Metadata and labels

FleetAMP separates ownership from deployment targeting.

Controlled identity

application, environment, and place establish the collector's group boundary. Only authorized management workflows can change these values. A label selector never moves a collector into another group and never expands a Group Owner's access.

Reported metadata

Collectors may report version, host, operating-system, SDK, or other runtime attributes. These values are useful for inventory and troubleshooting but should not be trusted as authorization inputs.

Managed labels

Administrators and authorized Group Owners can maintain labels such as:

region=eu-west
tier=edge
runtime=kubernetes

Managed values take precedence when the same key is also reported by a collector. Label changes are audited.

Selector rules

Deployment selectors use exact key/value matches. Multiple entries use logical AND, so region=eu-west plus tier=edge targets collectors carrying both effective labels. Matching is always evaluated inside the selected group.

See Label-based targeting for preview and approval behavior.