Skipping tags in Puppet

Most people know about the –tags argument to puppet agent execute specific parts of the manifest.

'--tags' allows you to specify what portions of a configuration you want
to apply. Puppet elements are tagged with all of the class or definition
names that contain them, and you can use the 'tags' flag to specify one
of these names, causing only configuration elements contained within
that class or definition to be applied. This is very useful when you are
testing new configurations --- for instance, if you are just starting to
manage 'ntpd', you would put all of the new elements into an 'ntpd'
class, and call puppet with '--tags ntpd', which would only apply that
small portion of the configuration during your testing, rather than
applying the whole thing.

But did you know there is its opposite notation. Using –skip_tags you can exclude specific sections too.

'--skip_tags' is a flag used to filter resources. If this is set, then
only resources not tagged with the specified tags will be applied.
Values must be comma-separated.

for example.

puppet agent --test --noop
Info: Using configured environment 'production'
Info: Retrieving pluginfacts
Info: Retrieving plugin
Info: Retrieving locales
Info: Loading facts
Info: Applying configuration version '1584527837'
Notice: /Stage[main]/Cron/Cron::Job[apt_update]/File[job_apt_update]/ensure: current_value 'absent', should be 'file' (noop)
Notice: Cron::Job[apt_update]: Would have triggered 'refresh' from 1 event
Notice: Class[Cron]: Would have triggered 'refresh' from 1 event
Notice: /Stage[main]/Common::Pkgmgmt/Package[puppet-release]/ensure: current_value '1.0.0-7buster', should be '1.0.0-10buster' (noop) (corrective)
Notice: /Stage[main]/Common::Pkgmgmt/Package[puppet-agent]/ensure: current_value '6.13.0-1buster', should be '6.14.0-1buster' (noop) (corrective)
Notice: Class[Common::Pkgmgmt]: Would have triggered 'refresh' from 2 events
Notice: Stage[main]: Would have triggered 'refresh' from 2 events
Notice: Applied catalog in 4.71 seconds

Lets say we don’t want the puppet agent package to update on this run, by skipping the common section from the example above we can stop that happening.

puppet agent --test --noop --skip_tags Common
Info: Using configured environment 'production'
Info: Retrieving pluginfacts
Info: Retrieving plugin
Info: Retrieving locales
Info: Loading facts
Info: Applying configuration version '1584527767'
Notice: /Stage[main]/Cron/Cron::Job[apt_update]/File[job_apt_update]/ensure: current_value 'absent', should be 'file' (noop)
Notice: Cron::Job[apt_update]: Would have triggered 'refresh' from 1 event
Notice: Class[Cron]: Would have triggered 'refresh' from 1 event
Notice: Stage[main]: Would have triggered 'refresh' from 1 event
Notice: Applied catalog in 3.41 seconds