The primary goal of this issue is to enabling trace collection on Integrations Server on Cloud by default to send to our internal APM backends. This tracing configuration will be specified in the elastic-agent.yml file on the server side and will not be part of the agent policy retrieved by Fleet.

See the initial discussion in #1969

Requirements

• When tracing is configured in Agent's local configuration, but absent in the Fleet agent policy, the local tracing configuration should take precedence
• APM tracing configuration must be propagated to sub-processes via the control protocol
  • We should not use environment variables since this will not always be possible in some runtimes
• elastic-agent-client should be updated to support this configuration
• We need to prevent any sensitive information from leaking via APM tracing data
  • We should audit existing traces
  • We should propose / consider any additional protections that need to be enabled to avoid leaking sensitive data
  • Areas to focus on: requests to Fleet Server, handling of the agent policy (local and remote from Fleet), gRPC control protocol messages to sub-processes