[lesnik512]

Closes #322.

opentelemetry_insecure now defaults to None and goes to the gRPC span and metric exporters unchanged. With None, the exporter makes the call itself. It reads OTEL_EXPORTER_OTLP_TRACES_INSECURE or OTEL_EXPORTER_OTLP_METRICS_INSECURE first, then OTEL_EXPORTER_OTLP_INSECURE, then the endpoint's scheme, and only http:// gives a plaintext connection. An https:// endpoint always uses TLS. Under the old True default the exporter never got to those variables, so they had no effect.

I checked this order against the exporter source at 1.42.0, our floor, and at 1.44.0: exporter.py and the insecure handling in the trace and metric exporters' __init__. Both versions read the same.

Warning

The "sending telemetry unencrypted" warning used to check the field. Now _is_grpc_plaintext works out the effective value in the exporter's order, using the signal's own variable for each endpoint. The warning fires exactly when the exporter will connect in plaintext to a non-local host. #333's https handling is kept as the first step.

Tests

Written first. test_insecure_warning_fires_exactly_when_the_grpc_exporter_sends_plaintext builds the real gRPC exporter for traces and for metrics. It covers 11 cases: the default with http://, schemeless and https:// endpoints, the field set either way, each variable set either way, the signal variable beating the generic one, and the field beating both. In each case it asserts that the exporter's _insecure and the warning agree with the expected result. On main, 6 of the 22 cases failed (schemeless, generic-env-off and signal-env-off for both signals). So did test_bootstrap_grpc_protocol_uses_grpc_exporter, which now expects insecure=None.

test_config_cascade.py uses http://collector.example.com:4317 now. Its schemeless endpoint relied on the old default to trigger the warning.

The full suite passes, 578 tests at 100% coverage (just test-ci). just lint (including ty), just adr-check and just docs-build pass too. No floor changes.

Docs

The opentelemetry_insecure bullet in configuration.md gives the new default and the order the exporter checks. It also says to write http:// for a plaintext collector. The metrics example's localhost:4317 endpoints are now http://localhost:4317, so the example still connects in plaintext.

Breaking changes

If you use gRPC and never set opentelemetry_insecure, a schemeless endpoint such as collector:4317 or localhost:4317 now gets TLS. Against a plaintext collector it fails until you write http://collector:4317 or set opentelemetry_insecure=True. A unix:// endpoint also gets TLS under the default, which the issue doesn't mention, so a Unix socket also needs opentelemetry_insecure=True.