refactor(api): remove spec.trace from AgentRuntime CRD

README.md

@@ -274,7 +274,7 @@ kubectl logs -l app.kubernetes.io/name=weather-agent
 See the [config/samples](./kagenti-operator/config/samples) directory for AgentRuntime examples:
 
 - [`agent_v1alpha1_agentruntime_basic.yaml`](./kagenti-operator/config/samples/agent_v1alpha1_agentruntime_basic.yaml) — Minimal AgentRuntime with type + targetRef
-- [`agent_v1alpha1_agentruntime_full.yaml`](./kagenti-operator/config/samples/agent_v1alpha1_agentruntime_full.yaml) — With SPIFFE trust domain and OTEL trace overrides
+- [`agent_v1alpha1_agentruntime_full.yaml`](./kagenti-operator/config/samples/agent_v1alpha1_agentruntime_full.yaml) — With SPIFFE trust domain override and OCI skill images
 - [`agent_v1alpha1_agentruntime_tool.yaml`](./kagenti-operator/config/samples/agent_v1alpha1_agentruntime_tool.yaml) — Tool-type workload (MCP server)
 
 ## Contributing

charts/kagenti-operator/crds/agent.kagenti.dev_agentruntimes.yaml

@@ -43,8 +43,8 @@
       openAPIV3Schema:
         description: |-
           AgentRuntime attaches runtime configuration to a backing workload classified as an
-          agent or tool, providing per-workload overrides for SPIFFE identity and OpenTelemetry
-          tracing. The controller reports pod configuration coverage and phase in status.
+          agent or tool, providing per-workload overrides for SPIFFE identity.
+          The controller reports pod configuration coverage and phase in status.
         properties:
           apiVersion:
             description: |-
@@ -228,30 +228,6 @@
                 - kind
                 - name
                 type: object
-              trace:
-                description: Trace specifies optional per-workload observability overrides
-                properties:
-                  endpoint:
-                    description: Endpoint is the OTEL collector endpoint override
-                    type: string
-                  protocol:
-                    description: Protocol is the OTEL export protocol (grpc or http)
-                    enum:
-                    - grpc
-                    - http
-                    type: string
-                  sampling:
-                    description: Sampling specifies trace sampling configuration
-                    properties:
-                      rate:
-                        description: Rate is the sampling rate (0.0-1.0)
-                        maximum: 1
-                        minimum: 0
-                        type: number
-                    required:
-                    - rate
-                    type: object
-                type: object
               type:
                 description: Type classifies the workload as an agent or tool
                 enum:
@@ -488,7 +464,7 @@
                     lastTransitionTime:
                       description: |-
                         lastTransitionTime is the last time the condition transitioned from one status to another.
                         This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
                       format: date-time
                       type: string
                     message:
@@ -500,7 +476,7 @@
                     observedGeneration:
                       description: |-
                         observedGeneration represents the .metadata.generation that the condition was set based upon.
                         For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
                         with respect to the current state of the instance.
                       format: int64
                       minimum: 0

kagenti-operator/GETTING_STARTED.md

@@ -156,16 +156,14 @@ kubectl get pods -n team1 -l kagenti.io/type=agent -o jsonpath='{.items[0].spec.
 
 ### Updating Configuration
 
-When you update the AgentRuntime CR (e.g., changing the trust domain or trace endpoint), the controller recomputes the config hash and triggers a rolling update automatically:
+When you update the AgentRuntime CR (e.g., changing the trust domain), the controller recomputes the config hash and triggers a rolling update automatically:
 
 ```bash
 kubectl patch agentruntime weather-agent-runtime -n team1 --type merge -p '
 spec:
-  trace:
-    endpoint: otel-collector.observability.svc.cluster.local:4317
-    protocol: grpc
-    sampling:
-      rate: 0.5
+  identity:
+    spiffe:
+      trustDomain: custom.example.com
 '
 ```
 

kagenti-operator/api/v1alpha1/agentruntime_types.go

@@ -37,14 +37,6 @@ const (
 	RuntimePhaseError   RuntimePhase = "Error"
 )
 
-// +kubebuilder:validation:Enum=grpc;http
-type TraceProtocol string
-
-const (
-	TraceProtocolGRPC TraceProtocol = "grpc"
-	TraceProtocolHTTP TraceProtocol = "http"
-)
-
 // AgentRuntimeSpec defines the desired state of AgentRuntime.
 type AgentRuntimeSpec struct {
 	// Type classifies the workload as an agent or tool
@@ -57,10 +49,6 @@ type AgentRuntimeSpec struct {
 	// +optional
 	Identity *IdentitySpec `json:"identity,omitempty"`
 
