Opinionated baggage advice

[austinlparker]

Capturing some conversations I've had on baggage leaking attributes between OTel users --

• It's not intuitively clear that baggage values are sent over RPCs (even though this is documented; maybe we should make it more prominent?)
• There's no opinionated advice to implementors on how to properly sanitize baggage at the edge (as a consumer)
• There's no opinionated advice to implementors on how to sanitize baggage as a producer, either

These would be useful extensions to the baggage concept page

[svrnm]

Thanks for capturing this, I had heard some of that in the past as well. I like the idea to have some opinionated advice, this is what people are looking for at the end.

Odd question, what about applying encryption on the baggage? if only "my" otel users know the key to decrypt, this becomes a much smaller problem (also you send a lot of garbage over the wire)

[austinlparker]

eh, i could maybe see encrypting it before it goes out but it's still extra work (also, if you try to encrypt between services then you have to deal with shared secrets and whatever)

[svrnm]

eh, i could maybe see encrypting it before it goes out but it's still extra work (also, if you try to encrypt between services then you have to deal with shared secrets and whatever)

yeah, it's not a very practical solution, I was just wondering about it (a little bit off topic I guess)

[theletterf]

I'm assuming those best practices are knowledge the Collector maintainers could provide, right? Could we ask them?

[svrnm]

I'm assuming those best practices are knowledge the Collector maintainers could provide, right? Could we ask them?

baggage is probably one of the few topics the collector has no relationship with, since it is purely for propagating data among services. The SDK SIGs might have some ideas around it, but I would say this is especially a practitioner topic, so people who use and implement otel in their day to day job should be the SMEs here.