LCORE-1826: Expose OpenTelemetry configuration in v1/config endpoint

anik120 · anik120 · commit 6acd7f48f7f9 · 2026-07-29T15:28:31.000-04:00
Add observability configuration to the v1/config endpoint, exposing all
OTEL_* environment variables to provide visibility into the active OpenTelemetry
tracing setup.

Signed-off-by: Anik Bhattacharjee &lt;anbhatta@redhat.com&gt;
diff --git a/docs/devel_doc/openapi.json b/docs/devel_doc/openapi.json
@@ -6753,6 +6753,15 @@
                                             }
                                         ],
                                         "name": "lightspeed-stack",
+                                        "observability": {
+                                            "otel": {
+                                                "OTEL_EXPORTER_OTLP_ENDPOINT": "",
+                                                "OTEL_EXPORTER_OTLP_HEADERS": "[REDACTED]",
+                                                "OTEL_EXPORTER_OTLP_PROTOCOL": "",
+                                                "OTEL_SDK_DISABLED": "true",
+                                                "OTEL_SERVICE_NAME": ""
+                                            }
+                                        },
                                         "quota_handlers": {
                                             "enable_token_history": false,
                                             "limiters": [],
@@ -12367,6 +12376,11 @@
                         "title": "Splunk configuration",
                         "description": "Splunk HEC configuration for sending telemetry events."
                     },
+                    "observability": {
+                        "$ref": "#/components/schemas/ObservabilityConfiguration",
+                        "title": "Observability configuration",
+                        "description": "OpenTelemetry and observability configuration collected from OTEL_* environment variables."
+                    },
                     "deployment_environment": {
                         "type": "string",
                         "title": "Deployment environment",
@@ -12463,6 +12477,15 @@
                                 }
                             ],
                             "name": "lightspeed-stack",
+                            "observability": {
+                                "otel": {
+                                    "OTEL_EXPORTER_OTLP_ENDPOINT": "",
+                                    "OTEL_EXPORTER_OTLP_HEADERS": "[REDACTED]",
+                                    "OTEL_EXPORTER_OTLP_PROTOCOL": "",
+                                    "OTEL_SDK_DISABLED": "true",
+                                    "OTEL_SERVICE_NAME": ""
+                                }
+                            },
                             "quota_handlers": {
                                 "enable_token_history": false,
                                 "limiters": [],
@@ -15107,6 +15130,22 @@
                 "title": "OAuthFlows",
                 "description": "Defines the configuration for the supported OAuth 2.0 flows."
             },
+            "ObservabilityConfiguration": {
+                "properties": {
+                    "otel": {
+                        "additionalProperties": {
+                            "type": "string"
+                        },
+                        "type": "object",
+                        "title": "OpenTelemetry configuration",
+                        "description": "Active OpenTelemetry configuration from OTEL_* environment variables"
+                    }
+                },
+                "additionalProperties": false,
+                "type": "object",
+                "title": "ObservabilityConfiguration",
+                "description": "OpenTelemetry observability configuration.\n\nThis configuration is automatically populated from OTEL_* environment variables\nto provide visibility into the active tracing setup.\n\nAttributes:\n    otel: Dictionary of OTEL_* environment variables with secrets redacted."
+            },
             "OkpConfiguration": {
                 "properties": {
                     "rhokp_url": {
diff --git a/src/models/api/responses/successful/configuration.py b/src/models/api/responses/successful/configuration.py
@@ -87,6 +87,15 @@ class ConfigurationResponse(AbstractSuccessfulResponse):
                             "scheduler": {"period": 1},
                             "enable_token_history": False,
                         },
+                        "observability": {
+                            "otel": {
+                                "OTEL_SDK_DISABLED": "true",
+                                "OTEL_EXPORTER_OTLP_ENDPOINT": "",
+                                "OTEL_EXPORTER_OTLP_PROTOCOL": "",
+                                "OTEL_SERVICE_NAME": "",
+                                "OTEL_EXPORTER_OTLP_HEADERS": "[REDACTED]",
+                            }
+                        },
                     }
                 }
             ]
diff --git a/src/models/config.py b/src/models/config.py
@@ -2,6 +2,7 @@
 
 # pylint: disable=too-many-lines
 
+import os
 import re
 from enum import Enum
 from functools import cached_property
@@ -2830,6 +2831,83 @@ def compiled_patterns(self) -> CompiledPatterns:
         return list(self._compiled_patterns)
 
