Make a Langfuse trace worth opening: question, answer, session, no probe noise

infra/helm/medical-chatbot/templates/ai-service.yaml

@@ -22,6 +22,9 @@ data:
   OTEL_SERVICE_NAME: ai-service
   OTEL_EXPORTER_OTLP_ENDPOINT: {{ printf "http://%s-otel-collector:4318/v1/traces" (include "medical-chatbot.fullname" .) | quote }}
   OTEL_SAMPLE_RATIO: {{ .Values.aiService.config.otelSampleRatio | quote }}
+  {{- if .Values.aiService.config.langfuseBaseUrl }}
+  LANGFUSE_BASE_URL: {{ .Values.aiService.config.langfuseBaseUrl | quote }}
+  {{- end }}
   MAX_WALL_CLOCK_MS: {{ .Values.aiService.config.maxWallClockMs | quote }}
   MAX_LLM_CALLS_PER_TURN: {{ .Values.aiService.config.maxLlmCallsPerTurn | quote }}
 ---
@@ -81,6 +84,25 @@ spec:
                 secretKeyRef:
                   name: {{ include "medical-chatbot.secretName" . }}
                   key: postgres-dsn
+            {{- if .Values.aiService.config.langfuseBaseUrl }}
+            # Langfuse keys are real credentials, so they come from the
+            # Secret, never the ConfigMap above (which is world-readable to
+            # anyone with namespace get access). Both are marked optional so
+            # a cluster that sets the base URL before creating the Secret
+            # starts anyway, with the exporter simply not added.
+            - name: LANGFUSE_PUBLIC_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "medical-chatbot.secretName" . }}
+                  key: langfuse-public-key
+                  optional: true
+            - name: LANGFUSE_SECRET_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "medical-chatbot.secretName" . }}
+                  key: langfuse-secret-key
+                  optional: true
+            {{- end }}
             {{- if .Values.aws.region }}
             - name: AWS_REGION
               value: {{ .Values.aws.region | quote }}

infra/helm/medical-chatbot/templates/secret.yaml

@@ -14,6 +14,13 @@ stringData:
   aws-access-key-id: {{ .Values.aws.staticCredentials.accessKeyId | quote }}
   aws-secret-access-key: {{ .Values.aws.staticCredentials.secretAccessKey | quote }}
   {{- end }}
+  {{- if .Values.secret.langfusePublicKey }}
+  {{/* Both keys or neither: a public key without its secret authenticates
+  nothing, and ai-service already treats a partial config as "not
+  configured" (see rag/telemetry.py's _langfuse_exporters). */}}
+  langfuse-public-key: {{ .Values.secret.langfusePublicKey | quote }}
+  langfuse-secret-key: {{ required "secret.langfuseSecretKey is required when secret.langfusePublicKey is set" .Values.secret.langfuseSecretKey | quote }}
+  {{- end }}
   {{- if or .Values.authService.enabled .Values.apiGateway.enabled }}
   {{/* Required (not defaulted) once either service is turned on — same
   fail-closed posture as the image-tag guard above: a guessable or empty