feat(litellm): gateway traces reach Langfuse through Alloy, under the same redaction #634

Merged

kblack0610 merged 1 commit from feat/litellm-via-alloy into master

2026-11-06 22:59:13 +00:00

kblack0610 commented

2026-11-06 22:58:24 +00:00

Owner

LiteLLM stored full prompts and outputs in Langfuse with no redaction (up to 187K characters per call, about 1,100 calls a day). This routes them through Alloy, so one redaction covers every span.

New Alloy receiver litellm on 4319, at the path the callback always posts to, reached through a new alloy-otlp Service.
Redaction moves from claude_langfuse to langfuse_redact. Gateway spans skip the Claude labels, so they keep environment production and trace name litellm_request.

Removed: LANGFUSE_OTEL_HOST from apps/litellm/secret.sops.yaml; it is now a plain value in deployment.yaml. No redaction list was copied. The LiteLLM Langfuse keys stay because the callback refuses to start without them.

Proved on grafana/alloy:v1.5.1 with the real blocks: LiteLLM's path returns 200 and /v1/traces 404; a fake sk- value becomes <redacted:sk>, the rest of the text and the trace name survive; with the statements removed the value comes through. kubectl kustomize apps/alloy renders the Service. Not proved until deployed: live spans still arrive in Langfuse.

https://claude.ai/code/session_01BALUC2Sc2woMiYZb8kmzd3

LiteLLM stored full prompts and outputs in Langfuse with no redaction (up to 187K characters per call, about 1,100 calls a day). This routes them through Alloy, so one redaction covers every span. - New Alloy receiver `litellm` on 4319, at the path the callback always posts to, reached through a new `alloy-otlp` Service. - Redaction moves from `claude_langfuse` to `langfuse_redact`. Gateway spans skip the Claude labels, so they keep environment `production` and trace name `litellm_request`. Removed: `LANGFUSE_OTEL_HOST` from `apps/litellm/secret.sops.yaml`; it is now a plain value in `deployment.yaml`. No redaction list was copied. The LiteLLM Langfuse keys stay because the callback refuses to start without them. Proved on `grafana/alloy:v1.5.1` with the real blocks: LiteLLM's path returns 200 and `/v1/traces` 404; a fake `sk-` value becomes `<redacted:sk>`, the rest of the text and the trace name survive; with the statements removed the value comes through. `kubectl kustomize apps/alloy` renders the Service. Not proved until deployed: live spans still arrive in Langfuse. https://claude.ai/code/session_01BALUC2Sc2woMiYZb8kmzd3

kblack0610 added 1 commit

2026-11-06 22:58:24 +00:00

feat(litellm): gateway traces reach Langfuse through Alloy, under the same redaction

checks / ci-disk-prune (pull_request) Successful in 5s

Details

checks / zomboid-scripts (pull_request) Successful in 6s

Details

checks / fleet-roster (pull_request) Successful in 8s

Details

checks / kustomize-builds (pull_request) Successful in 5s

Details

checks / prometheus-rules (pull_request) Successful in 29s

Details

ae9c27138f

LiteLLM stored full prompts and outputs in Langfuse with no redaction.
Its langfuse_otel callback now posts to a new Alloy receiver, and the
redaction moves out of claude_langfuse into langfuse_redact, which both
paths cross. Gateway spans skip the Claude labels, so they keep their
own environment and trace name.

Claude-Session: https://claude.ai/code/session_01BALUC2Sc2woMiYZb8kmzd3