From 7a7eaa6d5bf9aeb8fa051b9610b715d60ade3258 Mon Sep 17 00:00:00 2001
From: ben11211 <nagengast@langchain.dev>
Date: Mon, 27 Jul 2026 08:55:24 -0700
Subject: [PATCH 1/8] fix(langsmith): normalize SmithDB OTLP endpoint scheme

Derive the URI scheme required by SmithDB from the chart's TLS setting while preserving the bare endpoint consumed by existing LangSmith services.

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 charts/langsmith/templates/_helpers.tpl       | 15 +++++-
 .../tests/langsmith_smithdb_test.yaml         | 51 ++++++++++++++++++-
 2 files changed, 63 insertions(+), 3 deletions(-)

diff --git a/charts/langsmith/templates/_helpers.tpl b/charts/langsmith/templates/_helpers.tpl
index b96771d2c..879b4e032 100644
--- a/charts/langsmith/templates/_helpers.tpl
+++ b/charts/langsmith/templates/_helpers.tpl
@@ -615,6 +615,19 @@ SmithDB OTEL resource attributes.
 {{- join "," $resourceAttributes -}}
 {{- end }}
 
+{{/*
+SmithDB OTLP endpoint. The chart models TLS separately, while the standard
+OTEL_EXPORTER_OTLP_ENDPOINT consumed by SmithDB requires a URI scheme.
+*/}}
+{{- define "langsmith.smithdb.otelEndpoint" -}}
+{{- $tracing := .Values.config.observability.tracing -}}
+{{- if regexMatch "^https?://" $tracing.endpoint -}}
+{{- $tracing.endpoint -}}
+{{- else -}}
+{{- printf "%s://%s" (ternary "https" "http" $tracing.useTls) $tracing.endpoint -}}
+{{- end -}}
+{{- end }}
+
 {{/*
 Common per-process SmithDB env: logging, OpenTelemetry, pod identity, allocator.
 Args: root, service, displayName.
@@ -654,7 +667,7 @@ Args: root, service, displayName.
   value: {{ $displayName | quote }}
 {{- if $tracingEnabled }}
 - name: OTEL_EXPORTER_OTLP_ENDPOINT
-  value: {{ $root.Values.config.observability.tracing.endpoint | quote }}
+  value: {{ include "langsmith.smithdb.otelEndpoint" $root | quote }}
 {{- /* SmithDB exports OTLP over gRPC. */}}
 - name: OTEL_EXPORTER_OTLP_PROTOCOL
   value: "grpc"
diff --git a/charts/langsmith/tests/langsmith_smithdb_test.yaml b/charts/langsmith/tests/langsmith_smithdb_test.yaml
index c6d27c58a..3422f971b 100644
--- a/charts/langsmith/tests/langsmith_smithdb_test.yaml
+++ b/charts/langsmith/tests/langsmith_smithdb_test.yaml
@@ -109,12 +109,13 @@ tests:
               resourceFieldRef:
                 resource: limits.memory
 
-  - it: should configure the SmithDB OTLP gRPC exporter when tracing is enabled
+  - it: should derive the plaintext SmithDB OTLP endpoint from chart-level tracing
     values:
       - ./values/smithdb-enabled.yaml
     set:
       config.observability.tracing.enabled: true
-      config.observability.tracing.endpoint: http://default-otel-collector:4317
+      config.observability.tracing.endpoint: default-otel-collector:4317
+      config.observability.tracing.useTls: false
       config.observability.tracing.exporter: grpc
     template: smithdb/query-deployment.yaml
     asserts:
@@ -144,6 +145,52 @@ tests:
             name: OTEL_RESOURCE_ATTRIBUTES
             value: pod_name=$(POD_NAME),k8s.pod.name=$(POD_NAME),container_name=$(CONTAINER_NAME),k8s.container.name=$(CONTAINER_NAME)
 
+  - it: should preserve the bare endpoint for LangSmith services
+    values:
+      - ./values/smithdb-enabled.yaml
+    set:
+      config.observability.tracing.enabled: true
+      config.observability.tracing.endpoint: default-otel-collector:4317
+      config.observability.tracing.useTls: false
+      config.observability.tracing.exporter: grpc
+    template: config-map.yaml
+    asserts:
+      - equal:
+          path: data.OTLP_ENDPOINT
+          value: default-otel-collector:4317
+
+  - it: should derive the TLS SmithDB OTLP endpoint from chart-level tracing
+    values:
+      - ./values/smithdb-enabled.yaml
+    set:
+      config.observability.tracing.enabled: true
+      config.observability.tracing.endpoint: secure-otel-collector:4317
+      config.observability.tracing.useTls: true
+      config.observability.tracing.exporter: grpc
+    template: smithdb/query-deployment.yaml
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: OTEL_EXPORTER_OTLP_ENDPOINT
+            value: https://secure-otel-collector:4317
+
+  - it: should preserve an explicit SmithDB OTLP endpoint scheme
+    values:
+      - ./values/smithdb-enabled.yaml
+    set:
+      config.observability.tracing.enabled: true
+      config.observability.tracing.endpoint: http://explicit-otel-collector:4317
+      config.observability.tracing.useTls: false
+      config.observability.tracing.exporter: grpc
+    template: smithdb/query-deployment.yaml
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: OTEL_EXPORTER_OTLP_ENDPOINT
+            value: http://explicit-otel-collector:4317
+
   - it: should keep SmithDB tracing disabled when chart-level tracing is disabled
     values:
       - ./values/smithdb-enabled.yaml

