Platform Tags Reference

info

Feature status: planned

This page lists all tags that Entigo Platform and its components apply to cloud resources.

Platform System Tags

Tags managed by the Entigo Platform. Do not modify these manually.

K8s Label	AWS Tag	Azure Tag	GCP Label	Purpose	When Present
`entigo.com/workspace`	`entigo:workspace`	`entigo.workspace`	`entigo_workspace`	Workspace isolation via ABAC	Always
`entigo.com/zone`	`entigo:zone`	`entigo.zone`	`entigo_zone`	Zone scoping via ABAC	Zone-scoped resources
—	`Name`	—	—	Human-readable name in AWS Console	Always (AWS only)

Notes

entigo:workspace is the only universally required tag. Its presence signals that the resource is within platform scope.
entigo:zone is omitted for workspace-scoped resources not associated with a specific zone.
Management policy is not propagated to cloud tags. The entigo.com/management-policy label is a Kubernetes-only concept that controls syncer behavior. See Kubernetes-Only Labels below.
Name follows AWS naming conventions for console readability.

Crossplane System Tags

Tags added by Crossplane (the cloud resource provisioning engine). These cannot be renamed or suppressed.

AWS Tag	Purpose	Example Value
`crossplane-kind`	Kubernetes managed resource type (GVK)	`instance.rds.aws.upbound.io`
`crossplane-name`	Kubernetes managed resource name	`my-database-abc12`
`crossplane-providerconfig`	ProviderConfig used for provisioning	`default`

Customer Passthrough Tags

Tags defined by users via the tags.entigo.com/ prefix on Organization, Workspace, or Zone objects. The prefix is stripped before applying to cloud resources.

Source	Cloud Tag
Label `tags.entigo.com/cost-center: CC-12345`	`cost-center: CC-12345`
Annotation `tags.entigo.com/project-description: My project`	`project-description: My project`

See the Custom Resource Tags guide for usage details.

Kubernetes-Only Labels

These labels exist within the platform (control plane and workspace clusters) and are not propagated to cloud resources:

Label	Purpose	Set By
`entigo.com/management-policy`	Lifecycle management (full vs. observed)	Platform / Syncer
`app.kubernetes.io/managed-by`	Identifies creating tool (argocd, helm, entigo-web)	Creating tool

Tag Key Format Per Cloud Provider

The platform translates Kubernetes label prefixes to provider-appropriate formats:

Cloud Provider	Prefix Format	Separator	Example
Kubernetes	`entigo.com/`	`/`	`entigo.com/workspace`
AWS	`entigo:`	`:`	`entigo:workspace`
Azure	`entigo.`	`.`	`entigo.workspace`
GCP	`entigo_`	`_`	`entigo_workspace`

Provider-Specific Limitations

Constraint	AWS	Azure	GCP
Max tags per resource	50	50	64 (labels)
Key max length	128	512 (128 for storage)	63
Value max length	256	256	63
Case sensitive (keys)	Yes	No	Lowercase only
Case sensitive (values)	Yes	Yes	Lowercase only

Example: Complete Tag Set on an AWS Resource

A fully managed RDS database in zone-1:

entigo:workspace          = ws-prod-001
entigo:zone               = zone-1
Name                      = my-production-database
crossplane-kind           = instance.rds.aws.upbound.io
crossplane-name           = my-production-database-x7k2m
crossplane-providerconfig = default
cost-center               = CC-12345          (passthrough from Zone)
environment               = production         (passthrough from Workspace)
company                   = acme-corp          (passthrough from Organization)

An observed S3 bucket:

entigo:workspace          = ws-prod-001
entigo:zone               = zone-1
Name                      = legacy-data-bucket
crossplane-kind           = bucket.s3.aws.upbound.io
crossplane-name           = legacy-data-bucket-m3p9q
crossplane-providerconfig = default
cost-center               = CC-12345          (passthrough from Zone)