[v4.9.0] docs(doc-1410): terminology — understand/, _fragments/, troubleshoot/, reference/ batch 5 (#2132)

platform_versioned_docs/version-4.9.0/_fragments/cli-steps/platform-add-cluster.mdx

@@ -1,6 +1,6 @@
-        **Add Host Cluster to the Platform (Optional)**: If you want to add the host cluster to the platform, then 
+        **Add Control Plane Cluster to the Platform (Optional)**: If you want to add the control plane cluster to the platform, then 
         run this command. Before running this command, be sure that your kubecontext is set to the 
-        host cluster.
+        control plane cluster.
 
 
     ```bash title="Connect host cluster to platform."

platform_versioned_docs/version-4.9.0/_fragments/ui-steps/project-select.mdx

@@ -1,2 +1,2 @@
 From the project drop-down menu (top left corner), select the project you'd like to create the
-    virtual cluster in.
+    tenant cluster in.

platform_versioned_docs/version-4.9.0/_fragments/ui-steps/virtual-cluster-new.mdx

@@ -1,3 +1,3 @@
 import Button from "@site/src/components/Button";
 
-Click the <Button>Create Virtual Cluster</Button> button.
+Click the <Button>Create Tenant Cluster</Button> button.

platform_versioned_docs/version-4.9.0/_fragments/ui-steps/virtual-cluster-select.mdx

@@ -1,3 +1,3 @@
 import NavStep from "@site/src/components/NavStep";
 
-Click on <NavStep>Virtual Clusters</NavStep>.
+Click on <NavStep>Tenant Clusters</NavStep>.

platform_versioned_docs/version-4.9.0/reference/platform-annotations.mdx

@@ -517,7 +517,7 @@ The project that owns the VirtualClusterInstance.
 
 **Set by:** Platform
 
-The name of the virtual cluster an object is associated with.
+The name of the tenant cluster an object is associated with.
 
 ### platform.vcluster.com/vcluster-instance-namespace {#platform-vcluster-com-vcluster-instance-namespace}
 
@@ -529,7 +529,7 @@ The name of the virtual cluster an object is associated with.
 
 **Set by:** Platform
 
-The namespace of the virtual cluster an object is associated with.
+The namespace of the tenant cluster an object is associated with.
 
 ### vcluster.loft.sh/managed-by {#vcluster-loft-sh-managed-by}
 
@@ -685,7 +685,35 @@ Identifies the Kubernetes name associated with the vCluster node.
 
 **Set by:** Platform
 
-Indicates the original namespace of an object synced from the vCluster to the host cluster.
+Indicates the original namespace of an object synced from the vCluster to the control plane cluster.
+
+## Snapshot and restore {#snapshot-restore}
+
+These labels mark resources used for vCluster backup and restore operations.
+
+### vcluster.loft.sh/snapshot-request {#vcluster-loft-sh-snapshot-request}
+
+**Type:** Label
+
+**Example:** `vcluster.loft.sh/snapshot-request: "true"`
+
+**Used on:** ConfigMap, Secret
+
+**Set by:** Platform
+
+Marks ConfigMaps and Secrets as snapshot request resources for vCluster backup operations.
+
+### vcluster.loft.sh/restore-request {#vcluster-loft-sh-restore-request}
+
+**Type:** Label
+
+**Example:** `vcluster.loft.sh/restore-request: "true"`
+
+**Used on:** ConfigMap, Secret
+
+**Set by:** Platform
+
+Marks ConfigMaps and Secrets as restore request resources for vCluster restore operations.
 
 ## Auto sleep configuration {#sleep-mode-configuration}
 
@@ -1487,6 +1515,42 @@ Enables ArgoCD integration for this vCluster or cluster. When set, the platform
 
 Tracks which ArgoCD AppProject destinations are managed by the loft project controller. This prevents the controller from removing destinations managed by vCluster instances when syncing project specifications.
 