From ab35bd69db052f4b1349ccdef501b4572170d002 Mon Sep 17 00:00:00 2001
From: ben11211 <nagengast@langchain.dev>
Date: Mon, 27 Jul 2026 09:10:08 -0700
Subject: [PATCH 2/8] fix(langsmith): allow disabling SmithDB tracing

Keep shared TLS tracing available to LangSmith services by adding a SmithDB-specific opt-out and validating TLS only when SmithDB export remains enabled.

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 charts/langsmith/README.md                    |  1 +
 charts/langsmith/templates/_helpers.tpl       |  2 +-
 charts/langsmith/templates/validate.yaml      |  3 +++
 .../tests/langsmith_smithdb_test.yaml         | 14 ++++++++--
 .../langsmith_smithdb_validation_test.yaml    | 27 +++++++++++++++++++
 charts/langsmith/values.yaml                  |  4 +++
 6 files changed, 48 insertions(+), 3 deletions(-)

diff --git a/charts/langsmith/README.md b/charts/langsmith/README.md
index a34bf44c5..b9089792f 100644
--- a/charts/langsmith/README.md
+++ b/charts/langsmith/README.md
@@ -1011,6 +1011,7 @@ For information on how to use this chart, up-to-date release notes, and other gu
 | smithdb.config.objectStore.s3.region | string | `""` | Defaults to the SmithDB S3 client default when empty. |
 | smithdb.config.objectStore.s3.secretAccessKeySecretKey | string | `""` |  |
 | smithdb.config.objectStore.type | string | `"s3"` | Supported values: s3, gcs. |
+| smithdb.config.observability.tracing.enabled | bool | `true` | Enable SmithDB trace and log export when chart-level tracing uses OTLP/gRPC. SmithDB currently supports plaintext export only. |
 | smithdb.enabled | bool | `false` | Please express interest (https://www.langchain.com/smithdb-early-access-waitlist) and we will reach out promptly to ensure we can set you up for success with SmithDB. |
 | smithdb.ingestion.autoscaling.enabled | bool | `true` |  |
 | smithdb.ingestion.autoscaling.maxReplicas | int | `10` |  |
diff --git a/charts/langsmith/templates/_helpers.tpl b/charts/langsmith/templates/_helpers.tpl
index 879b4e032..4ed30261d 100644
--- a/charts/langsmith/templates/_helpers.tpl
+++ b/charts/langsmith/templates/_helpers.tpl
@@ -636,7 +636,7 @@ Args: root, service, displayName.
 {{- $root := .root -}}
 {{- $prefix := printf "SMITHDB_%s" (upper .service) -}}
 {{- $displayName := .displayName -}}
-{{- $tracingEnabled := and $root.Values.config.observability.tracing.enabled (eq $root.Values.config.observability.tracing.exporter "grpc") -}}
+{{- $tracingEnabled := and $root.Values.smithdb.config.observability.tracing.enabled $root.Values.config.observability.tracing.enabled (eq $root.Values.config.observability.tracing.exporter "grpc") -}}
 - name: {{ $prefix }}__LOGGING__FORMAT
   value: {{ ternary "opentelemetry" "console" $tracingEnabled | quote }}
 - name: {{ $prefix }}__LOGGING__TRACING_ENABLED
diff --git a/charts/langsmith/templates/validate.yaml b/charts/langsmith/templates/validate.yaml
index d94efdce6..fde2d987e 100644
--- a/charts/langsmith/templates/validate.yaml
+++ b/charts/langsmith/templates/validate.yaml
@@ -235,6 +235,9 @@ AWS Marketplace Helm template verification).
 
 {{- /* Validate SmithDB configuration */ -}}
 {{- if .Values.smithdb.enabled -}}
+{{- if and .Values.smithdb.config.observability.tracing.enabled .Values.config.observability.tracing.enabled (eq .Values.config.observability.tracing.exporter "grpc") .Values.config.observability.tracing.useTls -}}
+{{- fail "config.observability.tracing.useTls must be false when SmithDB OTLP/gRPC tracing is enabled; set smithdb.config.observability.tracing.enabled=false to disable SmithDB tracing." -}}
+{{- end -}}
 {{- if .Values.smithdb.commonInitContainers -}}
 {{- range $index, $initContainer := .Values.smithdb.commonInitContainers -}}
 {{- if not (kindIs "map" $initContainer) -}}
diff --git a/charts/langsmith/tests/langsmith_smithdb_test.yaml b/charts/langsmith/tests/langsmith_smithdb_test.yaml
index 3422f971b..45e13c37e 100644
--- a/charts/langsmith/tests/langsmith_smithdb_test.yaml
+++ b/charts/langsmith/tests/langsmith_smithdb_test.yaml
@@ -159,7 +159,7 @@ tests:
           path: data.OTLP_ENDPOINT
           value: default-otel-collector:4317
 
