docs: add supported connection paths for remote clusters (CCS/CCR vs private connectivity)

[alxchalkias]

Summary

• Adds a Supported connection paths subsection to the "Remote clusters and network security" section of deploy-manage/remote-clusters.md, with a table showing which network paths support CCS/CCR depending on where the local cluster runs, a warning against using private connection hostnames as proxy_address between two ECH deployments, and a billing tip (CCS/CCR traffic is metered as Data out on the deployment the data leaves).
• Adds a remote clusters limitation note to the shared private connectivity limitations snippet (_snippets/private-connectivity-limitations-ech.md), which renders on the AWS PrivateLink, Azure Private Link, and GCP Private Service Connect pages: deployment-to-deployment remote cluster traffic does not traverse the customer's private endpoint.

Why

Recent support escalation (SDH via #cloud-networking Slack, Jul 17-24): a customer tried to configure CCR between two ECH deployments in Azure (eastus <-> westus2) using the Private Link hostname as proxy_address, which cannot work — PL hostnames only resolve inside the customer's VNet. The existing docs cover which filter type to use when network security is enabled, but not which connection paths are supported, and both support and the customer were confused about:

1. Whether the PL hostname can be used for ECH-to-ECH remote clusters (no).
2. Which direction private connectivity supports CCS/CCR (customer network -> ECH only; :9400 is open on the Azure PL LBs — ECPTRAFFIC-1076 — and :9443/RCS 2.0 was addressed in ECPTRAFFIC-1293).
3. How CCR traffic is billed (Data out on the deployment the data leaves — messaging confirmed with platform-billing, Jul 24).

Test plan

• Docs build passes
• New subsection renders correctly on deploy-manage/remote-clusters
• Snippet note renders on the AWS, Azure, and GCP private connectivity pages
• Anchor #remote-clusters-connection-paths resolves from the snippet link

Made with Cursor

[cla-checker-service]

💚 CLA has been signed

[github-actions]

Elastic Docs AI PR menu

Check the box to run an AI review for this pull request.

• Review docs changes (docs-review). Status: not started.

Powered by GitHub Agentic Workflows and docs-actions. For more information, reach out to the docs team.

[github-actions]

✅ Elastic Docs Style Checker (Vale)

No issues found on modified lines!

---

The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale.

[github-actions]

🔍 Preview links for changed docs

• deploy-manage/remote-clusters.md

[eedugon]

Great addition to the docs, thanks!!

I've shared a few comments, suggesting a small update in the title, because the main focus on our messages are about private connectivity.

There's one sentence that was contradictory with the rest of the PR and I've suggested to change the introductory path of the section (including a link to private connectivity docs, as we didn't have any in the section).

Let me know your thoughts!

Note that I've removed in the intro the message about 9400, 9443, API key, and TLS-based auth methods, as IMO that's out of the scope of this doc and it's explained already in all the setup docs plus the doc about authentication methods for RCS. But if we consider it's useful to add it also here we can find the way.

[jakommo]

Left a few minor / clarification comment, but LGTM in general.

[shainaraskas]

I think this PR will always fail CI because of the cursoragent commit ... might need to be recreated

[alxchalkias]

Addressed all open review items and rebuilt the branch per @shainaraskas' CLA note:

• Recreated as a single commit authored by me, without the cursoragent co-author trailer that was failing the CLA check. Review credit for @eedugon's and @shainaraskas' suggestions is preserved as co-author trailers. All previously reviewed content is unchanged except the items below.
• Fixed a broken table: one applied suggestion had dropped a duplicate of the warning text into the middle of the connection-paths table, splitting it. Removed.
• CCS billing direction (@jakommo): the tip now states explicitly that Data out is metered on the deployment that holds the data — for CCR the deployment you replicate from, for CCS the remote deployment being searched.
• Error symptom (@jakommo): the warning now names the failure mode (unknown host / UnknownHostException in the ES logs) so users can find this doc from the error.
• CRLF/^M noise (@jakommo): the file now keeps main's original line endings with the new section appended in LF — the diff is a clean ~22-line addition.

CI should be green now; ready for another look.

[eedugon]

LGTM!

[nikfot]

Added some comments for clarity.