+### loft.sh/argocd-connector {#loft-sh-argocd-connector}
+
+**Type:** Annotation
+
+**Example:** `loft.sh/argocd-connector: "my-argocd-connector"`
+
+**Used on:** ArgoCD application resources
+
+**Set by:** Platform
+
+Tracks the connector name last used to sync this ArgoCD application. A change in this value triggers cleanup on the old backend before the application is created on the new connector.
+
+### loft.sh/argocd-akuity-connector {#loft-sh-argocd-akuity-connector}
+
+**Type:** Annotation
+
+**Example:** `loft.sh/argocd-akuity-connector: "akuity-connector:small"`
+
+**Used on:** VirtualClusterInstance
+
+**Set by:** Platform
+
+Stores the Akuity connector name and agent size (format: "connectorName:agentSize") for the currently installed Akuity agent. A change in either component triggers full cleanup and re-registration of the ArgoCD integration.
+
+### loft.sh/argocd-akuity-manifest-hash {#loft-sh-argocd-akuity-manifest-hash}
+
+**Type:** Annotation
+
+**Example:** `loft.sh/argocd-akuity-manifest-hash: "a1b2c3d4e5f67890abcdef1234567890abcdef1234567890abcdef1234567890"`
+
+**Used on:** VirtualClusterInstance
+
+**Set by:** Platform
+
+The SHA-256 hash of the last applied Akuity agent manifest. Re-application is skipped when the hash is unchanged, preventing overwrites of manual or operator-driven patches.
+
 ### loft.sh/connector-type {#loft-sh-connector-type}
 
 **Type:** Label
@@ -1887,6 +1951,18 @@ General cleanup finalizer ensuring proper resource deletion.
 
 Ensures management resources are cleaned up when the parent resource is deleted.
 
+### loft.sh/cleanup-argocd-integration {#loft-sh-cleanup-argocd-integration}
+
+**Type:** Finalizer
+
+**Example:** `finalizers: ["loft.sh/cleanup-argocd-integration"]`
+
+**Used on:** VirtualClusterInstance
+
+**Set by:** Platform
+
+Blocks VirtualClusterInstance deletion until managed ArgoCD applications and cluster registrations are deleted through the ArgoCD API.
+
 ### loft.sh/cleanup-workload {#loft-sh-cleanup-workload}
 
 **Type:** Finalizer

platform_versioned_docs/version-4.9.0/troubleshoot/tsnet-connectivity.mdx

@@ -1,14 +1,14 @@
 ---
 title: Resolve vCluster TSNet connection failures
 sidebar_label: Resolve TSNet connection failures
-description: Fix TSNet connectivity issues that prevent virtual clusters from showing as ready in the platform UI.
+description: Fix TSNet connectivity issues that prevent tenant clusters from showing as ready in the platform UI.
 ---
 
 import Flow, { Step } from "@site/src/components/Flow";
 
 # Resolve vCluster TSNet connection failures
 
-The [TSNet (Tailscale Network)](https://tailscale.com/kb/1244/tsnet) connection failure prevents the vCluster Platform from properly marking virtual clusters as ready, even when they are running successfully. This occurs because TSNet cannot establish a stable connection with the platform, which blocks communication between the vCluster on the connected cluster and the platform. As a result, the vCluster appears to be running in the host cluster but shows as it is not ready in the platform UI, which prevents proper management and monitoring.
+The [TSNet (Tailscale Network)](https://tailscale.com/kb/1244/tsnet) connection failure prevents the vCluster Platform from properly marking tenant clusters as ready, even when they are running successfully. This occurs because TSNet cannot establish a stable connection with the platform, which blocks communication between the vCluster on the connected cluster and the platform. As a result, the vCluster appears to be running in the control plane cluster but shows as it is not ready in the platform UI, which prevents proper management and monitoring.
 
 ## Error message
 
@@ -26,7 +26,7 @@ ERROR ts-net-controller tsnet/tsnet.go:148 Check if TSNet is online {
 
 When the TSNet connection fails, you might observe the following:
 
-- **vCluster status discrepancy**: The vCluster shows as `Running` in the remote host cluster but is not marked as ready in the vCluster Platform UI.
+- **vCluster status discrepancy**: The vCluster shows as `Running` in the remote control plane cluster but is not marked as ready in the vCluster Platform UI.
 
 - **Successful local connection**: You can successfully connect to the vCluster using `vcluster connect` command.
 
@@ -45,7 +45,7 @@ Look for errors related to connection timeouts or relay server failures.
 
 TSNet connection failures might occur due to the following:
 
-- **Restricted egress policies**: Host clusters with strict network policies (common in GKE, EKS, and other managed Kubernetes services) might block outbound connections to the coordination server.
+- **Restricted egress policies**: Control plane clusters with strict network policies (common in GKE, EKS, and other managed Kubernetes services) might block outbound connections to the coordination server.
 
 - **Ingress controller interference**: Ingress controllers like Istio might block or interfere with WebSocket upgrades required for TSNet communication.
 
