Not all virtual resources are independent from each other. Sometimes, we want to generate a collection of resources that we can realize together as a group. Puppet provides a metaparameter called a tag that allows us to categorize resources together. Tags allow us to run a subset of Puppet code using puppet agent -t --tags <tag>. They provide a user-specific marking of a resource in order to build a collection of similar objects. Tags are an array, so you can apply more than one tag to a resource, but still call them separately. Virtual resources with tags can be called with a resource collector, sometimes called the spaceship operator. The simple format for calling resources by a tag is Resource <| |>. Inside of the two pipes, you can search the catalog for any parameter or metaparameter.

By using tags, we could call that administrative user with User <| tag == 'monitoring_admin' |>. This allows us to bundle resources and call them as a group, rather than as an individual pocket. Let's take the preceding example and expand it to use a tag-based system:

class admins::infrastructure {
  @user {'rrussellyates':
    ensure  => present,
    comment => 'Ryan Russell-Yates',
    groups  => ['wheel'],
    tag     => ['infrastructure_admin','monitoring_support'],
  }
  @user {'jsouthgate':
    ensure  => present,
    comment => 'Jason Southgate',
    groups  => ['wheel'],
    tag     => ['infrastructure_admin'],
  }
  @user {'chuck':
    ensure  => present,
    comment => 'Our Intern',
    groups  => ['wheel'],
    tag     => ['monitoring_support'],
  }
}

Now, we've tagged chuck as a member of monitoring support, Jason as a member of infrastructure administrators, and myself as a member of both teams. My manifest would then call users of a group, rather than the users individually:

class profile::my_app {
  include admins::infrastructure
  include security
  include ntp
  include dns

  # This line calls in all Monitoring Support and Infrastructure Admin users.
  User <| tag == 'monitoring_support' or tag == 'infrastructure_admin' |>
}

After we change our profile to use both tags, the two additional users will be added: jsouthgate and chuck. The administrative user russellyates was already on the system, so he was not created again:

[root@wordpress vagrant]# puppet agent -t
Info: Using configured environment 'production'
Info: Retrieving pluginfacts
Info: Retrieving plugin
Info: Retrieving locales
Info: Loading facts
Info: Caching catalog for wordpress
Info: Applying configuration version '1529120940'
Notice: /Stage[main]/Admins::Infrastructure/User[jsouthgate]/ensure: created
Notice: /Stage[main]/Admins::Infrastructure/User[chuck]/ensure: created
Notice: Applied catalog in 0.11 seconds