Idle (session). A session without active client traffic. An idle session closes after its idle close delay and releases its compute. See Sessions.

Invitation. A time-limited invite that adds a user to an organization. See Invite teammates.

J

Job. A reusable, versioned SQL or Python workload that runs on a cluster. See Defining jobs.

Job run. A record of a job execution. Running a job creates a new run; retrying resets the latest eligible run under the same ID and version. See Runs & debugging.

M

Management nodes. Cluster nodes that run system services. Their instance type and node range are set in the cluster configuration and can be updated. Management nodes are separate from compute nodes.

Managed secret. An encrypted credential that jobs, compute profiles, and catalogs reference without storing its value in their configuration. The value is never returned after creation and is resolved when a runtime starts. See Manage secrets.

Member. The organization-scoped link between a user and an organization. Roles, team membership, and resource access apply to the member. See Members.

Memory catalog. An ephemeral, in-memory catalog for testing and temporary workloads.

MFA (Multi-Factor Authentication). Sign-in that requires an additional factor. LakeSail password sign-in uses time-based codes from an authenticator app. SSO can rely on the identity provider's MFA. See MFA.

Missed-schedule policy. What happens when one or more scheduled job times were missed: latest runs once on recovery, while all runs every missed occurrence. See Scheduling.

N

Network. A VPC LakeSail provisions inside a cloud account. It contains clusters and the network's workspace bucket. See Manage networks.

Notebook. A hosted, Marimo-based interactive Python notebook backed by a Sail session. It provides both the editor and runtime. See Notebooks.

Notification rule. Connects an event at a resource, team, organization, or personal scope to one or more notification channels. See Notifications.

O

Operation (long-running). Background infrastructure work, such as provisioning or destroying a network or cluster. LakeSail shows its progress in the resource's status.

Organization. A workspace containing members, settings, and resources. See Concepts.

Organization role. A predefined permission bundle that applies across an organization. You assign the roles provided by LakeSail. See Roles & permissions.

P

Pause. A job state that stops scheduled runs without deleting the job. Manual runs remain available.

Permission. The ability to perform an action on a type of resource. Roles bundle permissions. See Roles & permissions.

Permissions boundary. An IAM managed policy that caps the effective permissions of LakeSail-created roles in your AWS account. See Security & IAM.

Q

Query. A saved SQL definition used as a source for SQL jobs. A query can reference a catalog or specify a schema directly. See Queries.

R

Readiness. Whether a cluster or compute profile can run workloads now. Readiness is separate from the outcome recorded by infrastructure status.

Role. A predefined bundle of permissions. LakeSail provides organization roles and team roles.

Run (job). See Job run.

S

Saved query. See Query.

Session. A live Spark Connect runtime on a cluster. Compatible clients submit SQL and DataFrame operations over gRPC. See Sessions.

Shared (resource). A resource assigned to a team so its members can use it according to their team roles.

Snapshot (job source). SQL stored directly in a job instead of referenced from a saved query. The snapshot does not change when a saved query is edited. See Defining jobs.

Spark Connect. The gRPC protocol used to connect an external client to a Sail session. See Sessions.

T

Team. A group of members whose team roles control access to resources assigned to the team. See Teams.

Team role. A predefined permission bundle scoped to one team. A member can hold different roles in different teams. See Roles & permissions.

Token (session). A short-lived token that authenticates a Spark Connect client to one session. Only the session owner can issue one. See Sessions.

Trust policy. The part of an IAM role that controls who can assume it. LakeSail's role requires its platform principal and the correct external ID. See Security & IAM.

U

User. A global LakeSail identity. A member connects that user to an organization.

V

Version (job). A frozen job definition. Each published edit creates a new version, and every run records the version it used. See Defining jobs.

W

Workspace bucket. The S3 bucket LakeSail creates for each cloud network. It stores S3-backed table data, job files, notebook contents, and SQL job results in your AWS account. See Workspace bucket.

Workload boundary. An IAM permissions boundary that limits workload S3 access to LakeSail buckets associated with the cloud account connection. See Security & IAM.

Webhook signature. An HMAC-SHA256 signature over the raw request body, sent in the LakeSail-Signature header. Use it to verify that a webhook came from LakeSail. See Verifying webhook signatures.

Workload config. The API name for a compute profile. See Compute profiles.