Add TLS/mTLS support to the ClickHouse exporter #4505

Pre-filing checklist

• I searched existing issues and didn't find a duplicate

Component(s)

Rust OTAP dataflow (rust/otap-dataflow/)

Is your feature request related to a problem?

The ClickHouse exporter currently has no way to connect to ClickHouse servers that require custom CA certificates or client certificate (mTLS) authentication. Users deploying ClickHouse with TLS-secured endpoints or in zero-trust environments cannot use the exporter as it exists today.

Proposed Solution

Add an optional tls configuration block to the ClickHouse exporter that accepts the same TlsClientConfig fields used by other exporters (e.g. OTLP gRPC), supporting:

• Custom CA certificate (ca_file) for server verification
• Client certificate and key (cert_file, key_file) for mutual TLS authentication

When the tls block is present, the exporter should build a custom HTTPS client with the configured rustls settings. When absent, behavior should remain unchanged (default client with standard https:// support).

Alternatives Considered

No response

Additional Context

This would bring the ClickHouse exporter in line with the OTLP gRPC exporter's TLS capabilities and keep the configuration interface consistent across the data plane. The implementation would require adding hyper-rustls and hyper-util as dependencies, gated behind the existing clickhouse feature flag.