feat!: addition of configuration end point

[jot2re]

Description of changes

• Added endpoint for retrieving current configuration of the kms
• Fixes an issue where tls is loaded during recovery mode

To validate run the centralized server (threshold will currently not boot in recovery see here)

cargo run --bin kms-server -- --config-file core/service/config/default_centralized.toml

and run curl http://127.0.0.1:9646/config to see the configuration used as json.

Maybe infra wants to add this to the operator-check tool?

Issue ticket number and link

This closes https://github.com/zama-ai/kms-internal/issues/2891

PR Checklist

I attest that all checked items are satisfied. Any deviation is clearly justified above.

• Title follows conventional commits (e.g. chore: ...).
• Tests added for every new pub item and test coverage has not decreased.
• Public APIs and non-obvious logic documented; unfinished work marked as TODO(#issue).
• unwrap/expect/panic only in tests or for invariant bugs (documented if present).
• No dependency version changes OR (if changed) only minimal required fixes.
• No architectural protocol changes OR linked spec PR/issue provided.
• No breaking deployment config changes OR devops label + infra notified + infra-team reviewer assigned.
• No breaking gRPC / serialized data changes OR commit marked with ! and affected teams notified.
• No modifications to existing versionized structs OR backward compatibility tests updated.
• No critical business logic / crypto changes OR ≥2 reviewers assigned.
• No new sensitive data fields added OR Zeroize + ZeroizeOnDrop implemented.
• No new public storage data OR data is verifiable (signature / digest).
• No unsafe; if unavoidable: minimal, justified, documented, and test/fuzz covered.
• Strongly typed boundaries: typed inputs validated at the edge; no untyped values or errors cross modules.
• Self-review completed.

Dependency Update Questionnaire (only if deps changed or added)

Answer in the Cargo.toml next to the dependency (or here if updating):

1. Ownership changes or suspicious concentration?
2. Low popularity?
3. Unusual version jump?
4. Lacking documentation?
5. Missing CI?
6. No security / disclosure policy?
7. Significant size increase?

More details and explanations for the checklist and dependency updates can be found in CONTRIBUTING.md

[Copilot]

Pull request overview

Adds an operational endpoint to introspect the KMS runtime configuration and adjusts startup behavior so TLS isn’t initialized in threshold recovery mode (when the signing key is unavailable), improving recoverability and troubleshooting.

Changes:

• Added a /config HTTP route on the telemetry/metrics server to return the currently loaded configuration as JSON.
• Refactored telemetry initialization to accept a full config object (via ConfigTracing) instead of only TelemetryConfig.
• Prevented TLS identity initialization in threshold recovery mode; updated troubleshooting docs and clarified TLS cert file error messages.

Reviewed changes

Copilot reviewed 4 out of 5 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
observability/src/telemetry.rs	Adds /config handler and stores serialized config in metrics state; updates telemetry init APIs to accept a full config via ConfigTracing.
docs/operations/advanced/troubleshooting.md	Documents additional troubleshooting endpoints (/version, /config).
core/service/src/conf/threshold.rs	Improves error message when TLS cert file can’t be read.
core/service/src/conf/mod.rs	Moves ConfigTracing usage to observability and updates telemetry init call site accordingly.
core/service/src/bin/kms-server.rs	Skips TLS identity initialization when running threshold in recovery mode (no signing key).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[github-actions]

Consolidated Tests Results 2026-02-25 - 11:33:06

Test Results

14 passed

Details

14 tests
not captured
junit-to-ctrf
build-and-test test-reporter #574
feat!: addition of configuration end point #425

test-reporter: Run #574

Tests 📝	Passed ✅	Failed ❌	Skipped ⏭️	Pending ⏳	Other ❓	Flaky 🍂	Duration ⏱️
14	14	0	0	0	0	0	not captured

🎉 All tests passed!

Tests

View All Tests

Test Name	Status	Flaky	Duration
full_gen_tests_k8s_default_threshld_sequential_crs	✅		32.3s
test_k8s_threshld_insecure	✅		3m 13s
k8s_test_crs_uniqueness	✅		32.3s
k8s_test_keygen_and_crs	✅		3m 14s
k8s_test_keygen_uniqueness	✅		8m 54s
full_gen_tests_k8s_default_threshld_sequential_crs	✅		32.8s
test_k8s_threshld_insecure	✅		3m 15s
k8s_test_crs_uniqueness	✅		33.1s
k8s_test_keygen_and_crs	✅		3m 13s
k8s_test_keygen_uniqueness	✅		8m 57s
full_gen_tests_k8s_default_centralzd_sequential_crs	✅		1.8s
test_k8s_centralzd_insecure	✅		1m 3s
full_gen_tests_default_k8s_centralized_sequential_crs	✅		1.8s
k8s_test_centralized_insecure	✅		1m 1s

_{🍂 No flaky tests in this run.}

Github Test Reporter by CTRF 💚

🔄 This comment has been updated

[dd23]

Great! LGTM, besides one small remark.