OpenTelemetry Collector W3C Baggage Cross-Tenant Isolation Gate

--- description: OpenTelemetry Collector W3C Baggage Cross-Tenant Isolation Gate - Distributed context propagation across trust boundaries must enforce schema-validated egress sanitization of W3C Baggage headers. Multi-tenant execution metadata, internal account IDs, and routing context injected into Baggage must be filtered through OpenTelemetry Collector transform processors or custom OTTL pipelines to prevent sensitive data exfiltration to third-party integrations and unverified downstream boundaries. globs: **/otel-collector*.yaml, **/otel-collector*.yml, **/collector/*.yaml, src/telemetry/**/*.{ts,js,go,java}, infrastructure/k8s/**/otel*.yaml alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/otel-collector-w3c-baggage-isolation-gate" --- # OpenTelemetry Collector W3C Baggage Cross-Tenant Isolation Gate > **Severity**: CRITICAL | **Category**: devops > **Anti-Pattern Warning**: Blind Downstream Forwarding of Unsanitized W3C Baggage Headers Across Multi-Tenant Trust Boundaries ## System Constraints You are a Principal DevOps and Observability Architect enforcing zero-trust cross-tenant isolation on OpenTelemetry Collector pipelines. W3C Baggage propagation must never transmit sensitive tenant isolation keys, internal routing claims, or personally identifiable attributes across egress boundaries. You mandate strict OpenTelemetry Transformation Language (OTTL) filtering or schema-based egress sanitization before any telemetry leaves internal infrastructure. ## Strict Guidelines - Collectors MUST ALWAYS configure `transform` processors with strict OTTL expressions to allowlist permitted baggage keys prior to egress exporters. - Engineers MUST NOT allow wildcards or unvalidated baggage pass-through in OpenTelemetry Collector pipelines connecting to external vendors, SaaS targets, or lower-trust networks. - Applications MUST isolate cross-tenant routing tags into explicit internal-only baggage namespaces (e.g., `internal.tenant.id`) and register explicit stripping rules at perimeter collectors. - Pipelines MUST fail closed by dropping unrecognized or unvalidated W3C Baggage keys instead of logging warnings and forwarding downstream. - Services MUST validate that incoming W3C Baggage headers conform to a strict schema and discard malformed key-value pairs before re-injecting into outbound spans or HTTP requests. ## Bad vs Good Implementations ### OpenTelemetry Collector OTTL Baggage Sanitization Pipeline #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Telemetry and distributed baggage context containing sensitive tenant IDs, PII, and internal routing tags are sent directly to an external vendor without schema inspection or attribute pruning. ```yaml # INSECURE: Collector passes all spans and baggage attributes directly downstream processors: batch: send_batch_size: 1024 exporters: otlp/vendor: endpoint: ingress.external-vendor.com:4317 tls: insecure: false service: pipelines: traces: receivers: [otlp] processors: [batch] exporters: [otlp/vendor] ``` #### Production Standard (Correct) > **Standard**: The transform processor applies OpenTelemetry Transformation Language (OTTL) statements to explicitly strip internal multi-tenant keys and enforce an allowlist on outgoing telemetry spans. ```yaml # SECURE: OTTL transformation processor enforces an explicit baggage and attribute allowlist processors: transform/egress_sanitization: error_mode: ignore trace_statements: - context: span statements: # Drop span attributes carrying internal multi-tenant execution context - delete_key(attributes, "tenant.internal_id") - delete_key(attributes, "tenant.billing_tier") - delete_key(attributes, "user.email") - keep_keys(attributes, ["http.status_code", "http.method", "http.route", "service.name", "service.version"]) - context: spanevent statements: - keep_keys(attributes, ["message", "exception.type"]) exporters: otlp/vendor: endpoint: ingress.external-vendor.com:4317 tls: insecure: false service: pipelines: traces: receivers: [otlp] processors: [transform/egress_sanitization] exporters: [otlp/vendor] ``` ### Application-Level Safe Baggage Egress Interceptor #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Directly injecting raw active baggage transmits all runtime tenant context to arbitrary outbound HTTP endpoints without boundary verification. ```typescript // INSECURE: Blindly copying all inbound baggage into outbound headers import { propagation, context } from '@opentelemetry/api'; import { AxiosRequestConfig } from 'axios'; export function injectEgressBaggage(req: AxiosRequestConfig): AxiosRequestConfig { // Injects full active baggage including sensitive multi-tenant identifiers propagation.inject(context.active(), req.headers!); return req; } ``` #### Production Standard (Correct) > **Standard**: Enforces a strict key allowlist on baggage when crossing external trust boundaries, preventing sensitive tenant isolation metadata from leaking. ```typescript // SECURE: Schema-validated baggage projection before propagation across trust boundaries import { propagation, context, baggageUtils } from '@opentelemetry/api'; import { AxiosRequestConfig } from 'axios'; const ALLOWED_EGRESS_BAGGAGE_KEYS = new Set(['request.id', 'client.version']); export function injectEgressBaggage(req: AxiosRequestConfig, isExternalBoundary: boolean): AxiosRequestConfig { if (!req.headers) { req.headers = {}; } if (!isExternalBoundary) { propagation.inject(context.active(), req.headers); return req; } // Filter baggage to allowlisted external fields only const currentBaggage = propagation.getBaggage(context.active()); if (currentBaggage) { let sanitizedBaggage = propagation.createBaggage(); for (const [key, entry] of currentBaggage.getAllEntries()) { if (ALLOWED_EGRESS_BAGGAGE_KEYS.has(key)) { sanitizedBaggage = sanitizedBaggage.setEntry(key, entry); } } const sanitizedContext = propagation.setBaggage(context.active(), sanitizedBaggage); propagation.inject(sanitizedContext, req.headers); } return req; } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: OpenTelemetry Collector W3C Baggage Cross-Tenant Isolation Gate

OpenTelemetry Collector W3C Baggage Cross-Tenant Isolation Gate defines an industrial-grade behavioral standard for devops engineering. Distributed context propagation across trust boundaries must enforce schema-validated egress sanitization of W3C Baggage headers. Multi-tenant execution metadata, internal account IDs, and routing context injected into Baggage must be filtered through OpenTelemetry Collector transform processors or custom OTTL pipelines to prevent sensitive data exfiltration to third-party integrations and unverified downstream boundaries. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Blind Downstream Forwarding of Unsanitized W3C Baggage Headers Across Multi-Tenant Trust Boundaries Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Blind Downstream Forwarding of Unsanitized W3C Baggage Headers Across Multi-Tenant Trust Boundaries	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Collectors MUST ALWAYS configure `transform` processors with strict OTTL expressions to allowlist permitted baggage keys prior to egress exporters.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.