environment variables in Synthetics run from Private locations (#3979)

Adding instructions for using environment variables in synthetics run
from Private Locations

---------

Co-authored-by: Mike Birnstiehl <[email protected]>
Co-authored-by: Benjamin Ironside Goldstein <[email protected]>

Author: 3 people

solutions/observability/synthetics/work-with-params-secrets.md

@@ -137,6 +137,8 @@ Params are viewable in plain-text by administrators and other users with `all` p
 
 ::::
 
+### Use environment variables in Synthetics Projects
+
 If you are managing monitors with a Synthetics project, you can use environment variables in your `synthetics.config.ts` or `synthetics.config.js` file.
 
 The example below uses `process.env.MY_URL` to reference a variable named `MY_URL` defined in the environment and assigns its value to a param. That param can then be used in both lightweight and browser monitors that are managed in the Synthetics project:
@@ -148,3 +150,40 @@ export default {
   }
 };
 ```
+
+### Use environment variables with Private Locations
+
+If you are using Kibana-managed monitors and running them on a Private Location, you can inject environment variables directly into the agent's runtime environment.
+This method allows you to keep sensitive values out of the {{kib}} UI. Instead, it stores those values on the infrastructure hosting the {{agent}}.
+
+::::{warning}
+These variables are accessible to all monitors running on this specific Private Location.
+
+::::
+
+#### 1. Pass variables to the Private Location
+When starting your Private Location ({{agent}}) using Docker, use the `--env` flag to pass your variables. 
+
+
+
+```bash
+docker run \
+  --env FLEET_ENROLL=1 \
+  --env FLEET_URL={fleet_server_host_url} \
+  --env FLEET_ENROLLMENT_TOKEN={enrollment_token} \
+  --env MY_URL={secret_value} \
+  --cap-add=NET_RAW \
+  --cap-add=SETUID \
+  -d --restart=unless-stopped \
+  docker.elastic.co/elastic-agent/elastic-agent-complete:X.X.X
+```
+
+#### 2. Reference variables in the inline script
+In the Synthetics **Monitors** editor in {{kib}}, you can now access these variables using `process.env`.
+
+```js
+step('navigate to secure url', async () => {
+  // The script reads the environment variable from the private location elastic agent container
+  await page.goto(process.env.MY_URL);
+});
+```