What leaves your network

An orchestrator sends telemetry to a hosted plane only when -hostedplane-endpoint is set. Without it there is no telemetry agent at all. Everything else an orchestrator or a witness connects to is a system you name in its configuration: the other voters, your controllers’ targets, your identity provider and your secrets providers.

The flags that turn it on

• -deployment-id string: this deployment’s identifier as known to the hosted plane (defaults to -node-id)
• -hostedplane-ca string: PEM CA certificate(s) to verify the hosted plane’s HTTPS certificate with, instead of the system’s trusted CAs (a hosted plane run with a private CA)
• -hostedplane-endpoint string: hosted control/observability plane’s ingest URL (e.g. https://hostedplane.example.com/v1/ingest), per §58. Empty (the default) runs with no telemetry shipping agent at all — not merely a disconnected one — since §58/Critical Acceptance Test 9 require that severing this be a no-op for local decisions, which is easiest to see is true when there is nothing here to sever in the first place
• -hostedplane-token string: this deployment’s hosted-plane ingest credential, issued by the hosted plane for this deployment (required if -hostedplane-endpoint is set)

What is sent

The agent reads the orchestrator’s audit log and event stream, and only reads them. It sends what it has queued as one HTTPS POST to the -hostedplane-endpoint URL: a JSON array of records, with -hostedplane-token as a bearer token. It reads nothing from the answer but its status. While the plane cannot be reached, records wait in a bounded queue in memory, the oldest dropped first; nothing waits on them. The agent is pkg/telemetry.

A record

The redacted, wire-safe shape of one shipped item — audit and event records flattened to a single common envelope, so the hosted plane and the local queue both handle one schema instead of two.

This is deliberately narrower than audit.Record/events.Event: it excludes audit.Record.Reason (freeform text an operator typed for a force-acquire/force-release, §24 — it could contain anything, including incidental sensitive context that has no business leaving the customer’s own deployment) and both types’ free-text Error/Detail fields beyond a short, bounded copy. “Redacted, scoped” (§58) is enforced here, at the one place every shipped byte passes through, not left to callers to remember.

• deployment_id (string): The deployment the record comes from: the orchestrator’s -deployment-id, or its -node-id.
• kind (string, one of audit, event): “audit” for an audit record, “event” for an event.
• source_id (integer): The audit record’s or the event’s id on the orchestrator.
• timestamp (time, RFC 3339): When the orchestrator recorded it.
• plan_id (string): The availability plan it is about, if any.
• action (string): An audit record’s action, such as plan.failover, or an event’s kind.
• result (string): An audit record’s result, such as success.
• forced (boolean): Whether an audit record’s action was forced.
• detail (string): An audit record’s error, or an event’s detail: when it is longer than 200 bytes, its first 200 and an ellipsis.