fix(tracing): Add KONG_TRACING environment variables to gatewayconfiguration template

dataplane-globalpolicy-template/global-policies-plugins.yaml

@@ -1,9 +1,3 @@
-# Global (per-domain-CP) baseline policies — security, API behavior
-# consistency, observability. Bound via global-policies-pluginbindings.yaml
-# with scope: GlobalInControlPlane (applies to all traffic in this domain's
-# Control Plane, no per-route/service target needed — verified mechanism,
-# see ~/dev/kong/kube/apis/tasks-api/pluginbindings.yaml's
-# tasks-rate-limiting-global-binding).
 apiVersion: configuration.konghq.com/v1
 kind: KongPlugin
 metadata:
@@ -12,28 +6,10 @@ metadata:
 plugin: openid-connect
 config:
   issuer: ${OIDC_ISSUER}
-  # Whitelist of every audience valid anywhere in this domain, not one
-  # audience — a domain can expose several APIs, each with its own audience.
-  # This global check only proves "this token belongs to *some* API of this
-  # domain, minted by our IdP" — narrowing to the *specific* API's own
-  # audience happens again at that API's own KongService/Route (defense in
-  # depth: two independent openid-connect instances, Kong runs both on every
-  # request, verified — see STATUS.md). JWT_AUDIENCE_WHITELIST is a single
-  # var holding the whole YAML flow-sequence as a string (e.g.
-  # '["catalog-api", "catalog-mcp"]') because postBuild.substitute does
-  # plain text substitution, not list generation — grows as the domain gains
-  # APIs, set in policies-kustomization.yaml, not here.
   audience_required: ${JWT_AUDIENCE_WHITELIST}
   auth_methods:
     - bearer
-  display_errors: false # never leak IdP/token internals in error responses
-  # Every domain's Control Plane enforces a global tls_certificate_verify
-  # option (Konnect-side) that rejects plugin instances with TLS verification
-  # off. openid-connect defaults to ssl_verify: false, which silently broke
-  # DataPlane config sync entirely (verified via pod logs: "ssl_verify cannot
-  # be disabled" — the DataPlane never applied ANY config past this plugin,
-  # not just this domain's, until fixed). Explicit true is also the correct
-  # choice on its own merits: verify the issuer's cert when fetching JWKS.
+  display_errors: false
   ssl_verify: true
 ---
 apiVersion: configuration.konghq.com/v1
@@ -88,12 +64,6 @@ config:
   generator: uuid
   echo_downstream: true
 ---
-# Hides whatever the backend actually returned on 5xx (stack traces, DB
-# errors, etc.) behind a standard body. Only covers responses from a
-# successfully-contacted backend ("service"-origin errors) — Kong's own
-# generated errors (502/503/504 before reaching the backend, timeouts) are
-# NOT covered by this plugin, that's the exit-transformer / Enterprise
-# question still pending.
 apiVersion: configuration.konghq.com/v1
 kind: KongPlugin
 metadata:
@@ -131,3 +101,5 @@ config:
   traces_endpoint: ${OTEL_TRACES_ENDPOINT}
   resource_attributes:
     service.name: ${NAME}
+  sampling_rate: 1
+  http_response_header_for_traceid: X-Trace-Id