 
+class ObservabilityConfiguration(ConfigurationBase):
+    """OpenTelemetry observability configuration.
+
+    This configuration is automatically populated from OTEL_* environment variables
+    to provide visibility into the active tracing setup.
+
+    Attributes:
+        otel: Dictionary of OTEL_* environment variables with secrets redacted.
+    """
+
+    otel: dict[str, str] = Field(
+        default_factory=dict,
+        title="OpenTelemetry configuration",
+        description="Active OpenTelemetry configuration from OTEL_* environment variables",
+    )
+
+    @field_validator("otel", mode="before")
+    @classmethod
+    def redact_secrets(cls, value: dict[str, str]) -> dict[str, str]:
+        """Redact sensitive OTEL environment variables.
+
+        Redacts headers, certificates, and client keys for generic and signal-specific
+        (traces, metrics, logs) OTLP exporters.
+
+        Parameters:
+        ----------
+            value: Dictionary of OTEL environment variables
+
+        Returns:
+            New dictionary with sensitive values redacted as "[REDACTED]"
+        """
+        if not value:
+            return value
+
+        # Create a new dict to avoid mutating caller's data
+        redacted = {}
+
+        for key, val in value.items():
+            # Redact generic and signal-specific OTLP headers
+            # Matches: OTEL_EXPORTER_OTLP_HEADERS,
+            #          OTEL_EXPORTER_OTLP_TRACES_HEADERS,
+            #          OTEL_EXPORTER_OTLP_METRICS_HEADERS,
+            #          OTEL_EXPORTER_OTLP_LOGS_HEADERS
+            if "HEADERS" in key and "OTLP" in key:
+                redacted[key] = "[REDACTED]"
+            # Redact generic and signal-specific certificates
+            # Matches: OTEL_EXPORTER_OTLP_CERTIFICATE,
+            #          OTEL_EXPORTER_OTLP_TRACES_CERTIFICATE, etc.
+            elif "CERTIFICATE" in key and "OTLP" in key:
+                redacted[key] = "[REDACTED]"
+            # Redact generic and signal-specific client keys
+            # Matches: OTEL_EXPORTER_OTLP_CLIENT_KEY,
+            #          OTEL_EXPORTER_OTLP_TRACES_CLIENT_KEY, etc.
+            elif "CLIENT_KEY" in key and "OTLP" in key:
+                redacted[key] = "[REDACTED]"
+            else:
+                redacted[key] = val
+
+        return redacted
+
+    @classmethod
+    def from_environment(cls) -> "ObservabilityConfiguration":
+        """Collect all OTEL_* environment variables from the environment.
+
+        Sensitive variables (headers, certificates, keys) are automatically redacted
+        by the field validator.
+
+        Returns:
+            ObservabilityConfiguration with otel dict populated from environment.
+        """
+        otel_vars = {}
+        for key, value in os.environ.items():
+            if key.startswith("OTEL_"):
+                otel_vars[key] = value
+        return cls(otel=otel_vars)
+
+
 class Configuration(ConfigurationBase):
     """Global service configuration."""
 
@@ -2991,6 +3069,13 @@ class Configuration(ConfigurationBase):
         description="Splunk HEC configuration for sending telemetry events.",
     )
 