@@ -140,7 +140,7 @@ After completing the solution steps:
 
 <Step title="Test vCluster"> 
 
-  Connect to the virtual cluster and check node access:
+  Connect to the tenant cluster and check node access:
 
   ```bash
   vcluster connect <vcluster-name> -n <namespace>
@@ -174,7 +174,7 @@ To ensure reliable TSNet connectivity in the platform:
 
 - **Always disable direct connections**: Set `TS_DEBUG_DIAL_DIRECT=false` in environments to avoid connection issues.
 
-- **Monitor network policies**: Ensure your host cluster's network policies allow outbound connections to the platform coordination server.
+- **Monitor network policies**: Ensure your control plane cluster's network policies allow outbound connections to the platform coordination server.
 
 - **Configure appropriate timeouts**: Set reasonable timeout values for network operations in restricted environments.
 

platform_versioned_docs/version-4.9.0/understand/auth-explanation.mdx

@@ -20,7 +20,7 @@ The platform uses several objects to manage access and permissions:
 | **SSO Group** | A representation of a group from your [configured SSO provider](https://www.vcluster.com/docs/platform/configure/platform-configs/single-sign-on). These groups are imported during authentication and stored in User records. |
 | **Team** | A collection of platform users. Users join teams either through explicit assignment or via SSO Group membership. Teams can have Management Roles. [API reference](https://www.vcluster.com/docs/platform/api/resources/team) |
 | **Management Role** | Defines permissions granted to users or teams within specific scopes. [API reference](https://www.vcluster.com/docs/platform/api/resources/clusterroletemplate) |
-| **Project** | An organizational unit for resources such as virtual clusters. [Projects](https://www.vcluster.com/docs/platform/understand/what-are-projects) help enforce access control and resource quotas.|
+| **Project** | An organizational unit for resources such as tenant clusters. [Projects](https://www.vcluster.com/docs/platform/understand/what-are-projects) help enforce access control and resource quotas.|
 
 ## Setting up authentication with Microsoft Entra ID
 
@@ -47,8 +47,8 @@ This example shows how to implement a comprehensive security model using Microso
 Create Management Roles aligned with your organization's needs. This example uses four distinct roles:
 
 1. **Platform Operations** - Full platform management permissions
-2. **DevOps Engineers** - Create and manage virtual clusters within projects
-3. **Developers** - Connect to and use virtual clusters
+2. **DevOps Engineers** - Create and manage tenant clusters within projects
+3. **Developers** - Connect to and use tenant clusters
 4. **Automation Service Account** - Programmatic access for GitOps workflows
 
 ### Team structure

platform_versioned_docs/version-4.9.0/understand/platform_communication.mdx

@@ -11,7 +11,7 @@ Several background processes run when creating a vCluster that enable communicat
 ## Components in vCluster-platform communication
 
 ### The platform
-The control center for managing your virtual clusters. This includes the main dashboard where you can view, configure, and monitor all your virtual clusters.
+The control center for managing your tenant clusters. This includes the main dashboard where you can view, configure, and monitor all your tenant clusters.
 
 ### vCluster
 Your virtual Kubernetes cluster that runs your applications. It connects securely to the platform.
@@ -29,7 +29,7 @@ A VPN tunnel creates a secure connection between endpoints and the internet that
 
 ## What is VPN Mesh?
 
-A VPN mesh forms a secure, decentralized network where devices connect directly to each other using encrypted tunnels. In cluster architecture, VPN mesh (Tailscale) secures communication between the vCluster platform and virtual clusters.
+A VPN mesh forms a secure, decentralized network where devices connect directly to each other using encrypted tunnels. In cluster architecture, VPN mesh (Tailscale) secures communication between the vCluster platform and tenant clusters.
 
 ## Register vCluster on the platform
 

platform_versioned_docs/version-4.9.0/understand/ranges-app-template.mdx

@@ -88,7 +88,7 @@ This configuration:
 
 Setting numeric ranges is valuable for:
 
-- **Resource allocation**: Ensuring virtual clusters receive sufficient but not excessive resources.
+- **Resource allocation**: Ensuring tenant clusters receive sufficient but not excessive resources.
 - **Configuration safety**: Preventing users from entering values that could cause performance issues.
 - **Standardization**: Maintaining consistent deployments across your organization.
 - **User guidance**: Helping users understand appropriate values for different parameters.

platform_versioned_docs/version-4.9.0/understand/what-are-apps.mdx

@@ -9,15 +9,15 @@ sidebar_position: 6
 <!-- vale on -->
 
 Apps in vCluster Platform are a way for admins to package applications and scripts in consumable packages.
-These Apps can then be deployed into clusters, spaces, or virtual clusters.
+These Apps can then be deployed into clusters, spaces, or tenant clusters.
 
 An example application, and one that comes packaged in a default vCluster Platform deployment, is the 'Cert
