Resource tagging and labeling standard

The canonical org-wide tag/label taxonomy every cloud resource and k8s object on the nanohype stack carries. Defines vendor-neutral dimensions, their per-surface rendering (AWS tag keys, k8s labels, OTel attributes), the deterministic casing transforms, the reserved namespaces, which dimensions are required, and conditional requirements — tags required only on certain resource kinds, such as BackupPolicy on backup-eligible kinds, without which a resource is silently unprotected. cloudgov reads the required-tier keys from this file to gate CI; landing-zone and the eks-agent-platform operator inject them; tenant charts label workloads from it.

Name	resource-tagging
Version	1
Source	standards/resource-tagging.json

The standard

transforms

aws

Render the canonical kebab-case id as PascalCase (split on '-', capitalize each part, join). cost-center -> CostCenter.

k8s

Well-known dimensions render under app.kubernetes.io/<leaf>; org dimensions render under <group>.nanohype.dev/<id>. The label value must match [a-z0-9A-Z._-]{0,63} and start and end alphanumeric — the API server's own rule, and narrower than an AWS tag value. A dimension whose canonical value carries a character outside that set renders it with '/' replaced by '.' on this surface only (repository: nanohype/eks-gitops -> nanohype.eks-gitops). Slashes are legal in a label KEY's prefix and in an AWS tag value, which is why one dimension is spelled differently per surface. A value that cannot survive the transform belongs in an annotation, whose values are unconstrained — annotations are not selectable, so that is a real trade.

otel

Dotted lower-case attribute names. Reserved namespace agents.* (tenant/platform/model identity) plus the well-known deployment.environment and service.version.

reserved_prefixes

k8s

• app.kubernetes.io/
• platform.nanohype.dev/
• agents.nanohype.dev/
• tenants.nanohype.dev/
• governance.nanohype.dev/

otel

• agents.
• deployment.
• service.

app_extension

k8s

<app>.tenants.nanohype.dev/<key>

aws

app:<key>

otel

<app-namespace>.<key> (never under agents.*)

dimensions

• id

  environment

  tier

  required

  meaning

  Deploy stage: development, staging, production, hub, or org.

  render

  aws

  Environment

  k8s

  platform.nanohype.dev/environment

  otel

  deployment.environment

• id

  managed-by

  tier

  required

  meaning

  The tool that owns the resource lifecycle. Value: opentofu (substrate) or eks-agent-platform (operator-reconciled).

  render

  aws

  ManagedBy

  k8s

  app.kubernetes.io/managed-by

  otel

  —

• id

  project

  tier

  required

  meaning

  The substrate project the resource belongs to. Value: landing-zone.

  render

  aws

  Project

  k8s

  platform.nanohype.dev/project

  otel

  —

• id

  repository

  tier

  required

  meaning

  The repository that declares the resource, as org/name (e.g. <org>/<repo>). This is the declaring repo, not the product the resource belongs to — a resource declared by an infrastructure repo on behalf of a product carries the infrastructure repo. The k8s label renders it org.name (<org>.<repo>) — a label value may not contain '/'.

  render

  aws

  Repository

  k8s

  platform.nanohype.dev/repository

  otel

  —

• id

  cost-center

  tier

  required

  meaning

  Billing rollup unit (e.g. platform-engineering).

  render

  aws

  CostCenter

  k8s

  platform.nanohype.dev/cost-center

  otel

  —

• id

  business-unit

  tier

  required

  meaning

  Organizational rollup above cost-center (e.g. engineering).

  render

  aws

  BusinessUnit

  k8s

  platform.nanohype.dev/business-unit

  otel

  —

• id

  data-classification

  tier

  required

  meaning

  Data sensitivity: public, internal, confidential, or restricted.

  render

  aws

  DataClassification

  k8s

  platform.nanohype.dev/data-classification

  otel

  —

• id

  compliance

  tier

  required

  meaning

  Compliance regime: soc2, hipaa, or none.

  render

  aws

  Compliance

  k8s

  platform.nanohype.dev/compliance

  otel

  —

• id

  component

  tier

  required

  meaning

  The substrate component or workload role (network, cluster, llm, ...).

