# Configure observability

When `telemetry.enabled: true`, Gateway exports OTLP metrics and traces to the customer-operated `telemetry.otlp_endpoint`; it never sends telemetry to Keystone. Supported protocols are `grpc` and `http/protobuf`. Use an HTTPS endpoint and `telemetry.ca_file` for a private CA. The endpoint must not contain userinfo, query parameters, or a fragment; configure Collector authentication with `telemetry.auth_headers`, which is secret material. A Collector outage does not stop Gateway licensing; export shutdown is bounded by `telemetry.export_timeout_seconds`.

Resource attributes are `service.name=keystone-gateway`, `service.version`, `keystone.gateway.id`, and `keystone.gateway.replica.id`. Signals include `keystone.gateway.license.valid`, `.license.expiry.seconds`, `.entitlement.{limit,in_use,available,over_capacity}`, `.leases.active`, `.lease.{requests,rejections,expirations}`, `.ha.role`, `.peer.reachable`, `.ha.split_brain_possible`, and `.http.request.duration`. Labels are limited to license type, component, operation, outcome, and replica ID. Product identities, lease IDs, credentials, and certificate subjects are excluded.

Monitor readiness, valid license/expiry, available capacity, lease rejection rate, request latency, current HA role, peer reachability, split-brain risk, and over-capacity. Gateway writes structured logs to standard output in JSON by default; include the response `X-Correlation-Id` when correlating a request with logs. Structured logging redacts recognized sensitive keys and, for string/error values and `slog.Group` leaves, high-confidence credential representations as defense in depth. It cannot reliably identify every opaque secret or sanitize arbitrary composite objects. Keep credentials out of log messages, errors, request/configuration dumps, and URLs; review logs and startup stderr before sharing them.