# Observability plugins for the AI gateway.
#
# The five business domains get these from k8s-platform's
# dataplane-globalpolicy-template, but that template also carries
# openid-connect, rate-limiting and cors — all of which this gateway already
# defines its own AI-specific versions of. Applying it here would duplicate
# them, so the three observability plugins are declared locally instead,
# with the same configuration as the shared template.
apiVersion: configuration.konghq.com/v1
kind: KongPlugin
metadata:
  name: ${NAME}-llm-prometheus
  namespace: ${NAMESPACE}
plugin: prometheus
config:
  status_code_metrics: true
  latency_metrics: true
  bandwidth_metrics: true
  upstream_health_metrics: true
---
apiVersion: configuration.konghq.com/v1
kind: KongPlugin
metadata:
  name: ${NAME}-llm-opentelemetry
  namespace: ${NAMESPACE}
plugin: opentelemetry
config:
  traces_endpoint: ${OTEL_TRACES_ENDPOINT}
  resource_attributes:
    service.name: ${NAME}
  sampling_rate: 1
  http_response_header_for_traceid: X-Trace-Id
---
apiVersion: configuration.konghq.com/v1
kind: KongPlugin
metadata:
  name: ${NAME}-llm-audit-log
  namespace: ${NAMESPACE}
# dev only: the raw Authorization header is captured in clear text, which is
# not acceptable as-is outside dev.
plugin: http-log
config:
  http_endpoint: ${AUDIT_LOG_ENDPOINT}
  method: POST
  content_type: application/json
---
# prometheus and opentelemetry are bound control-plane-wide, matching the
# shared template: they describe the gateway itself, not one service.
apiVersion: configuration.konghq.com/v1alpha1
kind: KongPluginBinding
metadata:
  name: ${NAME}-llm-prometheus-binding
  namespace: ${NAMESPACE}
spec:
  controlPlaneRef:
    type: konnectNamespacedRef
    konnectNamespacedRef:
      name: ${CONTROL_PLANE_REF_NAME}
  pluginRef:
    name: ${NAME}-llm-prometheus
  scope: GlobalInControlPlane
---
apiVersion: configuration.konghq.com/v1alpha1
kind: KongPluginBinding
metadata:
  name: ${NAME}-llm-opentelemetry-binding
  namespace: ${NAMESPACE}
spec:
  controlPlaneRef:
    type: konnectNamespacedRef
    konnectNamespacedRef:
      name: ${CONTROL_PLANE_REF_NAME}
  pluginRef:
    name: ${NAME}-llm-opentelemetry
  scope: GlobalInControlPlane
---
# The audit log is bound to the proxy service, like the business domains bind
# theirs, so only real gateway traffic is captured.
apiVersion: configuration.konghq.com/v1alpha1
kind: KongPluginBinding
metadata:
  name: ${NAME}-llm-audit-log-binding
  namespace: ${NAMESPACE}
spec:
  controlPlaneRef:
    type: konnectNamespacedRef
    konnectNamespacedRef:
      name: ${CONTROL_PLANE_REF_NAME}
  pluginRef:
    name: ${NAME}-llm-audit-log
  targets:
    serviceRef:
      group: configuration.konghq.com
      kind: KongService
      name: ${NAME}-llm-proxy