Skip the gRPC-reserved 'te' header in SanitizeMetadataHeaders

After [a-z0-9] key sanitization, "te" is the only grpc-reserved header
name reachable (every other reserved header contains a ':' or '-' that
sanitization strips). Handle it deterministically via an explicit skip
set rather than relying on grpc's own handling of a reserved header.

Author: pkcll

pkg/chipingress/header_provider.go

@@ -141,9 +141,15 @@ func SanitizeMetadataValue(val string) string {
 // corresponding CE extension (differing only by the CloudEvents Kafka binding's "ce_" prefix
 // once on the wire). Values are sanitized via SanitizeMetadataValue, since grpc-go fails the
 // whole RPC on a non-printable value. Entries that sanitize to an empty key, or that collide
-// with a reserved extension name (see reservedExtensionNames), are skipped. Keys are applied
-// in sorted order so duplicate sanitized keys resolve deterministically (first in sorted order
-// wins), matching WithResourceAttributeExtensions' collision handling.
+// with a reserved extension name (see reservedExtensionNames) or a gRPC-reserved header name
+// (see reservedMetadataKeys), are skipped. Keys are applied in sorted order so duplicate
+// sanitized keys resolve deterministically (first in sorted order wins), matching
+// WithResourceAttributeExtensions' collision handling.
+//
+// Note: unlike the CloudEvents Kafka binding, gRPC metadata keys are NOT prefixed with "ce_" —
+// that prefix is a CloudEvents-binding concept, not a metadata one, and reusing it here would
+// collide with the CE binding's own "ce_<name>" Kafka header if the server ever forwards gRPC
+// metadata verbatim onto Kafka.
 func SanitizeMetadataHeaders(in map[string]string) map[string]string {
 	keys := make([]string, 0, len(in))
 	for k := range in {
@@ -160,6 +166,9 @@ func SanitizeMetadataHeaders(in map[string]string) map[string]string {
 		if _, reserved := reservedExtensionNames[name]; reserved {
 			continue
 		}
+		if _, reserved := reservedMetadataKeys[name]; reserved {
+			continue
+		}
 		if _, exists := out[name]; exists {
 			continue
 		}

pkg/chipingress/header_provider_test.go

@@ -326,6 +326,11 @@ func TestSanitizeMetadataHeaders(t *testing.T) {
 		assert.Empty(t, got)
 	})
 
+	t.Run("gRPC-reserved header 'te' is dropped", func(t *testing.T) {
+		got := chipingress.SanitizeMetadataHeaders(map[string]string{"te": "trailers"})
+		assert.Empty(t, got)
+	})
+
 	t.Run("non-printable values are sanitized", func(t *testing.T) {
 		got := chipingress.SanitizeMetadataHeaders(map[string]string{"chain_id": "1\n2"})
 		assert.Equal(t, "1?2", got["chainid"])

pkg/chipingress/types.go

@@ -32,6 +32,16 @@ var reservedExtensionNames = map[string]struct{}{
 	"data":             {},
 }
 
+// reservedMetadataKeys holds gRPC-reserved header names that could otherwise be reached by
+// SanitizeExtensionName's [a-z0-9] sanitization. Verified against grpc-go v1.79.1's
+// isReservedHeader: every other reserved header (pseudo-headers, "content-type", "grpc-*")
+// contains a ':' or '-' that sanitization strips, so "te" is the only one actually reachable.
+// SanitizeMetadataHeaders consults this set so that edge case is handled deterministically
+// rather than relying on grpc's own (silent) handling of a reserved header.
+var reservedMetadataKeys = map[string]struct{}{
+	"te": {},
+}
+
 type (
 	// Cloudevents types
 	CloudEvent   = ce.Event