feat(helm): add OpenTelemetry export configuration

deployments/helm/gate/README.md

@@ -373,6 +373,37 @@ GATE also logs the FIPS status at startup, which can be verified in pod logs:
 kubectl logs -l app.kubernetes.io/name=gate -n gate | grep "FIPS 140-3"
 ```
 
+### OpenTelemetry
+
+GATE can export traces, metrics, and logs to an OpenTelemetry collector via OTLP/gRPC. Application logs continue to be written to stdout regardless.
+
+Enable export in your values, pointing at a reachable collector:
+
+```yaml
+config:
+  otel:
+    enabled: true
+    endpoint: "otel-collector.observability.svc:4317"
+    serviceName: "gate"
+    insecure: false       # set true only for in-cluster collectors on a trusted network
+    sampleRate: 1.0       # 1.0 samples all spans; lower to e.g. 0.1 in high-volume environments
+    exporterTimeout: "10s"
+```
+
+When `networkPolicy.enabled=true`, also add an egress rule for the collector port. There is a commented example in `values.yaml`:
+
+```yaml
+networkPolicy:
+  egress:
+    - to:
+        - namespaceSelector: {}
+      ports:
+        - protocol: TCP
+          port: 4317   # OTLP/gRPC (only protocol currently supported)
+```
+
+If `otel.enabled=true` is set without an `endpoint`, the application fails validation at startup. The endpoint must be `host:port` without a scheme — TLS behavior is controlled by `insecure`.
+
 ### Resource limits
 
 Adjust CPU and memory based on your expected load. The defaults are conservative starting points:
@@ -666,6 +697,18 @@ externalSecrets:
 | `config.fips.enabled` | Enable FIPS 140-3 mode (requires FIPS-compiled image) | `false` |
 | `config.fips.mode` | FIPS mode: `on` or `only` | `on` |
 
+### OpenTelemetry parameters
+
+| Parameter | Description | Default |
+|-----------|-------------|---------|
+| `config.otel.enabled` | Enable OpenTelemetry export (traces, metrics, logs) via OTLP/gRPC | `false` |
+| `config.otel.serviceName` | `service.name` resource attribute | `gate` |
+| `config.otel.endpoint` | OTLP/gRPC collector endpoint, `host:port` (required when enabled) | `""` |
+| `config.otel.protocol` | OTLP transport protocol (only `grpc` supported) | `grpc` |
+| `config.otel.insecure` | Disable TLS to the collector (in-cluster only) | `false` |
+| `config.otel.sampleRate` | Trace sampling ratio (0.0–1.0) | `1.0` |
+| `config.otel.exporterTimeout` | OTLP exporter timeout (Go duration) | `10s` |
+
 ### GitHub Apps parameters
 
 | Parameter | Description | Default |

deployments/helm/gate/templates/configmap.yaml

@@ -143,6 +143,18 @@ data:
       mode: {{ .Values.config.fips.mode | quote }}
     {{- end }}
 
+    {{- if .Values.config.otel.enabled }}
+    # OpenTelemetry configuration
+    otel:
+      enabled: true
+      service_name: {{ .Values.config.otel.serviceName | quote }}
+      endpoint: {{ .Values.config.otel.endpoint | quote }}
+      protocol: {{ .Values.config.otel.protocol | quote }}
+      insecure: {{ .Values.config.otel.insecure }}
+      sample_rate: {{ .Values.config.otel.sampleRate }}
+      exporter_timeout: {{ .Values.config.otel.exporterTimeout | quote }}
+    {{- end }}
+
     # GitHub Apps configuration
     # Private keys mounted from secret at /secrets/github-apps/app-N.pem
     github_apps:

deployments/helm/gate/values.schema.json

@@ -796,6 +796,45 @@
             }
           }
         },
+        "otel": {
+          "type": "object",
+          "description": "OpenTelemetry export pipeline (OTLP/gRPC) for traces, metrics, and logs",
+          "properties": {
+            "enabled": {
+              "type": "boolean",
+              "description": "Enable OpenTelemetry export"
+            },
+            "serviceName": {
+              "type": "string",
+              "description": "service.name resource attribute reported to the collector"
+            },
+            "endpoint": {
+              "type": "string",
+              "description": "OTLP/gRPC collector endpoint (host:port, no scheme). Required when enabled=true"
+            },
+            "protocol": {
+              "type": "string",
+              "enum": [
+                "grpc"
+              ],
+              "description": "OTLP transport protocol (only grpc is supported)"
+            },
+            "insecure": {
+              "type": "boolean",
+              "description": "Disable TLS to the collector (in-cluster only)"
+            },
+            "sampleRate": {
+              "type": "number",
+              "minimum": 0.0,
+              "maximum": 1.0,
+              "description": "Trace sampling ratio (0.0-1.0); 1.0 samples all spans"
+            },
+            "exporterTimeout": {
+              "type": "string",
+              "description": "OTLP exporter timeout (Go duration, e.g. 10s)"
+            }
+          }
+        },
         "oidc": {
           "type": "object",
           "description": "OIDC validation configuration",

deployments/helm/gate/values.yaml

@@ -220,6 +220,13 @@ networkPolicy:
     #   ports:
     #     - protocol: TCP
     #       port: 5432
+    # Uncomment if using OpenTelemetry export (otel.enabled=true)
+    # The chart only supports OTLP/gRPC on port 4317.
+    # - to:
+    #     - namespaceSelector: {}
+    #   ports:
+    #     - protocol: TCP
+    #       port: 4317
 
 # -----------------------------------------------------------------------------
 # Health Probes
@@ -311,6 +318,35 @@ config:
     #   algorithms (RS256, ES256, PS256, etc.) before enabling this mode.
     mode: "on"
 
+  # ---------------------------------------------------------------------------
+  # OpenTelemetry (traces, metrics, logs)
+  # ---------------------------------------------------------------------------
+  # When enabled, GATE exports traces, metrics, and logs to an OTLP/gRPC
+  # collector. Logs continue to be written to stdout regardless.
+  #
+  # The collector is expected to be reachable from the pod — typically an
+  # in-cluster collector (e.g., otel-collector.observability.svc:4317) or a
+  # node-local DaemonSet. If your cluster has NetworkPolicies enabled, add
+  # an egress rule (see networkPolicy.egress example below) so pods can
+  # reach the collector port (default 4317 for OTLP/gRPC).
+  otel:
+    # Enable the OpenTelemetry export pipeline
+    enabled: false
+    # service.name resource attribute reported to the collector
+    serviceName: "gate"
+    # OTLP/gRPC collector endpoint (host:port, no scheme)
+    # REQUIRED when enabled=true — no default to force explicit configuration
+    endpoint: ""
+    # OTLP transport protocol — only "grpc" is currently supported
+    protocol: "grpc"
+    # Disable TLS to the collector
+    # Set true only for in-cluster collectors on a trusted network
+    insecure: false
+    # Trace sampling ratio (0.0-1.0). 1.0 = sample all spans
+    sampleRate: 1.0
+    # OTLP exporter timeout
+    exporterTimeout: "10s"
+
   # ---------------------------------------------------------------------------
   # OIDC configuration
   # ---------------------------------------------------------------------------