-	// Trace specifies optional per-workload observability overrides
-	// +optional
-	Trace *TraceSpec `json:"trace,omitempty"`
-
 	// AuthBridgeMode selects the deployment shape for this workload's
 	// authbridge sidecar. When unset, the namespace-level
 	// authbridge-runtime-config ConfigMap's mode is used; if that is
@@ -159,29 +147,6 @@ type SPIFFEIdentity struct {
 	TrustDomain string `json:"trustDomain,omitempty"`
 }
 
-// TraceSpec configures observability for an AgentRuntime.
-type TraceSpec struct {
-	// Endpoint is the OTEL collector endpoint override
-	// +optional
-	Endpoint string `json:"endpoint,omitempty"`
-
-	// Protocol is the OTEL export protocol (grpc or http)
-	// +optional
-	Protocol TraceProtocol `json:"protocol,omitempty"`
-
-	// Sampling specifies trace sampling configuration
-	// +optional
-	Sampling *SamplingSpec `json:"sampling,omitempty"`
-}
-
-// SamplingSpec configures trace sampling for an AgentRuntime.
-type SamplingSpec struct {
-	// Rate is the sampling rate (0.0-1.0)
-	// +kubebuilder:validation:Minimum=0
-	// +kubebuilder:validation:Maximum=1
-	Rate float64 `json:"rate"`
-}
-
 // CardStatus holds the fetched A2A agent card data along with fetch metadata
 // and optional verification results. Populated by the card discovery phase when
 // --enable-card-discovery is set.
@@ -281,8 +246,8 @@ type AgentRuntimeStatus struct {
 // +kubebuilder:printcolumn:name="Age",type="date",JSONPath=".metadata.creationTimestamp"
 
 // AgentRuntime attaches runtime configuration to a backing workload classified as an
-// agent or tool, providing per-workload overrides for SPIFFE identity and OpenTelemetry
-// tracing. The controller reports pod configuration coverage and phase in status.
+// agent or tool, providing per-workload overrides for SPIFFE identity.
+// The controller reports pod configuration coverage and phase in status.
 type AgentRuntime struct {
 	metav1.TypeMeta   `json:",inline"`
 	metav1.ObjectMeta `json:"metadata,omitempty"`

kagenti-operator/config/crd/bases/agent.kagenti.dev_agentruntimes.yaml

@@ -43,8 +43,8 @@ spec:
       openAPIV3Schema:
         description: |-
           AgentRuntime attaches runtime configuration to a backing workload classified as an
-          agent or tool, providing per-workload overrides for SPIFFE identity and OpenTelemetry
-          tracing. The controller reports pod configuration coverage and phase in status.
+          agent or tool, providing per-workload overrides for SPIFFE identity.
+          The controller reports pod configuration coverage and phase in status.
         properties:
           apiVersion:
             description: |-
@@ -228,30 +228,6 @@ spec:
                 - kind
                 - name
                 type: object
-              trace:
-                description: Trace specifies optional per-workload observability overrides
-                properties:
-                  endpoint:
-                    description: Endpoint is the OTEL collector endpoint override
-                    type: string
-                  protocol:
-                    description: Protocol is the OTEL export protocol (grpc or http)
-                    enum:
-                    - grpc
-                    - http
-                    type: string
-                  sampling:
-                    description: Sampling specifies trace sampling configuration
-                    properties:
-                      rate:
-                        description: Rate is the sampling rate (0.0-1.0)
-                        maximum: 1
-                        minimum: 0
-                        type: number
-                    required:
-                    - rate
-                    type: object
-                type: object
               type:
                 description: Type classifies the workload as an agent or tool
                 enum:

kagenti-operator/config/samples/agent_v1alpha1_agentruntime_basic.yaml

@@ -1,6 +1,6 @@
 # Basic AgentRuntime: enroll a Deployment as an agent with default configuration.
 # The controller applies kagenti.io/type label and triggers sidecar injection.
-# Identity and trace settings come from cluster and namespace defaults.
+# Identity settings come from cluster and namespace defaults.
 # Note: The target Deployment should have a protocol.kagenti.io/a2a label
 # for automatic AgentCard creation and agent discovery.
 apiVersion: agent.kagenti.dev/v1alpha1

