Add section on securing the connection between the EDOT Collector and…

[alexandra5000]

What does this PR do?

This PR expands the "Secure connections" content in default-config-standalone.md to cover securing the connection between the EDOT Collector and Elastic APM or Elasticsearch endpoints.

Why is it important?

Previously, the Secure connection section focused only on securing communication between EDOT SDKs and the apmconfigextension. This update closes that gap by documenting how to secure the Collector to Elastic exporter path.

Checklist

• I have read and understood the pull request guidelines of this project.
  - [ ] My code follows the style guidelines of this project
  - [ ] I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
  - [ ] I have made corresponding change to the default configuration files
  - [ ] I have added tests that prove my fix is effective or that my feature works
  - [ ] I have added an entry in ./changelog/fragments using the changelog tool
  - [ ] I have added an integration test or an E2E test

Disruptive User Impact

No

How to test this PR locally

Follow the Contribute locally guide.

Related issues

Closes #10416

[github-actions]

🔍 Preview links for changed docs

• docs/reference/edot-collector/config/default-config-standalone.md

[hegerchr]

Based on the certificate chain of the Elasticsearch endpoint this needs to be the ISRG Root X1 (Let's Encrypt Root CA). The certificate provided in Cloud console is not for this purpose and it's not working based on my tests. If we remove ca_file from the config, it uses the system's default CA store where the ISRG Root X1 certificate should be part of.

 tls:
      insecure: false

I suggest to mention it somehow in the docs.

[alexandra5000]

@hegerchr Ok, I added a note and rephrased the subsection a bit. Let me know if it looks good to you!

[hegerchr]

Looks good to me!

[hegerchr]

I tested TLS on EDOT SDK OTLP Exporter -> EDOT Collector OTLP Receiver connection. It's working for .NET, Java and Python. For the SDKs the environment variables are OTEL_EXPORTER_OTLP_INSECURE: "false" and OTEL_EXPORTER_OTLP_CERTIFICATE: "/etc/ssl/certs/collector-ca.crt" (shown with example values) and OTEL_EXPORTER_OTLP_ENDPOINT needs to have HTTPS in the URL.

Receiver config for collector looks like (shown with example values)

receivers:
      # Receives data from other Collectors in Agent mode
      otlp:
        protocols:
          grpc:
            endpoint: 0.0.0.0:4317 # Listen on all interfaces
            tls:
              cert_file: "/etc/ssl/certs/collector-server.crt"
              key_file: "/etc/ssl/private/collector-server.key"
          http:
            endpoint: 0.0.0.0:4318 # Listen on all interfaces
            tls:
              cert_file: "/etc/ssl/certs/collector-server.crt"
              key_file: "/etc/ssl/private/collector-server.key"

Should we add this too?