-  - it: should derive the TLS SmithDB OTLP endpoint from chart-level tracing
+  - it: should allow disabling SmithDB tracing independently
     values:
       - ./values/smithdb-enabled.yaml
     set:
@@ -167,13 +167,23 @@ tests:
       config.observability.tracing.endpoint: secure-otel-collector:4317
       config.observability.tracing.useTls: true
       config.observability.tracing.exporter: grpc
+      smithdb.config.observability.tracing.enabled: false
     template: smithdb/query-deployment.yaml
     asserts:
       - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: SMITHDB_QUERY__LOGGING__TRACING_ENABLED
+            value: "false"
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: SMITHDB_QUERY__LOGGING__FORMAT
+            value: console
+      - notContains:
           path: spec.template.spec.containers[0].env
           content:
             name: OTEL_EXPORTER_OTLP_ENDPOINT
-            value: https://secure-otel-collector:4317
 
   - it: should preserve an explicit SmithDB OTLP endpoint scheme
     values:
diff --git a/charts/langsmith/tests/langsmith_smithdb_validation_test.yaml b/charts/langsmith/tests/langsmith_smithdb_validation_test.yaml
index 6918b6b3f..d5f8d4af7 100644
--- a/charts/langsmith/tests/langsmith_smithdb_validation_test.yaml
+++ b/charts/langsmith/tests/langsmith_smithdb_validation_test.yaml
@@ -2,6 +2,33 @@ suite: test smithdb phase validation
 templates:
   - validate.yaml
 tests:
+  - it: should reject TLS when SmithDB OTLP gRPC tracing is enabled
+    values:
+      - ./values/smithdb-enabled.yaml
+    set:
+      config.existingSecretName: langsmith-secret
+      config.observability.tracing.enabled: true
+      config.observability.tracing.endpoint: secure-otel-collector:4317
+      config.observability.tracing.exporter: grpc
+      config.observability.tracing.useTls: true
+    asserts:
+      - failedTemplate:
+          errorMessage: "config.observability.tracing.useTls must be false when SmithDB OTLP/gRPC tracing is enabled; set smithdb.config.observability.tracing.enabled=false to disable SmithDB tracing."
+
+  - it: should allow chart-level TLS when SmithDB tracing is disabled
+    values:
+      - ./values/smithdb-enabled.yaml
+    set:
+      config.existingSecretName: langsmith-secret
+      config.observability.tracing.enabled: true
+      config.observability.tracing.endpoint: secure-otel-collector:4317
+      config.observability.tracing.exporter: grpc
+      config.observability.tracing.useTls: true
+      smithdb.config.observability.tracing.enabled: false
+    asserts:
+      - hasDocuments:
+          count: 0
+
   - it: should reject smithdb without query replicas
     values:
       - ./values/smithdb-enabled.yaml
diff --git a/charts/langsmith/values.yaml b/charts/langsmith/values.yaml
index 389899f93..821fb52f4 100644
--- a/charts/langsmith/values.yaml
+++ b/charts/langsmith/values.yaml
@@ -1247,6 +1247,10 @@ smithdb:
       passwordSecretKey: ""
       port: "5432"
       useSsl: false
+    observability:
+      tracing:
+        # -- Enable SmithDB trace and log export when chart-level tracing uses OTLP/gRPC. SmithDB currently supports plaintext export only.
+        enabled: true
     objectStore:
       # -- Supported values: s3, gcs.
       type: "s3"

From 9d743689cf3cf868e97cf761874e5c97469d3261 Mon Sep 17 00:00:00 2001
From: ben11211 <nagengast@langchain.dev>
Date: Mon, 27 Jul 2026 09:16:14 -0700
Subject: [PATCH 3/8] fix(langsmith): disable SmithDB tracing with TLS

Keep TLS tracing available to supported services while SmithDB falls back to console logging until its OTLP exporter supports TLS.

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 charts/langsmith/README.md                    |  3 +-
 charts/langsmith/templates/_helpers.tpl       |  7 +++--
 charts/langsmith/templates/validate.yaml      |  3 --
 .../tests/langsmith_smithdb_test.yaml         | 28 +++++++++++++++++--
 .../langsmith_smithdb_validation_test.yaml    | 27 ------------------
 charts/langsmith/values.yaml                  |  5 +---
 6 files changed, 32 insertions(+), 41 deletions(-)

