Proxies, ingress controllers, service meshes, and load balancers can preserve trace continuity only when the required context fields reach the next tracing boundary.

Forward context fields

For W3C propagation, allow traceparent and tracestate through every request path that should remain correlated. If a compatibility boundary uses B3 or another configured propagator, forward only the fields required by that boundary. HTTP field names are case-insensitive; avoid duplicate or conflicting values.
A pass-through proxy should not rewrite valid trace context. A proxy that creates its own span should use its SDK propagator so the outgoing parent ID represents that operation while preserving the trace relationship.

Trust and security

Treat context from public or otherwise untrusted callers according to the service’s trust policy. Trace headers are not authorization credentials. Do not expose sensitive data in tracestate or baggage, and avoid forwarding baggage to external destinations unless explicitly approved.

Test the path

Exercise inbound and outbound routes through each proxy and load balancer. Compare trace IDs and parent-child relationships at both sides, inspect proxy header allowlists and size limits, and test error, retry, and cross-origin paths where applicable.