[Feature] Add shared OpenTelemetry producer config

[royischoss]

📝 Description

Adds a top-level telemetry: block to the umbrella chart so any service in the bundle can read the same OpenTelemetry producer-side config. Today it wires MLRUN_TELEMETRY__* env vars into mlrun-api via the existing
mlrun-common-env ConfigMap; Nuclio and other services are left for follow-up.

Mirrors the producer side of the MLRun PR (mlrun/mlrun#9668) and the analogous mlefi PR (IG4-2293, #532) on the IG4 side.

Resolution table

How the MLRUN_TELEMETRY__* env vars resolve at render time. All four telemetry.* knobs default to "" (fall back to MLRun's own defaults).

Path	ENABLED	ENDPOINT	INSECURE
Zero config	false	—	—
Collector on (in-cluster)	true	otel-collector.<ns>.svc.cluster.local:4317	omit → MLRun default true (plaintext, correct for in-cluster)
User endpoint (external, collector off)	true	user value	omit → MLRun default true (user must set false for TLS)
User endpoint + collector on	true	user value (wins)	omit → MLRun default true
User endpoint + explicit insecure=false	true	user value	false (TLS)
enabled=true with no collector and no endpoint	false (safety)	—	—

MLRUN_TELEMETRY__INSECURE and MLRUN_TELEMETRY__HEADERS_SECRET_NAME are only emitted when the user supplies a value; otherwise mlrun-api falls back to its own defaults (true and "" respectively). The README includes a TLS callout for the external-endpoint path.

---

🛠️ Changes Made

File	Change
values.yaml	Add top-level telemetry: block (enabled / otlpEndpoint / insecure / headersSecretName), sibling to mlrun: / nuclio:
templates/config/mlrun-env-configmap.yaml	Append MLRUN_TELEMETRY__* keys with resolution + safety logic
README.md	Document the opt-in knobs + truth table + external-endpoint example
Chart.yaml	Bump to 0.12.0-rc.1

---

✅ Checklist

• I have tested the changes in this PR
• I confirmed whether my changes require a change in documentation and if so, I created another PR in MLRun for the relevant documentation.
• I confirmed whether my changes require a changes in QA tests, for example: credentials changes, resources naming change and if so, I updated the relevant Jira ticket for QA.
• I increased the Chart version in charts/mlrun-ce/Chart.yaml.
• I confirmed that the installation works both on a local Docker Desktop environment and on a real cluster when using the required prerequisites.
  • If installation issues were found, I updated the relevant Jira ticket with the issue and steps to reproduce, or updated the prerequisites documentation if the issue is related to missing or outdated prerequisites.
• If needed, update https://github.com/mlrun/ce/blob/development/charts/mlrun-ce/README.md with the relevant installation instructions and version Matrix.
• If needed, update the following values files for multi namespace support:
  • Admin values
  • User values Node Port
  • User values ClusterIP

---

🧪 Testing

Live cluster verification on app1.vmdev232ig4.lab.iguaz.io:
- Test 1 (no OTel): mlrun-common-env ConfigMap shows MLRUN_TELEMETRY__ENABLED: "false"
- Test 2 (OTel enabled): ConfigMap shows ENABLED: "true", OTLP_ENDPOINT: otel-collector.mlrun.svc.cluster.local:4317
- Probe pod with same envFrom: configMapRef: mlrun-common-env receives all three env vars at runtime

---

🔗 References

• Ticket link: https://ecliptos.atlassian.net/browse/CEML-708
• External links:
• Design docs links (Optional):

---

🚨 Breaking Changes?

• Yes (explain below)
• No

---

🔍️ Additional Notes

[davesh0812]

Looks very good overall.
please add some unit tests if you want you can use those tests I added in mlefi :

  - test_telemetry_default_inherits_collector_disabled — default values, expect MLRUN_TELEMETRY__ENABLED: "false", no endpoint key.
  - test_telemetry_inherits_collector_enabled — --set opentelemetry.collector.enabled=true, expect ENABLED: "true" + in-cluster endpoint.
  - test_telemetry_external_endpoint — --set telemetry.enabled=true --set telemetry.otlpEndpoint=external.com:4317 --set opentelemetry.collector.enabled=false, expect endpoint passes through.
  - test_telemetry_safety_force_disable — --set telemetry.enabled=true with collector off and no endpoint, expect ENABLED: "false".
  - test_telemetry_headers_secret_emitted_only_when_enabled — headersSecretName set but enabled=false, expect no HEADERS_SECRET_NAME key.