diff --git a/charts/langsmith/README.md b/charts/langsmith/README.md
index b9089792f..cc05ff1e0 100644
--- a/charts/langsmith/README.md
+++ b/charts/langsmith/README.md
@@ -1011,7 +1011,6 @@ For information on how to use this chart, up-to-date release notes, and other gu
 | smithdb.config.objectStore.s3.region | string | `""` | Defaults to the SmithDB S3 client default when empty. |
 | smithdb.config.objectStore.s3.secretAccessKeySecretKey | string | `""` |  |
 | smithdb.config.objectStore.type | string | `"s3"` | Supported values: s3, gcs. |
-| smithdb.config.observability.tracing.enabled | bool | `true` | Enable SmithDB trace and log export when chart-level tracing uses OTLP/gRPC. SmithDB currently supports plaintext export only. |
 | smithdb.enabled | bool | `false` | Please express interest (https://www.langchain.com/smithdb-early-access-waitlist) and we will reach out promptly to ensure we can set you up for success with SmithDB. |
 | smithdb.ingestion.autoscaling.enabled | bool | `true` |  |
 | smithdb.ingestion.autoscaling.maxReplicas | int | `10` |  |
@@ -1318,7 +1317,7 @@ For information on how to use this chart, up-to-date release notes, and other gu
 | config.observability.tracing.endpoint | string | `""` |  |
 | config.observability.tracing.env | string | `"ls_self_hosted"` |  |
 | config.observability.tracing.exporter | string | `"http"` |  |
-| config.observability.tracing.useTls | bool | `true` |  |
+| config.observability.tracing.useTls | bool | `true` | Use TLS for OTLP export. SmithDB trace and log export is disabled when this is true because SmithDB currently supports plaintext OTLP/gRPC only. |
 | config.orgAdminsInstallationUsageExportEnabled | bool | `false` | When true, any org admin can use the usage backfill export. |
 | config.personalOrgsDisabled | bool | `true` | Disable personal orgs. |
 | config.security | object | `{"cors":{"allowedOrigins":"*","allowedOriginsRegex":"","alwaysAllowPathsRegex":""}}` | Security configuration for CORS, headers, and other security-related settings. These settings control cross-origin access and help protect against common web vulnerabilities. |
diff --git a/charts/langsmith/templates/_helpers.tpl b/charts/langsmith/templates/_helpers.tpl
index 4ed30261d..c1cf0962a 100644
--- a/charts/langsmith/templates/_helpers.tpl
+++ b/charts/langsmith/templates/_helpers.tpl
@@ -621,10 +621,10 @@ OTEL_EXPORTER_OTLP_ENDPOINT consumed by SmithDB requires a URI scheme.
 */}}
 {{- define "langsmith.smithdb.otelEndpoint" -}}
 {{- $tracing := .Values.config.observability.tracing -}}
-{{- if regexMatch "^https?://" $tracing.endpoint -}}
+{{- if regexMatch "(?i)^https?://" $tracing.endpoint -}}
 {{- $tracing.endpoint -}}
 {{- else -}}
-{{- printf "%s://%s" (ternary "https" "http" $tracing.useTls) $tracing.endpoint -}}
+{{- printf "http://%s" $tracing.endpoint -}}
 {{- end -}}
 {{- end }}
 
@@ -636,7 +636,8 @@ Args: root, service, displayName.
 {{- $root := .root -}}
 {{- $prefix := printf "SMITHDB_%s" (upper .service) -}}
 {{- $displayName := .displayName -}}
-{{- $tracingEnabled := and $root.Values.smithdb.config.observability.tracing.enabled $root.Values.config.observability.tracing.enabled (eq $root.Values.config.observability.tracing.exporter "grpc") -}}
+{{- $tracing := $root.Values.config.observability.tracing -}}
+{{- $tracingEnabled := and $tracing.enabled (eq $tracing.exporter "grpc") (not $tracing.useTls) (not (regexMatch "(?i)^https://" $tracing.endpoint)) -}}
 - name: {{ $prefix }}__LOGGING__FORMAT
   value: {{ ternary "opentelemetry" "console" $tracingEnabled | quote }}
 - name: {{ $prefix }}__LOGGING__TRACING_ENABLED
diff --git a/charts/langsmith/templates/validate.yaml b/charts/langsmith/templates/validate.yaml
index fde2d987e..d94efdce6 100644
--- a/charts/langsmith/templates/validate.yaml
+++ b/charts/langsmith/templates/validate.yaml
@@ -235,9 +235,6 @@ AWS Marketplace Helm template verification).
 
 {{- /* Validate SmithDB configuration */ -}}
 {{- if .Values.smithdb.enabled -}}
-{{- if and .Values.smithdb.config.observability.tracing.enabled .Values.config.observability.tracing.enabled (eq .Values.config.observability.tracing.exporter "grpc") .Values.config.observability.tracing.useTls -}}
-{{- fail "config.observability.tracing.useTls must be false when SmithDB OTLP/gRPC tracing is enabled; set smithdb.config.observability.tracing.enabled=false to disable SmithDB tracing." -}}
-{{- end -}}
 {{- if .Values.smithdb.commonInitContainers -}}
 {{- range $index, $initContainer := .Values.smithdb.commonInitContainers -}}
 {{- if not (kindIs "map" $initContainer) -}}
diff --git a/charts/langsmith/tests/langsmith_smithdb_test.yaml b/charts/langsmith/tests/langsmith_smithdb_test.yaml
index 45e13c37e..cf6ca757e 100644
--- a/charts/langsmith/tests/langsmith_smithdb_test.yaml
+++ b/charts/langsmith/tests/langsmith_smithdb_test.yaml
@@ -159,7 +159,7 @@ tests:
           path: data.OTLP_ENDPOINT
           value: default-otel-collector:4317
 
