Document the splunk-ca ConfigMap for private-CA Splunk HEC endpoints

The operator now folds a user-supplied CA from a splunk-ca ConfigMap
into the log collector's trusted bundle, the same way syslog-ca works
for syslog, so Splunk HEC endpoints with self-signed certificates can
be used. Add the step to the Splunk archiving instructions and a
release-note line.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: hjiawei

calico-enterprise/observability/elastic/archive-storage.mdx

@@ -210,6 +210,18 @@ $[prodname] uses Splunk's **HTTP Event Collector** to send data to Splunk server
    kubectl edit logcollector tigera-secure
    ```
 
+4. If your `https` HTTP Event Collector endpoint serves a certificate signed by a private CA (for example, a self-hosted Splunk Enterprise with a self-signed certificate), create a configmap in the tigera-operator namespace named, splunk-ca, with the CA certificate in the field name tls.crt. Example:
+
+   :::note
+
+   Skip this step if publicCA bundle is good enough to verify the server certificates.
+
+   :::
+
+   ```bash
+   kubectl create configmap splunk-ca --from-file=tls.crt -n tigera-operator
+   ```
+
 </TabItem>
 
 </Tabs>

calico-enterprise/release-notes/index.mdx

@@ -30,6 +30,8 @@ This version of Calico Enterprise is based on [Calico Open Source $[openSourceVe
 
 $[prodname] now collects logs with Fluent Bit in place of Fluentd. The operator deploys `calico-fluent-bit` in the `calico-system` namespace with operator-rendered configuration and migrates Fluentd tail positions during upgrade, so logs are not re-shipped. Log buffering moves to on-disk filesystem storage, so buffered chunks now survive pod restarts.
 
+Splunk log archiving now supports HTTP Event Collector endpoints whose certificates are signed by a private CA: create a `splunk-ca` configmap in the `tigera-operator` namespace, the same way `syslog-ca` works for syslog. For more information, see [Archive logs to storage](../observability/elastic/archive-storage.mdx).
+
 For more information, see [Filter flow logs](../observability/elastic/flow/filtering.mdx) and [Elasticsearch and Fluent Bit metrics](../operations/monitor/metrics/elasticsearch-and-fluentd-metrics.mdx).
 
 ### Deprecated and removed features