Add the option of enabling TLS for sending traces

[ldvc]

Is your feature request related to a problem? Please describe

We would like to enforce TLS for sending our traces. But we are not able to do it for nginx traces as nginx-otel does not have any config option to enable it.

Describe the solution you'd like

Beeing able to specify:

• that we want to send our traces over TLS
• toggle an insecure mode in order to disable certificate verification

Describe alternatives you've considered

None.

Additional context

None.

[vladimirkokshenev]

We have this feature (and few other features) in our roadmap:

otel_exporter {
    ssl on | off;   # “off” by default
    trusted_certificate “path/to/ca/bundle“;
}

Trying to understand priorities for those. So, thank you for your interest in this module and for submitting a feature request.

[mk-raven]

I`m also interesting to use https for collector endpoint with tls option insecure_skip_verify
its very important for our stack,
How long needs to wait about this feature?

[p-pautov]

We are going to implement TLS export, but I'm not sure about 'insecure_skip_verify'. If you need such option, perhaps, you don't really need TLS. As a workaround for now you can try to use otelcol, which can accept HTTP and reexport via HTTPS.

[sahilganguly]

If I understand the problem correct, the way we've gotten around this is by doing the following:

1. Create a new server block in nginx for the otel upstream
2. Set up grpc_pass, grpc_ssl_certificate, and grpc_ssl_certificate_key in the block
3. Point the otel_exporter block to localhost: for the server block created in step 1.
4. We also set otel_trace off for this server block so we don't create spans for nginx sending a trace to the otel upstream.

Would that solve this use case?

[mk-raven]

I`m also interesting to use https for collector endpoint with tls option insecure_skip_verify its very important for our stack, How long needs to wait about this feature?

I mean, need to skip certificate verification. Because, using self signed ssl and some time there are problems, with adding these everytime.