Configure observability

When telemetry.enabled: true, Gateway exports OTLP metrics and traces to the customer-operated telemetry.otlp_endpoint; it never sends telemetry to Keystone. Supported protocols are grpc and http/protobuf. Use an HTTPS endpoint and telemetry.ca_file for a private CA. The endpoint must not contain userinfo, query parameters, or a fragment; configure Collector authentication with telemetry.auth_headers, which is secret material. A Collector outage does not stop Gateway licensing; export shutdown is bounded by telemetry.export_timeout_seconds.

Resource attributes are service.name=keystone-gateway, service.version, keystone.gateway.id, and keystone.gateway.replica.id. Signals include keystone.gateway.license.valid, .license.expiry.seconds, .entitlement.{limit,in_use,available,over_capacity}, .leases.active, .lease.{requests,rejections,expirations}, .ha.role, .peer.reachable, .ha.split_brain_possible, and .http.request.duration. Labels are limited to license type, component, operation, outcome, and replica ID. Product identities, lease IDs, credentials, and certificate subjects are excluded.

Monitor readiness, valid license/expiry, available capacity, lease rejection rate, request latency, current HA role, peer reachability, split-brain risk, and over-capacity. Gateway writes structured logs to standard output in JSON by default; include the response X-Correlation-Id when correlating a request with logs. Structured logging redacts recognized sensitive keys and, for string/error values and slog.Group leaves, high-confidence credential representations as defense in depth. It cannot reliably identify every opaque secret or sanitize arbitrary composite objects. Keep credentials out of log messages, errors, request/configuration dumps, and URLs; review logs and startup stderr before sharing them.