Skip to main content

​
Considerations

Before enabling pii masking, please note the following:
  • Predefined PII categories replace matched values with a category-specific token (e.g. ***EMAIL***, ***CREDIT_CARD***).
  • Custom format and regex maskings replace only the matched capture group with ****, leaving the rest of the value intact.
  • Currently, only trace signals are supported.
  • All span attribute values in every matching span will be examined and masked accordingly.

​
Use Cases

Security
  • By default, OpenTelemetry should not record PII (Personally Identifiable Information) or sensitive data such as passwords, api tokens, etc. However, if the data is accidentally added to the telemetry signals, or if a manual instrumentation recorded it into an attribute, this action can be used to mask such data.
Legal and Compliance
  • Ensure compliance with legal and privacy.
    • Payment Card Industry (PCI) Data Security Standards prohibit logging certain things or storing them unencrypted.
Domain-specific secrets
  • Mask application-specific fields (e.g. SSN in JSON payloads, passwords in SQL statements, or identifiers in URL paths) using customFormatMaskings or customRegexMaskings when they are not covered by a predefined PII category.

​
Configuration Options

The PiiMasking action is configured using the odigos.io/v1alpha1.Action CRD with the piiMasking configuration section.
actionName string : Allows you to attach a meaningful name to the action for convenience.
  • This field is optional
  • Odigos does not use or assume any meaning from this field
notes string : Allows you to attach notes regarding the action for convenience.
  • This field is optional
  • Odigos does not use or assume any meaning from this field
disabled boolean : Allows you to temporarily disable the action, but keep it saved for future use.
  • This field is optional, and defaults to false
signals string[] : An array with the signals that the action will operate on.
  • This field is required
  • Supported values: TRACES
piiMasking object : Configuration for the PiiMasking action.
  • This field is required for this action type
scopes object : Limits which sources this masking config applies to.
  • This field is optional
  • If unset or empty, the config is applied to all sources.
sources object[] : A list of workloads to apply this action to.
  • Each entry requires name, namespace, and kind (Deployment, StatefulSet, or DaemonSet).
namespaces string[] : Apply this action to all sources in the listed namespaces.
languages string[] : Apply this action only to containers instrumented with the listed programming languages.
piiCategories string[] : An array of strings representing the PII categories you want to mask.
  • This field is optional
  • The available PII categories are:
    • CREDIT_CARD - mask Visa and MasterCard credit card numbers
    • EMAIL - mask email addresses
    • JWT - mask JSON Web Tokens
    • UUID - mask UUIDs
Can’t find the PII category you need? Use customFormatMaskings or customRegexMaskings, or contact us and we will add it for you.
customFormatMaskings object[] : Format-based masking rules applied in order. Each rule looks up a key inside structured attribute values and masks the matched value.
  • This field is optional
lookupKey string : The field or path segment whose value should be masked (e.g. a JSON key, SQL column name, or URL path segment).
  • This field is required
dataFormat string : The format of the data to search in.
  • This field is required
  • Supported values:
    • json — matches key: value pairs in JSON envelopes (e.g. {"ssn": "123-45-6789"} or ssn: 123-45-6789).
    • sql — matches key = value pairs in SQL statements (e.g. WHERE password = 'hunter2').
    • resource_path — matches key/value segments inside URL paths (e.g. /orders/abc-123), stopping at the next /, whitespace, ?, &, #, or quote.
customRegexMaskings object[] : Regex-based masking rules applied in order.
  • This field is optional
regex string : A custom regular expression with a single capture group whose value is masked with ****.
  • This field is required
  • The pattern must contain at least one capture group; only the first capture group is replaced.

​
Basic Example

The following example demonstrates how to configure the Pii Masking action to mask Visa and MasterCard credit card numbers from span attribute values using the Action CRD.
1
Create a YAML file with the following content:
pii-masking.yaml
2
Apply the action to the cluster:

​
Custom Masking Example

The following example combines a predefined category with custom format and regex rules. Given span attributes such as:
  • {"ssn": "123-45-6789", "name": "alice"}
  • WHERE password = 'hunter2' AND status = 'ok'
  • /api/v1/orders/abc-123/items
  • auth api_key=super-secret-value next
the action produces:
1
Create a YAML file with the following content:
pii-masking-custom.yaml
2
Apply the action to the cluster:

​
Scoped Example

To limit masking to specific workloads, add scopes. Omit scopes (or leave it empty) to apply the action to all sources.
pii-masking-scoped.yaml