[sjmiller609]

Summary

Adds a kernel_telemetry_destination resource so the org-level OTLP export destinations that browser sessions send telemetry to can be managed in Terraform alongside projects.

• Attributes: name, endpoint, optional description, optional sensitive headers map; computed id. Import by canonical ID.
• Kernel returns header values redacted, so header values in state come from configuration. Header names are reconciled against the API (case-insensitively), so a header added or removed outside Terraform shows up as a diff. A value changed outside Terraform does not.
• The API patches headers key by key. On update the provider sends only changed headers and deletes removed names with explicit nulls. Re-spelling a header name (authorization → Authorization) does not delete it.
• Runtime delivery-health fields (consecutive_failures, last_export_at, last_error*) are left out to avoid drift.
• A 403 is reported with a hint that destinations need an API key that is not bound to a project.
• Bumps kernel-go-sdk v0.76.0 → v0.99.0. This is the earliest tag whose telemetry destination API matches the current one. Later tags remove ProxyNewParamsTypeDatacenter, which existing tests use.
• Adds the package to the acceptance matrix and workflow, plus docs and an example.

Testing

• go test -short ./..., go vet ./..., gofmt, terraform fmt -check, scripts/check-examples.sh, scripts/check-docs.sh, and scripts/check-markdown-links.sh all pass locally.
• New acceptance test TestAccTelemetryDestinationLifecycle passed against the staging API. It covers: create with headers; update name, endpoint, description and headers with a stable ID; remove all headers; header names verified through the API; no-drift plan; import; destroy with 404 verification.
• The full existing acceptance suite (browser pool, project, and all data sources) also passed against staging on the bumped SDK.
• Manual Terraform CLI run against staging with dev_overrides: apply, no-drift plan, a header added out of band was detected and removed on the next apply, import into empty state, destroy.

---

Note

Medium Risk
New resource manages sensitive OTLP headers and org-scoped credentials (403 if API key is project-bound); SDK bump may affect other provider code paths, though existing acceptance passed on staging.

Overview
Adds kernel_telemetry_destination, a new org-scoped managed resource for OTLP export endpoints (name, endpoint, optional description, sensitive headers), with import by canonical ID. Browser sessions can reference these destinations for telemetry export.

The provider wires TelemetryDestinationService through kernelclient, registers the resource, and bumps kernel-go-sdk from v0.76.0 to v0.99.0. Header handling is tailored to Kernel’s API: values are never returned, so state keeps configured values while reconciling header names case-insensitively; updates patch only changed headers and send explicit nulls to remove dropped keys.

Acceptance CI gains a seventh matrix job for ./internal/resources/telemetrydestination, with cleanup helpers, docs, and an example. Runtime delivery-health fields are intentionally omitted to avoid drift.

^{Reviewed by Cursor Bugbot for commit a99e4bf. Bugbot is set up for automated code reviews on this repo. Configure here.}

[yummybomb]

lgtm, the changes look pretty good:

Non Blocking Nits:

• ID-shaped names fail only at apply. The API rejects names matching ^[a-z0-9]{24}$, and the provider has no matching validator.
• Import by name fails after import. The API's GET accepts a name, and Read then fails on the ID mismatch. kernel_project does the same thing, with the same "imported by name, re-import by ID" message.
• 409s get no hint. Rename returns 409 while a managed auth connection selects the destination by name. Delete returns 409 in more cases than I listed: browser sessions still bound to it, a managed auth connection still selecting it, or a managed auth login using it still in progress.

[sjmiller609]

thanks @yummybomb

• id-shaped names: fixed in a99e4bf. name now rejects ^[a-z0-9]{24}$ at plan time, same check kernel_browser_pool uses.
• import by name: leaving as is to match kernel_project, which rejects name imports with the same re-import-by-ID message. if we want name imports, it should be one follow-up for both resources so they stay consistent.
• 409 hints: leaving as is. the provider already surfaces the API's message, and each 409 explains its cause (e.g. "Cannot delete OTLP destination. It is in use by N browser session(s). Delete those sessions or wait for them to end.", plus the managed auth connection and in-progress login variants, and the rename conflict). a provider-side hint would duplicate that. the 403 is the one case where we add context, since the API's message doesn't say the key has to be org-scoped.