Node Tagging

Tags are labels you attach to nodes to organize them by role, environment, team, or any other grouping. Tags simplify ACL management by allowing you to write rules between groups of nodes instead of individual IPs.

Overview

A tag is a named label with an optional color and description. Tags are defined at the network level and can be assigned to multiple nodes. Each node can have multiple tags.

Key Features:

• Organize nodes by role, environment, or any custom criteria
• Use tags in ACL rules instead of hardcoded IPs
• Automatically apply access policies to new nodes by tagging them
• Per-network scope (tags in one network do not affect others)

Creating Tags

Tags are created from the network detail page in Camouflage Cloud.

1. Navigate to your network in Camouflage Cloud
2. Click the Tags tab
3. Click + Add Tag (or similar button)
4. Provide:
   • Name — A short, descriptive label (e.g., "web-server", "database", "dev")
   • Color — Optional visual indicator for the tag
   • Description — Optional explanation of the tag's purpose

Example Tags

Name	Color	Description
web-server	Blue	Frontend web servers serving HTTP/HTTPS traffic
database	Red	PostgreSQL and MySQL database nodes
dev	Green	Development environment nodes
prod	Orange	Production environment nodes
engineering	Purple	Nodes managed by the engineering team
finance	Yellow	Nodes used by the finance department

Tag Naming Best Practices

• Use lowercase for consistency
• Use hyphens or underscores instead of spaces (e.g., app-server, not app server)
• Keep names short and descriptive
• Avoid ambiguous names (e.g., prefer web-frontend over web if you also have web-backend)

Assigning Tags to Nodes

Once tags are created, you can assign them to nodes from:

1. Node detail view — View a specific node and add/remove tags
2. Tags tab — Select a tag and assign it to multiple nodes at once

A node can have multiple tags. For example, a node might be tagged with both "web-server" and "prod" to indicate its role and environment.

Example Node Tagging

Node: web-01

• Tags: web-server, prod, engineering

Node: db-01

• Tags: database, prod, engineering

Node: dev-workstation

• Tags: dev, engineering

With these tags in place, you can now write ACL rules like:

• Allow tag:web-server → tag:database on tcp:5432
• Deny tag:dev → tag:prod on all protocols

Using Tags with ACLs

Tags unlock powerful, scalable security patterns. Instead of managing rules for individual node IPs (which becomes unmanageable as your network grows), you write rules between tags.

How It Works

1. Create tags that represent roles or environments
2. Assign tags to nodes based on their function
3. Write ACL rules using tag:name syntax in the source or destination field
4. When a new node joins and receives a tag, it automatically inherits the access defined by your tag-based rules

Example: Three-Tier Application

Tags:

• frontend — Web servers
• backend — API servers
• database — Database servers

ACL Rules:

Priority: 10
Source: tag:frontend
Destination: tag:backend
Protocol: tcp
Ports: 8080
Action: Allow

Priority: 20
Source: tag:backend
Destination: tag:database
Protocol: tcp
Ports: 5432
Action: Allow

Priority: 5
Source: tag:frontend
Destination: tag:database
Protocol: *
Ports: *
Action: Deny

When you add a new web server, simply tag it with frontend and it will automatically be allowed to reach backend nodes but denied direct access to database nodes.

Example: Environment Isolation

Tags:

• dev — Development environment
• staging — Staging environment
• prod — Production environment

ACL Rule:

Priority: 1
Source: tag:dev
Destination: tag:prod
Protocol: *
Ports: *
Action: Deny

This prevents any development node from accessing production resources, regardless of how many dev or prod nodes you have.

Tag Management

Renaming Tags

When you rename a tag, all ACL rules referencing that tag are automatically updated. Nodes keep their tag assignments.

Deleting Tags

When you delete a tag:

• It is removed from all nodes that have it
• ACL rules referencing the tag may become invalid or ineffective
• Consider updating or removing those rules before deleting the tag

Tag Colors

Colors are purely visual aids to help you quickly identify tags in the UI. They do not affect ACL behavior.

Best Practices

Use Environment Tags

Create tags for each environment stage:

• dev — Development
• staging — Staging or QA
• prod — Production

Use these tags to enforce isolation between environments with deny rules.

Use Role Tags

Tag nodes by their function:

• web — Web servers
• api — API servers
• database — Database servers
• cache — Redis or Memcached nodes
• worker — Background job workers

Use role tags to define service-level access (e.g., only api can reach database).

Use Team Tags

Tag nodes by owning team:

• engineering — Engineering team nodes
• ops — Operations team nodes
• finance — Finance department nodes

Use team tags for visibility and organizational accountability.

Combine Tags

A node can have multiple tags. Use combinations for precise control:

Node: api-prod-01

• Tags: api, prod, engineering

Node: api-dev-02

• Tags: api, dev, engineering

Now you can write rules like:

• Allow tag:web → tag:api (all environments can reach API servers)
• Deny tag:dev → tag:prod (but dev nodes cannot reach prod)

Keep Descriptions Updated

Use the tag description field to explain the purpose of each tag. This helps new team members understand your tagging strategy and prevents confusion as your network grows.

Avoid Over-Tagging

While tags are flexible, creating too many can make management confusing. Aim for a clear, consistent taxonomy:

• 1-2 environment tags per node (dev/staging/prod)
• 1-2 role tags per node (web/api/database)
• 0-1 team tag per node (engineering/ops)

Example Tagging Strategy

A typical organization might use this tagging strategy:

Environment Tags:

• dev, staging, prod

Role Tags:

• web, api, database, cache, worker, monitoring

Team Tags:

• engineering, ops, finance, hr

Example Nodes:

Node Name	Environment	Role	Team
web-prod-01	prod	web	engineering
web-prod-02	prod	web	engineering
api-prod-01	prod	api	engineering
db-prod-01	prod	database	ops
web-dev-01	dev	web	engineering
db-dev-01	dev	database	engineering

Example ACL Rules:

# Deny dev from prod
Priority: 1
Source: tag:dev
Destination: tag:prod
Action: Deny

# Allow web to api
Priority: 10
Source: tag:web
Destination: tag:api
Protocol: tcp
Ports: 8080
Action: Allow

# Allow api to database
Priority: 20
Source: tag:api
Destination: tag:database
Protocol: tcp
Ports: 5432
Action: Allow

Next Steps

• Access Control Lists (ACLs) — Learn how to write ACL rules using tags
• Standalone Daemon Administration — Managing clients in standalone mode