Advanced tagging

Auto-tagging is powerful, but raw host metadata is noisy — cloud providers attach dozens of internal tags you don’t want cluttering your taxonomy. Advanced tagging is the filter that decides which self-reported tags are accepted, configured per server agent profile.

Filter modes

Each profile that has server-led tagging enabled sets a filter mode and selects a set of tag groups:

Mode	Behaviour
Include	Keep only collected tags belonging to a selected group. Everything else is dropped.
Exclude	Drop collected tags belonging to a selected group. Everything else is kept.

If no groups are selected, all collected tags pass through — the filter only constrains once you populate it.

Matching is on the tag group, not the value

This is the detail worth internalising: the filter matches a whole tag group. Selecting a group matches every tag whose key is that group’s name, whatever its value.

Consider a profile in exclude mode with the Environments group selected:

• a collected Environments = QA is dropped,
• a collected Environments = UAT is dropped as well.

So selecting a group in exclude mode retires the entire group in one action — you don’t enumerate values. Conversely, in include mode, selecting Environments admits every value the host reports for that group.

A group is matched by its stored form and without case: selecting Environment also matches a host reporting environment, and selecting a group an agent created before the naming rule, such as app.kubernetes.io/name, still matches the reports now stored as app-kubernetes-io-name.

Include mode for a tight taxonomy

On regulated or high-cardinality fleets, prefer include mode. Select the exact groups you want (Environment, Team, …) and every other piece of host metadata is discarded at the door. Your taxonomy stays curated no matter what the cloud provider attaches.

The filter is group-level, so it is blunt by design

You cannot accept Environment = production while rejecting Environment = scratch — both belong to the same group, so the filter treats them identically. If you need value-level control, model the distinction as separate groups, or curate those tags on the profile instead of collecting them from the host.

Where the filter lives and how it’s applied

The filter is stored against the profile as a set of tag groups, so it always references real, known groups in your organisation rather than free-text strings.

It is backend-authoritative. The agent reports everything a host’s metadata offers and WatchTower15 decides what to keep, on both:

1. Enrollment, when the server first appears, and
2. every heartbeat thereafter, so a filter you change today takes effect on existing hosts without reinstalling or restarting anything.

Because the decision is made server-side, an outdated or misbehaving agent can’t smuggle filtered tags past the platform — and changing a filter never requires a fleet-wide agent rollout.

How the final tag set is computed

The server’s tags are the union of:

• the profile’s assigned tags (always applied), and
• the server-reported tags that survived the filter.

Re-syncs are additive. The practical consequences:

• Profile-assigned tags are guaranteed on every host, filter or not.
• Excluding a group stops it being added going forward; it doesn’t retroactively strip hosts that already carry those tags.
• To fully retire a tag from hosts, remove it in the dashboard — the filter governs intake, not deletion.

Worked example

A web-tier profile with server-led tagging on, mode include, groups:

Environment
Team

A host whose cloud metadata reports Environment=production, Team=platform, aws:cloudformation:stack-name=web-42, CostCentre=1234 enrolls with exactly:

• Environment = production and Team = platform (their groups are selected), plus
• whatever tags the web-tier profile assigns directly.

The aws:cloudformation:* and CostCentre tags are discarded — their groups were never in the include set.

Related

• Tagging & auto-tagging — the sources and the tag-group model.
• Fleet & profiles — enabling server-led tagging.