-  - it: should allow disabling SmithDB tracing independently
+  - it: should disable SmithDB tracing when chart-level tracing uses TLS
     values:
       - ./values/smithdb-enabled.yaml
     set:
@@ -167,7 +167,6 @@ tests:
       config.observability.tracing.endpoint: secure-otel-collector:4317
       config.observability.tracing.useTls: true
       config.observability.tracing.exporter: grpc
-      smithdb.config.observability.tracing.enabled: false
     template: smithdb/query-deployment.yaml
     asserts:
       - contains:
@@ -201,6 +200,31 @@ tests:
             name: OTEL_EXPORTER_OTLP_ENDPOINT
             value: http://explicit-otel-collector:4317
 
+  - it: should disable SmithDB tracing for an explicit HTTPS endpoint
+    values:
+      - ./values/smithdb-enabled.yaml
+    set:
+      config.observability.tracing.enabled: true
+      config.observability.tracing.endpoint: https://secure-otel-collector:4317
+      config.observability.tracing.useTls: false
+      config.observability.tracing.exporter: grpc
+    template: smithdb/query-deployment.yaml
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: SMITHDB_QUERY__LOGGING__TRACING_ENABLED
+            value: "false"
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: SMITHDB_QUERY__LOGGING__FORMAT
+            value: console
+      - notContains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: OTEL_EXPORTER_OTLP_ENDPOINT
+
   - it: should keep SmithDB tracing disabled when chart-level tracing is disabled
     values:
       - ./values/smithdb-enabled.yaml
diff --git a/charts/langsmith/tests/langsmith_smithdb_validation_test.yaml b/charts/langsmith/tests/langsmith_smithdb_validation_test.yaml
index d5f8d4af7..6918b6b3f 100644
--- a/charts/langsmith/tests/langsmith_smithdb_validation_test.yaml
+++ b/charts/langsmith/tests/langsmith_smithdb_validation_test.yaml
@@ -2,33 +2,6 @@ suite: test smithdb phase validation
 templates:
   - validate.yaml
 tests:
-  - it: should reject TLS when SmithDB OTLP gRPC tracing is enabled
-    values:
-      - ./values/smithdb-enabled.yaml
-    set:
-      config.existingSecretName: langsmith-secret
-      config.observability.tracing.enabled: true
-      config.observability.tracing.endpoint: secure-otel-collector:4317
-      config.observability.tracing.exporter: grpc
-      config.observability.tracing.useTls: true
-    asserts:
-      - failedTemplate:
-          errorMessage: "config.observability.tracing.useTls must be false when SmithDB OTLP/gRPC tracing is enabled; set smithdb.config.observability.tracing.enabled=false to disable SmithDB tracing."
-
-  - it: should allow chart-level TLS when SmithDB tracing is disabled
-    values:
-      - ./values/smithdb-enabled.yaml
-    set:
-      config.existingSecretName: langsmith-secret
-      config.observability.tracing.enabled: true
-      config.observability.tracing.endpoint: secure-otel-collector:4317
-      config.observability.tracing.exporter: grpc
-      config.observability.tracing.useTls: true
-      smithdb.config.observability.tracing.enabled: false
-    asserts:
-      - hasDocuments:
-          count: 0
-
   - it: should reject smithdb without query replicas
     values:
       - ./values/smithdb-enabled.yaml
diff --git a/charts/langsmith/values.yaml b/charts/langsmith/values.yaml
index 821fb52f4..1b89fe8d5 100644
--- a/charts/langsmith/values.yaml
+++ b/charts/langsmith/values.yaml
@@ -1068,6 +1068,7 @@ config:
       enabled: false
       # Replace this with the endpoint of your trace collector. If you are using the LangSmith Observability helm chart, this will be the endpoint of the OTEL Gateway collector.
       endpoint: ""
+      # -- Use TLS for OTLP export. SmithDB trace and log export is disabled when this is true because SmithDB currently supports plaintext OTLP/gRPC only.
       useTls: true
       env: "ls_self_hosted"
       exporter: "http"
@@ -1247,10 +1248,6 @@ smithdb:
       passwordSecretKey: ""
       port: "5432"
       useSsl: false
-    observability:
-      tracing:
-        # -- Enable SmithDB trace and log export when chart-level tracing uses OTLP/gRPC. SmithDB currently supports plaintext export only.
-        enabled: true
     objectStore:
       # -- Supported values: s3, gcs.
       type: "s3"

From 90d41f77f1be18fa423cc2561ddceb2387535258 Mon Sep 17 00:00:00 2001
From: ben11211 <nagengast@langchain.dev>
Date: Mon, 27 Jul 2026 09:23:29 -0700
Subject: [PATCH 4/8] refactor(langsmith): simplify SmithDB tracing condition

Use the chart's explicit TLS setting as the source of truth for SmithDB exporter compatibility.