+    observability: ObservabilityConfiguration = Field(
+        default_factory=ObservabilityConfiguration.from_environment,
+        title="Observability configuration",
+        description="OpenTelemetry and observability configuration collected "
+        "from OTEL_* environment variables.",
+    )
+
     deployment_environment: str = Field(
         "development",
         title="Deployment environment",
diff --git a/tests/integration/endpoints/test_config_integration.py b/tests/integration/endpoints/test_config_integration.py
@@ -88,3 +88,85 @@ async def test_config_endpoint_fails_without_configuration(
     assert "response" in exc_info.value.detail
     detail = cast(dict[str, str], exc_info.value.detail)
     assert "configuration is not loaded" in detail["response"].lower()
+
+
+@pytest.mark.asyncio
+async def test_config_endpoint_includes_observability(
+    current_config: AppConfig,  # pylint: disable=unused-argument
+    test_request: Request,
+    test_auth: AuthTuple,
+) -> None:
+    """Test that config endpoint includes observability configuration.
+
+    This integration test verifies:
+    - Observability field is present in the configuration response
+    - OTEL environment variables are correctly collected
+    - Response structure includes observability.otel block
+
+    Parameters:
+    ----------
+        current_config (AppConfig): Loads root configuration
+        test_request (Request): FastAPI request
+        test_auth (AuthTuple): noop authentication tuple
+    """
+    response = await config_endpoint_handler(auth=test_auth, request=test_request)
+
+    # Verify observability field exists
+    assert hasattr(response.configuration, "observability")
+    assert response.configuration.observability is not None
+
+    # Verify otel field exists
+    assert hasattr(response.configuration.observability, "otel")
+    assert isinstance(response.configuration.observability.otel, dict)
+
+
+@pytest.mark.asyncio
+async def test_config_endpoint_observability_collects_otel_vars(
+    current_config: AppConfig,
+    test_request: Request,
+    test_auth: AuthTuple,
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    """Test that observability config collects OTEL_* environment variables.
+
+    This integration test verifies the full endpoint integration:
+    - OTEL_* environment variables are collected into observability.otel
+    - Configuration reload picks up new environment variables
+    - Endpoint response includes the updated observability configuration
+
+    Parameters:
+    ----------
+        current_config (AppConfig): Loads root configuration
+        test_request (Request): FastAPI request
+        test_auth (AuthTuple): noop authentication tuple
+        monkeypatch (pytest.MonkeyPatch): Fixture to modify environment variables
+    """
+    # pylint: disable=import-outside-toplevel
+    from pathlib import Path
+
+    # Set OTEL environment variables
+    monkeypatch.setenv("OTEL_SDK_DISABLED", "true")
+    monkeypatch.setenv("OTEL_SERVICE_NAME", "test-service")
+    monkeypatch.setenv("OTEL_EXPORTER_OTLP_ENDPOINT", "http://localhost:4317")
+
+    # Reload configuration to pick up new env vars
+    # The observability field is populated via from_environment() during config load
+    config_path = Path(__file__).parent.parent.parent.parent / "lightspeed-stack.yaml"
+    current_config.load_configuration(str(config_path))
+
+    # Call the actual endpoint handler to test full integration
+    response = await config_endpoint_handler(auth=test_auth, request=test_request)
+
+    # Verify that the endpoint response includes observability configuration
+    assert hasattr(response.configuration, "observability")
+    assert response.configuration.observability is not None
+    assert hasattr(response.configuration.observability, "otel")
+
+    # Verify OTEL vars are present in the endpoint response
+    otel_config = response.configuration.observability.otel
+    assert "OTEL_SDK_DISABLED" in otel_config
+    assert otel_config["OTEL_SDK_DISABLED"] == "true"
+    assert "OTEL_SERVICE_NAME" in otel_config
+    assert otel_config["OTEL_SERVICE_NAME"] == "test-service"
+    assert "OTEL_EXPORTER_OTLP_ENDPOINT" in otel_config
+    assert otel_config["OTEL_EXPORTER_OTLP_ENDPOINT"] == "http://localhost:4317"
diff --git a/tests/unit/models/config/test_dump_configuration.py b/tests/unit/models/config/test_dump_configuration.py
@@ -4,9 +4,11 @@
 # pyright: reportCallIssue=false
 