kagenti-operator/config/samples/agent_v1alpha1_agentruntime_full.yaml

@@ -1,6 +1,6 @@
 # Full AgentRuntime: enroll a Deployment as an agent with per-workload overrides.
-# Overrides the SPIFFE trust domain, configures OTEL trace collection, and
-# mounts OCI skill images (requires skillImageVolumes feature gate + K8s 1.31+).
+# Overrides the SPIFFE trust domain, and mounts OCI skill images
+# (requires skillImageVolumes feature gate + K8s 1.31+).
 apiVersion: agent.kagenti.dev/v1alpha1
 kind: AgentRuntime
 metadata:
@@ -17,11 +17,6 @@ spec:
   identity:
     spiffe:
       trustDomain: custom.example.com
-  trace:
-    endpoint: otel-collector.observability.svc.cluster.local:4317
-    protocol: grpc
-    sampling:
-      rate: 0.1
   skills:
     - name: weather-forecast
       image: ghcr.io/redhat-et/skillimage/weather-forecast:v1.0.0

kagenti-operator/config/samples/agent_v1alpha1_agentruntime_tool.yaml

@@ -13,8 +13,3 @@ spec:
     apiVersion: apps/v1
     kind: Deployment
     name: calculator-tool
-  trace:
-    endpoint: otel-collector.observability.svc.cluster.local:4318
-    protocol: http
-    sampling:
-      rate: 1.0

kagenti-operator/docs/api-reference.md

@@ -378,7 +378,7 @@ For Deployments and StatefulSets to be automatically discovered by the operator,
 
 ## AgentRuntime
 
-The `AgentRuntime` Custom Resource configures identity (SPIFFE) and observability (OTEL traces) for agent and tool workloads. Unlike AgentCard, which handles discovery and metadata fetching, AgentRuntime provides runtime configuration for workload identity and telemetry.
+The `AgentRuntime` Custom Resource configures identity (SPIFFE) for agent and tool workloads. Unlike AgentCard, which handles discovery and metadata fetching, AgentRuntime provides runtime configuration for workload identity.
 
 ### API Group and Version
 
@@ -392,15 +392,15 @@ The `AgentRuntime` Custom Resource configures identity (SPIFFE) and observabilit
 AgentRuntime and AgentCard serve complementary purposes:
 
 - **AgentCard**: Fetches and stores agent metadata (capabilities, skills, endpoints) for dynamic discovery. Handles signature verification and identity binding validation.
-- **AgentRuntime**: Configures identity (SPIFFE trust domain) and observability (OTEL trace endpoints, sampling) for running workloads.
+- **AgentRuntime**: Configures identity (SPIFFE trust domain) for running workloads.
 
 Both resources use the shared `TargetRef` type to reference the backing workload (Deployment, StatefulSet, etc.).
 
 ### Configuration Precedence
 
 The controller merges configuration from three layers (highest priority wins):
 
-1. **AgentRuntime CR spec** — per-workload overrides (trust domain, trace endpoint, etc.)
+1. **AgentRuntime CR spec** — per-workload overrides (trust domain, etc.)
 2. **Namespace defaults** — ConfigMap with `kagenti.io/defaults=true` label in the workload's namespace
 3. **Cluster defaults** — `kagenti-platform-config` ConfigMap in `kagenti-system`
 
@@ -413,7 +413,6 @@ The controller merges configuration from three layers (highest priority wins):
 | `type` | string | Yes | Classifies the workload as `agent` or `tool` |
 | `targetRef` | [TargetRef](#targetref) | Yes | Identifies the workload backing this runtime (uses the same TargetRef type as AgentCard) |
 | `identity` | [IdentitySpec](#identityspec) | No | Optional per-workload identity overrides |
-| `trace` | [TraceSpec](#tracespec) | No | Optional per-workload observability overrides |
 | `skills` | [][SkillImageRef](#skillimageref) | No | OCI skill images to mount into the agent pod as Kubernetes ImageVolumes. Requires the `skillImageVolumes` feature gate and Kubernetes 1.31+. Max 20 items. |
 
 #### IdentitySpec
@@ -430,22 +429,6 @@ Configures workload identity for an AgentRuntime.
 |-------|------|----------|-------------|
 | `trustDomain` | string | No | Overrides the operator-level `--spire-trust-domain` for this workload. If empty, the operator flag value is used. Must match pattern: `^[a-zA-Z0-9]([a-zA-Z0-9\-\.]*[a-zA-Z0-9])?$` |
 
