​
Considerations

Before enabling pii masking, please note the following:

  • This action masks span attribute values by replacing only the sensitive portions with ****, while leaving the rest of the value intact.
  • The regex used for masking are predefined for each PII category and cannot be configured.
  • Currently, only trace signals are supported.
  • All span attribute values in every span will be examined and masked accordingly.

​
Use Cases

Security

  • By default, OpenTelemetry should not record PII (Personally Identifiable Information) or sensitive data such as passwords, api tokens, etc. However, if the data is accidentally added to the telemetry signals, or if a manual instrumentation recorded it into an attribute, this action can be used to mask such data.

Legal and Compliance

  • Ensure compliance with legal and privacy.
    • Payment Card Industry (PCI) Data Security Standards prohibit logging certain things or storing them unencrypted.

​
Configuration Options

​
Basic Example

The following example demonstrates how to configure the Pii Masking action to mask Visa and MasterCard credit card numbers from span attribute values.

1

Create a YAML file with the following content:

pii-masking.yaml
apiVersion: actions.odigos.io/v1alpha1
kind: PiiMasking
metadata:
  name: pii-masking
  namespace: odigos-system
spec:
  actionName: PII Masking
  piiCategories:
    - CREDIT_CARD
  signals:
    - TRACES
2

Apply the action to the cluster:

kubectl apply -f pii-masking.yaml