  render

  aws

  Component

  k8s

  app.kubernetes.io/component

  otel

  —

• id

  team

  tier

  required

  meaning

  The owning team that operates the resource (e.g. platform).

  render

  aws

  Team

  k8s

  platform.nanohype.dev/team

  otel

  —

• id

  owner

  tier

  recommended

  meaning

  Accountable handle for escalation (a team or GitHub-team slug). Auto-filled from the env-level owner, defaulting to team when unset; never hand-entered per resource.

  render

  aws

  Owner

  k8s

  platform.nanohype.dev/owner

  otel

  —

• id

  revision

  tier

  recommended

  meaning

  The deployed source revision (a short git SHA or chart appVersion) for provenance and rollback correlation.

  render

  aws

  Revision

  k8s

  app.kubernetes.io/version

  otel

  service.version

• id

  provisioner

  tier

  recommended

  meaning

  The factory job or CI run that created the resource (a pipeline run id). Feeds provenance and attribution.

  render

  aws

  Provisioner

  k8s

  platform.nanohype.dev/provisioner

  otel

  —

• id

  lifecycle

  tier

  recommended

  meaning

  Whether the resource is reapable: ephemeral or persistent. Ephemeral resources past their expiry are cleanup candidates.

  render

  aws

  Lifecycle

  k8s

  platform.nanohype.dev/lifecycle

  otel

  —

• id

  expiry

  tier

  recommended

  meaning

  An ISO-8601 date (YYYY-MM-DD) after which an ephemeral resource is safe to reap. Set by the vend layer as now + ttl; omit on persistent resources.

  render

  aws

  Expiry

  k8s

  platform.nanohype.dev/expiry

  otel

  —

• id

  tenant

  tier

  contextual

  meaning

  The Platform tenant a per-tenant resource belongs to. Applies only to multi-tenant components and per-tenant cloud resources.

  render

  aws

  Tenant

  k8s

  agents.nanohype.dev/tenant

  otel

  agents.tenant

• id

  platform

  tier

  contextual

  meaning

  The Platform CR name (the app). k8s and OTel only — never a cloud tag.

  render

  aws

  —

  k8s

  agents.nanohype.dev/platform

  otel

  agents.platform

• id

  model-family

  tier

  contextual

  meaning

  The LLM family for AI workloads. OTel only — runtime cost attribution.

  render

  aws

  —

  k8s

  —

  otel

  agents.model_family

• id

  model-id

  tier

  contextual

  meaning

  The full Bedrock model id for AI workloads. OTel only — runtime cost attribution.

  render

  aws

  —

  k8s

  —

  otel

  agents.model_id

• id

  backup-policy

  tier

  contextual

  meaning

  The AWS Backup plan key whose vault selection tag-matches this resource, so it is protected. Cloud tag only. Required on backup-eligible resource kinds (see conditional_requirements): a backup-eligible resource without this tag is silently unprotected — the tag-based selection never picks it up and nothing errors until a restore is attempted. tenant-substrate stamps it on every datastore from spec.datastores; anything created outside a component is caught by the eks-gitops Kyverno rule and cloudgov.

  render

  aws

  BackupPolicy

  k8s

  —

  otel

  —

required_by_surface

aws

• Environment
• ManagedBy
• Project
• Repository
• CostCenter
• BusinessUnit
• DataClassification
• Compliance
• Component
• Team

k8s

• app.kubernetes.io/managed-by
• app.kubernetes.io/component
• platform.nanohype.dev/environment
• platform.nanohype.dev/team

otel

• agents.tenant
• agents.platform

conditional_requirements

• dimension

  backup-policy

  surface

  aws

  tag

  BackupPolicy

  required_on_kinds

  • Aurora
  • RDS
  • DynamoDB
  • S3
  • EFS

  value

  The AWS Backup plan key (e.g. "daily") whose vault selection tag-matches this value.

  rationale

  A backup-eligible resource without a BackupPolicy tag is silently unprotected — the tag-based backup selection never selects it, and nothing errors until a restore is attempted. This is the highest-probability coverage failure because it produces no signal. Enforced preventively where the resource is minted (tenant-substrate stamps it from spec.datastores) and detectively by the eks-gitops Kyverno rule and cloudgov, which flag a backup-eligible resource of one of required_on_kinds that lacks the tag.