-#### TraceSpec
-
-Configures observability for an AgentRuntime.
-
-| Field | Type | Required | Description |
-|-------|------|----------|-------------|
-| `endpoint` | string | No | OTEL collector endpoint override |
-| `protocol` | string | No | OTEL export protocol (`grpc` or `http`) |
-| `sampling` | [SamplingSpec](#samplingspec) | No | Trace sampling configuration |
-
-#### SamplingSpec
-
-| Field | Type | Required | Description |
-|-------|------|----------|-------------|
-| `rate` | float | Yes | Sampling rate (0.0-1.0, inclusive) |
-
 #### SkillImageRef
 
 Identifies an OCI skill image to mount into the agent pod as a Kubernetes [ImageVolume](https://kubernetes.io/docs/tasks/configure-pod-container/image-volumes/). Skills are packaged as OCI images following the [skillimage](https://github.com/redhat-et/skillimage) convention (`FROM scratch` with `skill.yaml` + `SKILL.md`).
@@ -551,7 +534,7 @@ spec:
     name: weather-agent
 ```
 
-#### Agent Runtime with Identity and Trace Overrides
+#### Agent Runtime with Identity Overrides
 
 ```yaml
 apiVersion: agent.kagenti.dev/v1alpha1
@@ -568,11 +551,6 @@ spec:
   identity:
     spiffe:
       trustDomain: custom.example.com
-  trace:
-    endpoint: otel-collector.observability.svc.cluster.local:4317
-    protocol: grpc
-    sampling:
-      rate: 0.1
 ```
 
 #### Tool Runtime
@@ -589,11 +567,6 @@ spec:
     apiVersion: apps/v1
     kind: Deployment
     name: calculator-tool
-  trace:
-    endpoint: otel-collector.observability.svc.cluster.local:4318
-    protocol: http
-    sampling:
-      rate: 1.0
 ```
 
 #### Agent Runtime with OCI Skill Images

kagenti-operator/docs/architecture.md

@@ -41,7 +41,7 @@ The Kagenti Operator is a Kubernetes controller that implements the [Operator Pa
 #### AgentRuntime CRD
 - The declarative way to enroll a workload into the Kagenti platform
 - Developer creates an AgentRuntime CR with `targetRef` — the controller applies labels and triggers injection
-- Configures identity (SPIFFE) and observability (OTEL traces) per workload via 3-layer defaults (cluster → namespace → CR)
+- Configures identity (SPIFFE) per workload via 3-layer defaults (cluster → namespace → CR)
 - Uses `targetRef` to reference backing workloads (Deployment, StatefulSet)
 - The `kagenti.io/type` label applied by the controller triggers the webhook's `objectSelector`
 - Developer workloads only need a `protocol.kagenti.io/a2a` label — the controller applies `kagenti.io/type` and `managed-by` labels automatically

kagenti-operator/docs/authbridge-webhook.md

@@ -134,7 +134,7 @@ When the `perWorkloadConfigResolution` feature gate is enabled, the webhook reso
 ```
 ┌──────────────────────────────────────┐
 │ Layer 3: AgentRuntime CR overrides   │  ← highest precedence
-│   (spec.identity, spec.trace)        │
+│   (spec.identity)                    │
 ├──────────────────────────────────────┤
 │ Layer 2: Namespace ConfigMaps        │
 │   (authbridge-config, envoy-config,  │
@@ -178,9 +178,6 @@ When the `perWorkloadConfigResolution` feature gate is enabled, the webhook reso
 |-------------------|---------------------|-------------|
 | `spec.identity.spiffe.trustDomain` | `SpiffeTrustDomain` | SPIFFE trust domain |
 | `spec.identity.clientRegistration.realm` | `KeycloakRealm` | Keycloak realm (future — not yet in CRD) |
-| `spec.trace.endpoint` | `TraceEndpoint` | OpenTelemetry collector endpoint |
-| `spec.trace.protocol` | `TraceProtocol` | `grpc` or `http` |
-| `spec.trace.sampling.rate` | `TraceSamplingRate` | 0.0–1.0 sampling rate |
 
 **Non-overridable fields** (always from PlatformConfig or namespace CMs):
 - Container images, resource limits, proxy ports