Clarify TLS/Secure default behavior

[dyladan]

The configuration options for the OTLP gRPC exporter are a little unclear what to do if no endpoint is configured. By a strict reading of the current spec it seems like a secure connection to localhost:4317 should be made, but it seems likely that certificate validation will fail in this case most of the time if a certificate is not supplied to the client. I would propose a secure connection is only the default here if a certificate is provided for validation, or we should specify that if no endpoint is provided TLS certificate validation should be disabled.

[tigrannajaryan]

I believe the default connection to localhost should be insecure (I am not aware of any benefits of using encryption for localhost connections). If we agree on this then the spec needs to be clarified.

[dyladan]

There are still a couple open questions in open-telemetry/opentelemetry-js#2827

Specifically:

• if user sets http scheme and no other items (like providing credentials or env insecure settings) return insecure channel

This is not as clear. I'll ask Tigran. The spec says insecure is false by default, but http implies insecure.

• if user wants to use all defaults, return secure channel

According to @tigrannajaryan open-telemetry/opentelemetry-specification#2420 it should be insecure to localhost. Tigran agrees spec should be clarified.

• if user sets http scheme and env insecure = false, return secure channel

Yes. I think this will also be the answer for "user sets http scheme and no other items" but we'll wait for Tigran.

Would appreciate some clarification/guidance here.

[tigrannajaryan]

• if user sets http scheme and no other items (like providing credentials or env insecure settings) return insecure channel

This is not as clear. I'll ask Tigran. The spec says insecure is false by default, but http implies insecure.

The spec says that "insecure" option is ignored for OTLP/HTTP. So, with the default protocol of http/protobuf and default destination of http://localhost:4318 I believe there is no ambiguity. It means: use OTLP/HTTP, insecure.

[dyladan]

This is specifically for the gRPC exporter

[tigrannajaryan]

For gRPC the spec says:

Endpoint (OTLP/gRPC): Target to which the exporter is going to send spans or metrics. The endpoint SHOULD accept
 any form allowed by the underlying gRPC client implementation. Additionally, the endpoint MUST accept a URL with 
a scheme of either http or https. A scheme of https indicates a secure connection and takes precedence over the 
insecure configuration setting.

I think we need to modify it to say that if the "http" or "https" scheme is used in the endpoint then that takes precedence over the insecure configuration setting (so, not just the "https" as it says currently, but also "http").

I think that should remove the ambiguity.

[dyladan]

So the insecure config is only used if there is no scheme in the URL?

[tigrannajaryan]

So the insecure config is only used if there is no scheme in the URL?

Yes, I think so.