 Manager' app. This app, as you may guess from the name, deploys the
 [cert-manager](https://github.com/cert-manager/cert-manager) controller into a cluster, space or
-virtual cluster.
+tenant cluster.
 
 Apps can be an existing or custom (user provided) Helm chart, a Kubernetes manifest, or a bash
-script that installs resources into a given destination (cluster, space, or virtual cluster).
+script that installs resources into a given destination (cluster, space, or tenant cluster).
 Importantly, Apps can have _parameters_, that is, values that a user can provide to modify the
 deployment of an application.
 

platform_versioned_docs/version-4.9.0/understand/what-are-secrets.mdx

@@ -6,12 +6,12 @@ sidebar_position: 9
 
 ## What are Secrets?
 
-Like [Kubernetes secrets](https://kubernetes.io/docs/concepts/configuration/secret/), vCluster Platform secrets are intended to hold confidential data in the form of key/value pairs. vCluster Platform extends Kubernetes secrets by allowing global or project level management of secret data, managing which users and teams can access secrets, and synchronizing secret data across multiple clusters and the spaces and virtual clusters on those clusters. After creating vCluster Platform secrets, native Kubernetes secrets can be created with labels that indicate to vCluster Platform that the secret data should be synchronized with vCluster Platform secrets. Once this secret synchronization is configured, the secret data can be mounted using the native secret as usual, but managed at the project or global level using vCluster Platform secrets.
+Like [Kubernetes secrets](https://kubernetes.io/docs/concepts/configuration/secret/), vCluster Platform secrets are intended to hold confidential data in the form of key/value pairs. vCluster Platform extends Kubernetes secrets by allowing global or project level management of secret data, managing which users and teams can access secrets, and synchronizing secret data across multiple clusters and the spaces and tenant clusters on those clusters. After creating vCluster Platform secrets, native Kubernetes secrets can be created with labels that indicate to vCluster Platform that the secret data should be synchronized with vCluster Platform secrets. Once this secret synchronization is configured, the secret data can be mounted using the native secret as usual, but managed at the project or global level using vCluster Platform secrets.
 
 ## Project Secrets
 
-Project secrets are scoped to a Project, and implicitly only allow access to members of the project. Once a project secret is created, native Kubernetes secrets that synchronize to the project secret can be created in spaces and virtual clusters that belong to the project. This provides a convenient way to manage secret data for all members of the project. For more information on creating project secrets, see [creating project secrets](../administer/secrets/project/create.mdx)
+Project secrets are scoped to a Project, and implicitly only allow access to members of the project. Once a project secret is created, native Kubernetes secrets that synchronize to the project secret can be created in spaces and tenant clusters that belong to the project. This provides a convenient way to manage secret data for all members of the project. For more information on creating project secrets, see [creating project secrets](../administer/secrets/project/create.mdx)
 
 ## Global Secrets
 
-Global secrets or shared secrets can be synchronized across all spaces in vCluster Platform registered clusters. Additionally, global secrets can be use to synchronize project secrets. This allows organization wide management of secrets shared across multiple projects. Like project secrets, native Kubernetes secrets can be synchronized directly to global secrets, however this synchronization only works for secrets defined in spaces and not virtual clusters. For more information on creating project secrets, see [creating global secrets](../administer/secrets/global/create.mdx)
+Global secrets or shared secrets can be synchronized across all spaces in vCluster Platform registered clusters. Additionally, global secrets can be use to synchronize project secrets. This allows organization wide management of secrets shared across multiple projects. Like project secrets, native Kubernetes secrets can be synchronized directly to global secrets, however this synchronization only works for secrets defined in spaces and not tenant clusters. For more information on creating project secrets, see [creating global secrets](../administer/secrets/global/create.mdx)

platform_versioned_docs/version-4.9.0/understand/what-are-users-and-teams.mdx

@@ -9,5 +9,5 @@ sidebar_position: 10
 Users and teams are entities that can interact with the vCluster Platform API. A user can
 be a developer that develops applications or an administrator that manages the
 vCluster Platform. Users can be assigned to teams, which set the permissions applied
-to all the team's members. For example, you can give virtual cluster access to a team, which
-gives all members of the team virtual cluster access.
+to all the team's members. For example, you can give tenant cluster access to a team, which
+gives all members of the team tenant cluster access.