[Bug]: Policy-engine sampler ignores the parent's sampling decision, producing orphan spans and partial traces
Maintainers usually reply within 1 day
@lahiruudayakumara is already working on this.
Since Oct 13, 2026.
- #3752 by @lahiruudayakumara — open
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 72/100
- Issue type
- Bug
- Clarity
- Clearly specified
- Activity status
- Active
- Tech stack
- go
- Domain
- observability
Research direction
Start with gateway/gateway-runtime/policy-engine/internal/tracing/tracer.go at the sampler setup around lines 121–132, then compare its parent sampling behavior with the Envoy configuration in gateway/gateway-controller/pkg/xds/translator.go around line 2950. Reproduce using the supplied unsampled traceparent and tracing backend. Done when the policy engine honors the parent sampling decision and the reported request no longer produces orphan spans.
Written by the indexing model from the issue text.
Description
Please select the area the issue is related to
Gateway
Please select the aspect the issue is related to
Aspect/Monitoring (Metrics, observability, health checks, alerts)
Description
The policy engine uses AlwaysSample() when sampling_rate is 1.0 and TraceIDRatioBased(rate) otherwise (tracer.go L121-L132). Neither honours the sampled flag of the parent context, while Envoy samples with random_sampling (translator.go L2950).
- Observed: a request with
traceparent: ...-00(not sampled). Envoy recorded no spans; the policy engine still exported 13 spans whose parent was never recorded (orphan spans). - From the code: with
sampling_rate < 1, Envoy keeps a random fraction of requests and the policy engine keeps an independent fraction chosen by its own trace ID, so most retained traces will be missing one side.
Steps to Reproduce
- Enable
[tracing]and a Jaeger/OTLP backend. - Send a request with
traceparent: 00-<trace-id>-<span-id>-00. - Jaeger shows policy-engine spans whose parent span does not exist, and no router spans.
Expected: the policy engine follows the parent's sampling decision.
Suggested fix: sdktrace.ParentBased(sdktrace.TraceIDRatioBased(rate)). Together with #3734 the policy engine then follows Envoy's decision exactly; the ratio applies only when there is no parent.
Severity Level of the Issue
Severity/Major (Important functionality is broken. Should be prioritized. Doesn't need immediate attention)
Environment Details (with versions)
gateway-runtime and gateway-controller 2026.09.24 built from main (cba467a), Envoy 1.39.0, Jaeger 1.76. Code links pinned to 94c8527.
- Dominant language
- Go
- Stars
- 76
- Forks
- 126
- Avg merge
- 2d 10h
- Merged PRs (30d)
- 183
Getting set up
- No Dockerfile or Docker Compose file
- Has a pull request template
- No contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from wso2/api-platform
-
[Bug]: Deleting an MCP proxy leaves its API keys in the gateway's memory and in the policy engineOpenAspect/API Aspect/Other Severity/Minor Type/Bug
Difficulty 2/5 1-3 hours Newbie friendliness 83/100
wso2/api-platform#3852 ·
Maintainers usually reply within 1 day
-
UpstreamName routing convention for the primary provider is undocumented; fails silently as a 503 instead of a clear errorMay be free again @Shalitha1 claimed this 28 days ago, and no pull request is open. OpenArea/AIPolicies Area/PolicyEngine documentation Severity/Minor
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
wso2/api-platform#3537 · 1 comment ·
Maintainers usually reply within 1 day
-
[Bug]: Root README documentation links 404 after docs/gateway and docs/ai-gateway removalPossibly taken @randilt claimed this 47 days ago. OpenAspect/API Aspect/Other hackathon Severity/Trivial Type/Bug
Difficulty 1/5 1-3 hours Newbie friendliness 90/100
wso2/api-platform#3375 ·
Maintainers usually reply within 1 day
-
Area/AIWorkspace Aspect/API Severity/Major Type/Bug
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
wso2/api-platform#3152 ·
Maintainers usually reply within 1 day
-
Aspect/UI Severity/Trivial Type/Bug
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
wso2/api-platform#3074 ·
Maintainers usually reply within 1 day
All issues in wso2/api-platform
Similar issues
-
OCIRepository: pick the Helm chart layer automatically when the first layer is a provenance fileOpen
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
fluxcd/source-controller#2198 ·
Maintainers usually reply within 1 day
-
webhook: mutating admission silently allows objects when createPatch fails (error discarded)Possibly taken @lemonzoey claimed this today. Open
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
volcano-sh/volcano#6138 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
Maintainers usually reply within 1 day
-
area/frameworks area/steve kind/bug team/frameworks
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
Maintainers usually reply within 1 day