Signal Forge ADR-007: secretKeyRef for all credentials (no plaintext env vars)
Status: Accepted
Decision: All database passwords, RabbitMQ credentials, and API keys are stored in Kubernetes
Secrets and referenced via secretKeyRef in Deployment env vars. No plaintext credentials in
manifests. See
ADR-006 for what
happens when a referenced secret is absent.
Rationale:
- Kubernetes manifests are typically committed to version control. Plaintext passwords in
deployment.yamlwould be exposed to anyone with repo read access and in all git history. secretKeyRefkeeps credential values in the cluster only. Manifests are safe to commit.optional: trueis used on Grafana Cloud secrets only (opt-in feature). All datastore secrets are required (nooptional).
Alternative considered: ConfigMap with base64 values — rejected because ConfigMaps are not access-controlled by default and are not treated as sensitive by cluster operators.
Local graph
Related notes
Signal Forge ADR-005: Separate collector configmaps per deployment mode
Keeps cloud and local Alloy collector configs in separate files rather than one conditional configmap, so each mode's exporters stay explicit and uncoupled.
Signal Forge ADR-003: Span metrics generated before tail sampling
Places the spanmetrics connector ahead of tail_sampling so RED metrics reflect all traffic instead of only the ~25% of traces that survive sampling.
Signal Forge ADR-002: SpanLink for async RabbitMQ propagation (not parent-child)
Uses a SpanLink, not a parent-child span relationship, to connect RabbitMQ consumer spans back to the producer span across async, retry-prone delivery.
Architecture Overview
Signal Forge's topology, service communication, trace propagation, and per-signal pipeline flow across local and Grafana Cloud deployment modes.