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 charts/langsmith/templates/_helpers.tpl       |  2 +-
 .../tests/langsmith_smithdb_test.yaml         | 25 -------------------
 2 files changed, 1 insertion(+), 26 deletions(-)

diff --git a/charts/langsmith/templates/_helpers.tpl b/charts/langsmith/templates/_helpers.tpl
index c1cf0962a..b3ee6e826 100644
--- a/charts/langsmith/templates/_helpers.tpl
+++ b/charts/langsmith/templates/_helpers.tpl
@@ -637,7 +637,7 @@ Args: root, service, displayName.
 {{- $prefix := printf "SMITHDB_%s" (upper .service) -}}
 {{- $displayName := .displayName -}}
 {{- $tracing := $root.Values.config.observability.tracing -}}
-{{- $tracingEnabled := and $tracing.enabled (eq $tracing.exporter "grpc") (not $tracing.useTls) (not (regexMatch "(?i)^https://" $tracing.endpoint)) -}}
+{{- $tracingEnabled := and $tracing.enabled (eq $tracing.exporter "grpc") (not $tracing.useTls) -}}
 - name: {{ $prefix }}__LOGGING__FORMAT
   value: {{ ternary "opentelemetry" "console" $tracingEnabled | quote }}
 - name: {{ $prefix }}__LOGGING__TRACING_ENABLED
diff --git a/charts/langsmith/tests/langsmith_smithdb_test.yaml b/charts/langsmith/tests/langsmith_smithdb_test.yaml
index cf6ca757e..21ed51375 100644
--- a/charts/langsmith/tests/langsmith_smithdb_test.yaml
+++ b/charts/langsmith/tests/langsmith_smithdb_test.yaml
@@ -200,31 +200,6 @@ tests:
             name: OTEL_EXPORTER_OTLP_ENDPOINT
             value: http://explicit-otel-collector:4317
 
-  - it: should disable SmithDB tracing for an explicit HTTPS endpoint
-    values:
-      - ./values/smithdb-enabled.yaml
-    set:
-      config.observability.tracing.enabled: true
-      config.observability.tracing.endpoint: https://secure-otel-collector:4317
-      config.observability.tracing.useTls: false
-      config.observability.tracing.exporter: grpc
-    template: smithdb/query-deployment.yaml
-    asserts:
-      - contains:
-          path: spec.template.spec.containers[0].env
-          content:
-            name: SMITHDB_QUERY__LOGGING__TRACING_ENABLED
-            value: "false"
-      - contains:
-          path: spec.template.spec.containers[0].env
-          content:
-            name: SMITHDB_QUERY__LOGGING__FORMAT
-            value: console
-      - notContains:
-          path: spec.template.spec.containers[0].env
-          content:
-            name: OTEL_EXPORTER_OTLP_ENDPOINT
-
   - it: should keep SmithDB tracing disabled when chart-level tracing is disabled
     values:
       - ./values/smithdb-enabled.yaml

From f337aedd3d95dc3a7e75312f7194c65b1db66b08 Mon Sep 17 00:00:00 2001
From: ben11211 <nagengast@langchain.dev>
Date: Mon, 27 Jul 2026 09:25:47 -0700
Subject: [PATCH 5/8] docs(langsmith): clarify SmithDB TLS fallback

Distinguish disabled OTLP tracing from console-formatted stdout logging.

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 charts/langsmith/README.md   | 2 +-
 charts/langsmith/values.yaml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/charts/langsmith/README.md b/charts/langsmith/README.md
index cc05ff1e0..72212f15f 100644
--- a/charts/langsmith/README.md
+++ b/charts/langsmith/README.md
@@ -1317,7 +1317,7 @@ For information on how to use this chart, up-to-date release notes, and other gu
 | config.observability.tracing.endpoint | string | `""` |  |
 | config.observability.tracing.env | string | `"ls_self_hosted"` |  |
 | config.observability.tracing.exporter | string | `"http"` |  |
-| config.observability.tracing.useTls | bool | `true` | Use TLS for OTLP export. SmithDB trace and log export is disabled when this is true because SmithDB currently supports plaintext OTLP/gRPC only. |
+| config.observability.tracing.useTls | bool | `true` | Use TLS for OTLP export. When true, SmithDB does not configure OTLP: traces are not exported, and logs are written to stdout using console format. |
 | config.orgAdminsInstallationUsageExportEnabled | bool | `false` | When true, any org admin can use the usage backfill export. |
 | config.personalOrgsDisabled | bool | `true` | Disable personal orgs. |
 | config.security | object | `{"cors":{"allowedOrigins":"*","allowedOriginsRegex":"","alwaysAllowPathsRegex":""}}` | Security configuration for CORS, headers, and other security-related settings. These settings control cross-origin access and help protect against common web vulnerabilities. |
diff --git a/charts/langsmith/values.yaml b/charts/langsmith/values.yaml
index 1b89fe8d5..4a6cb6167 100644
--- a/charts/langsmith/values.yaml
+++ b/charts/langsmith/values.yaml
@@ -1068,7 +1068,7 @@ config:
       enabled: false
       # Replace this with the endpoint of your trace collector. If you are using the LangSmith Observability helm chart, this will be the endpoint of the OTEL Gateway collector.
       endpoint: ""
-      # -- Use TLS for OTLP export. SmithDB trace and log export is disabled when this is true because SmithDB currently supports plaintext OTLP/gRPC only.
+      # -- Use TLS for OTLP export. When true, SmithDB does not configure OTLP: traces are not exported, and logs are written to stdout using console format.
       useTls: true
       env: "ls_self_hosted"
       exporter: "http"

From 97eac827ebb2bcc1105ea55a06167de4a9d2ab21 Mon Sep 17 00:00:00 2001
From: ben11211 <nagengast@langchain.dev>
Date: Mon, 27 Jul 2026 09:27:54 -0700
Subject: [PATCH 6/8] refactor(langsmith): simplify SmithDB endpoint
 normalization

Make plaintext normalization explicit now that TLS compatibility is handled before rendering the endpoint.