 import json
+import os
 from pathlib import Path
 from typing import Any
 
+import pytest
 from pydantic import SecretStr
 
 import constants
@@ -52,6 +54,26 @@
 }
 
 
+@pytest.fixture(name="clear_otel_env", autouse=True)
+def clear_otel_env_fixture(monkeypatch: pytest.MonkeyPatch) -> None:
+    """Clear OTEL_* environment variables to prevent ambient leakage in tests.
+
+    This fixture ensures dump configuration tests have stable expectations
+    regardless of whether they run on instrumented CI runners.
+    """
+    for key in list(os.environ.keys()):
+        if key.startswith("OTEL_"):
+            monkeypatch.delenv(key, raising=False)
+
+
+def _get_expected_observability_dump() -> dict[str, dict[str, str]]:
+    """Get expected observability dump based on current environment.
+
+    Returns empty otel dict when OTEL_* vars are cleared by fixture.
+    """
+    return {"otel": {}}
+
+
 def test_dump_configuration_minimal_cfg(tmp_path: Path) -> None:
     """
     Test that the Configuration object can be serialized to a JSON file and
@@ -232,6 +254,7 @@ def test_dump_configuration_minimal_cfg(tmp_path: Path) -> None:
                 "quota_subject": None,
             },
             "splunk": None,
+            "observability": _get_expected_observability_dump(),
             "deployment_environment": "development",
             "reranker": {
                 "enabled": False,
@@ -459,6 +482,7 @@ def test_dump_configuration_valid_values(tmp_path: Path) -> None:
                 "quota_subject": None,
             },
             "splunk": None,
+            "observability": _get_expected_observability_dump(),
             "deployment_environment": "development",
             "reranker": {
                 "enabled": False,
@@ -837,6 +861,7 @@ def test_dump_configuration_with_quota_limiters(tmp_path: Path) -> None:
                 "quota_subject": None,
             },
             "splunk": None,
+            "observability": _get_expected_observability_dump(),
             "deployment_environment": "development",
             "reranker": {
                 "enabled": False,
@@ -1099,6 +1124,7 @@ def test_dump_configuration_with_quota_limiters_different_values(
                 "quota_subject": None,
             },
             "splunk": None,
+            "observability": _get_expected_observability_dump(),
             "deployment_environment": "development",
             "reranker": {
                 "enabled": False,
@@ -1394,6 +1420,7 @@ def test_dump_configuration_byok(tmp_path: Path) -> None:
                 "quota_subject": None,
             },
             "splunk": None,
+            "observability": _get_expected_observability_dump(),
             "deployment_environment": "development",
             "reranker": {
                 "enabled": False,
@@ -1616,6 +1643,7 @@ def test_dump_configuration_pg_namespace(tmp_path: Path) -> None:
                 "quota_subject": None,
             },
             "splunk": None,
+            "observability": _get_expected_observability_dump(),
             "deployment_environment": "development",
             "reranker": {
                 "enabled": False,
@@ -1998,6 +2026,7 @@ def test_dump_configuration_allow_degraded_mode(tmp_path: Path) -> None:
                 "quota_subject": None,
             },
             "splunk": None,
+            "observability": _get_expected_observability_dump(),
             "deployment_environment": "development",
             "reranker": {
                 "enabled": False,
@@ -2226,6 +2255,7 @@ def test_dump_configuration_max_retries_settings(tmp_path: Path) -> None:
                 "quota_subject": None,
             },
             "splunk": None,
+            "observability": _get_expected_observability_dump(),
             "deployment_environment": "development",
             "reranker": {
                 "enabled": False,
@@ -2454,6 +2484,7 @@ def test_dump_configuration_retry_count_settings(tmp_path: Path) -> None:
                 "quota_subject": None,
             },
             "splunk": None,
+            "observability": _get_expected_observability_dump(),
             "deployment_environment": "development",
             "reranker": {
                 "enabled": False,
@@ -2689,6 +2720,7 @@ def test_dump_configuration_specific_compaction_values(tmp_path: Path) -> None:
                 "quota_subject": None,
             },
             "splunk": None,
+            "observability": _get_expected_observability_dump(),
             "deployment_environment": "development",
             "reranker": {
                 "enabled": False,
diff --git a/tests/unit/models/config/test_observability_configuration.py b/tests/unit/models/config/test_observability_configuration.py

Original file line number	Diff line number	Diff line change
`@@ -87,6 +87,15 @@ class ConfigurationResponse(AbstractSuccessfulResponse):`
`87`	`87`	`"scheduler": {"period": 1},`
`88`	`88`	`"enable_token_history": False,`
`89`	`89`	`},`
	`90`	`+ "observability": {`
	`91`	`+ "otel": {`
	`92`	`+ "OTEL_SDK_DISABLED": "true",`
	`93`	`+ "OTEL_EXPORTER_OTLP_ENDPOINT": "",`
	`94`	`+ "OTEL_EXPORTER_OTLP_PROTOCOL": "",`
	`95`	`+ "OTEL_SERVICE_NAME": "",`
	`96`	`+ "OTEL_EXPORTER_OTLP_HEADERS": "[REDACTED]",`
	`97`	`+ }`
	`98`	`+ },`
`90`	`99`	`}`
`91`	`100`	`}`
`92`	`101`	`]`