Clarify default for OTLP endpoint should, not must, be https

[anuraaga]

Fixes #1984

Changes

Adds a subnote clarifying that while the OTLP endpoint variables should default to https, it is not a must

I mostly copied the wording from #1969

[tigrannajaryan]

LGTM, to avoid breaking a stable SDK release.

[tigrannajaryan]

@open-telemetry/specs-approvers please review.

[jack-berg]

Is it actually a good thing to have the default scheme be https? IMO the default configuration should work with a local collector running with minimal configuration. An app configured to export over https to a collector configured with a minimalist otlp receiver doesn't work.

To get this working, you'd have to configure TLS for the otlp receiver, issuing and specifying the certificate, and passing the same certificate to app via OTEL_EXPORTER_OTLP_CERTIFICATE. That's a lot to get right. The ergonomics are better if SDKs can talk to the collector without any configuration.

FYI, here's the original PR where the default scheme was set to https. The convo is primarily about inferring TLS from the scheme. Don't see any convo discussing whether https is actually a reasonable default, but maybe that's buried somewhere else.

[jack-berg]

After more digging, I found this PR that seems to have been the seed for the original https default. It added the original OTEL_EXPORTER_OTLP_*_INSECURE flags, which defaulted to false, and seem to have inspired the https default.

I can't find any context in that PR related to why to default to secure.

[carlosalberto]

@jack-berg Also we don't want to break this invariant for users, as mentioned @anuraaga :

I think fixing this now would be too disruptive to existing users without enough benefit.

[jsuereth]

Responding to @jack-berg's comments, I think it's a valid concern. However, I think instead we should try to define some kind of "local-lookup" mechanism in a future version of the specification where an SDK can find a local collector and communicate over a locally-optimal protocol. If you're interested in defining/refining that mechanism, would be happy to brainstorm ideas with you.

[jsuereth]

This has enough approvals. Going to leave open for 1 more business day for feedback before enabling auto-merge.