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 charts/langsmith/templates/_helpers.tpl | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/charts/langsmith/templates/_helpers.tpl b/charts/langsmith/templates/_helpers.tpl
index b3ee6e826..108e4de83 100644
--- a/charts/langsmith/templates/_helpers.tpl
+++ b/charts/langsmith/templates/_helpers.tpl
@@ -621,11 +621,7 @@ OTEL_EXPORTER_OTLP_ENDPOINT consumed by SmithDB requires a URI scheme.
 */}}
 {{- define "langsmith.smithdb.otelEndpoint" -}}
 {{- $tracing := .Values.config.observability.tracing -}}
-{{- if regexMatch "(?i)^https?://" $tracing.endpoint -}}
-{{- $tracing.endpoint -}}
-{{- else -}}
-{{- printf "http://%s" $tracing.endpoint -}}
-{{- end -}}
+{{- printf "http://%s" (trimPrefix "http://" $tracing.endpoint) -}}
 {{- end }}
 
 {{/*

From 2559805c43c26969a7e55c7cc5b3cd9ca821aa41 Mon Sep 17 00:00:00 2001
From: ben11211 <nagengast@langchain.dev>
Date: Mon, 27 Jul 2026 09:30:03 -0700
Subject: [PATCH 7/8] refactor(langsmith): prepend SmithDB OTLP scheme directly

Rely on the chart's bare endpoint contract instead of accepting protocol-bearing values.

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 charts/langsmith/templates/_helpers.tpl          |  2 +-
 .../langsmith/tests/langsmith_smithdb_test.yaml  | 16 ----------------
 2 files changed, 1 insertion(+), 17 deletions(-)

diff --git a/charts/langsmith/templates/_helpers.tpl b/charts/langsmith/templates/_helpers.tpl
index 108e4de83..898ae31f9 100644
--- a/charts/langsmith/templates/_helpers.tpl
+++ b/charts/langsmith/templates/_helpers.tpl
@@ -621,7 +621,7 @@ OTEL_EXPORTER_OTLP_ENDPOINT consumed by SmithDB requires a URI scheme.
 */}}
 {{- define "langsmith.smithdb.otelEndpoint" -}}
 {{- $tracing := .Values.config.observability.tracing -}}
-{{- printf "http://%s" (trimPrefix "http://" $tracing.endpoint) -}}
+{{- printf "http://%s" $tracing.endpoint -}}
 {{- end }}
 
 {{/*
diff --git a/charts/langsmith/tests/langsmith_smithdb_test.yaml b/charts/langsmith/tests/langsmith_smithdb_test.yaml
index 21ed51375..4c6bb00f8 100644
--- a/charts/langsmith/tests/langsmith_smithdb_test.yaml
+++ b/charts/langsmith/tests/langsmith_smithdb_test.yaml
@@ -184,22 +184,6 @@ tests:
           content:
             name: OTEL_EXPORTER_OTLP_ENDPOINT
 
-  - it: should preserve an explicit SmithDB OTLP endpoint scheme
-    values:
-      - ./values/smithdb-enabled.yaml
-    set:
-      config.observability.tracing.enabled: true
-      config.observability.tracing.endpoint: http://explicit-otel-collector:4317
-      config.observability.tracing.useTls: false
-      config.observability.tracing.exporter: grpc
-    template: smithdb/query-deployment.yaml
-    asserts:
-      - contains:
-          path: spec.template.spec.containers[0].env
-          content:
-            name: OTEL_EXPORTER_OTLP_ENDPOINT
-            value: http://explicit-otel-collector:4317
-
   - it: should keep SmithDB tracing disabled when chart-level tracing is disabled
     values:
       - ./values/smithdb-enabled.yaml

From 82a5db63a6047a1309302008c346062914a0e3a4 Mon Sep 17 00:00:00 2001
From: ben11211 <nagengast@langchain.dev>
Date: Mon, 27 Jul 2026 10:16:42 -0700
Subject: [PATCH 8/8] feat(langsmith): enable SmithDB OTLP TLS

Derive SmithDB's required endpoint URI scheme from the shared TLS setting while preserving the bare endpoint used by other services.
---
 charts/langsmith/README.md                         |  2 +-
 charts/langsmith/templates/_helpers.tpl            |  4 ++--
 charts/langsmith/tests/langsmith_smithdb_test.yaml | 14 ++++++++++----
 charts/langsmith/values.yaml                       |  2 +-
 4 files changed, 14 insertions(+), 8 deletions(-)

diff --git a/charts/langsmith/README.md b/charts/langsmith/README.md
index 72212f15f..2b25a72a9 100644
--- a/charts/langsmith/README.md
+++ b/charts/langsmith/README.md
@@ -1317,7 +1317,7 @@ For information on how to use this chart, up-to-date release notes, and other gu
 | config.observability.tracing.endpoint | string | `""` |  |
 | config.observability.tracing.env | string | `"ls_self_hosted"` |  |
 | config.observability.tracing.exporter | string | `"http"` |  |
-| config.observability.tracing.useTls | bool | `true` | Use TLS for OTLP export. When true, SmithDB does not configure OTLP: traces are not exported, and logs are written to stdout using console format. |
+| config.observability.tracing.useTls | bool | `true` | Use TLS for OTLP export. |
 | config.orgAdminsInstallationUsageExportEnabled | bool | `false` | When true, any org admin can use the usage backfill export. |
 | config.personalOrgsDisabled | bool | `true` | Disable personal orgs. |
 | config.security | object | `{"cors":{"allowedOrigins":"*","allowedOriginsRegex":"","alwaysAllowPathsRegex":""}}` | Security configuration for CORS, headers, and other security-related settings. These settings control cross-origin access and help protect against common web vulnerabilities. |
diff --git a/charts/langsmith/templates/_helpers.tpl b/charts/langsmith/templates/_helpers.tpl
index 898ae31f9..7684e7948 100644
--- a/charts/langsmith/templates/_helpers.tpl
+++ b/charts/langsmith/templates/_helpers.tpl
@@ -621,7 +621,7 @@ OTEL_EXPORTER_OTLP_ENDPOINT consumed by SmithDB requires a URI scheme.
 */}}
 {{- define "langsmith.smithdb.otelEndpoint" -}}
 {{- $tracing := .Values.config.observability.tracing -}}
-{{- printf "http://%s" $tracing.endpoint -}}
+{{- printf "%s://%s" (ternary "https" "http" $tracing.useTls) $tracing.endpoint -}}
 {{- end }}
 
 {{/*
@@ -633,7 +633,7 @@ Args: root, service, displayName.
 {{- $prefix := printf "SMITHDB_%s" (upper .service) -}}
 {{- $displayName := .displayName -}}
 {{- $tracing := $root.Values.config.observability.tracing -}}
-{{- $tracingEnabled := and $tracing.enabled (eq $tracing.exporter "grpc") (not $tracing.useTls) -}}
+{{- $tracingEnabled := and $tracing.enabled (eq $tracing.exporter "grpc") -}}
 - name: {{ $prefix }}__LOGGING__FORMAT
   value: {{ ternary "opentelemetry" "console" $tracingEnabled | quote }}
 - name: {{ $prefix }}__LOGGING__TRACING_ENABLED
diff --git a/charts/langsmith/tests/langsmith_smithdb_test.yaml b/charts/langsmith/tests/langsmith_smithdb_test.yaml
index 4c6bb00f8..b50cbb4cb 100644
--- a/charts/langsmith/tests/langsmith_smithdb_test.yaml
+++ b/charts/langsmith/tests/langsmith_smithdb_test.yaml
@@ -159,7 +159,7 @@ tests:
           path: data.OTLP_ENDPOINT
           value: default-otel-collector:4317
 
-  - it: should disable SmithDB tracing when chart-level tracing uses TLS
+  - it: should derive the TLS SmithDB OTLP endpoint from chart-level tracing
     values:
       - ./values/smithdb-enabled.yaml
     set:
@@ -173,16 +173,22 @@ tests:
           path: spec.template.spec.containers[0].env
           content:
             name: SMITHDB_QUERY__LOGGING__TRACING_ENABLED
-            value: "false"
+            value: "true"
       - contains:
           path: spec.template.spec.containers[0].env
           content:
             name: SMITHDB_QUERY__LOGGING__FORMAT
-            value: console
-      - notContains:
+            value: opentelemetry
+      - contains:
           path: spec.template.spec.containers[0].env
           content:
             name: OTEL_EXPORTER_OTLP_ENDPOINT
+            value: https://secure-otel-collector:4317
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: OTEL_EXPORTER_OTLP_PROTOCOL
+            value: grpc
 
   - it: should keep SmithDB tracing disabled when chart-level tracing is disabled
     values:
diff --git a/charts/langsmith/values.yaml b/charts/langsmith/values.yaml
index 4a6cb6167..de8511bae 100644
--- a/charts/langsmith/values.yaml
+++ b/charts/langsmith/values.yaml
@@ -1068,7 +1068,7 @@ config:
       enabled: false
       # Replace this with the endpoint of your trace collector. If you are using the LangSmith Observability helm chart, this will be the endpoint of the OTEL Gateway collector.
       endpoint: ""
-      # -- Use TLS for OTLP export. When true, SmithDB does not configure OTLP: traces are not exported, and logs are written to stdout using console format.
+      # -- Use TLS for OTLP export.
       useTls: true
       env: "ls_self_hosted"
       exporter: "http"