tctl
tctl copied to clipboard
Toggle the TLS configuration based on the Frontend URL format
Is your feature request related to a problem? Please describe.
Currently if TLS is enabled OR Nginx is used for the TLS termination towards the Frontend tctl does not know if it should activate the TLS unless one of the relevant flags is toggled - https://github.com/temporalio/temporal/blob/bdeff26cfe99248bd66bd1302abdf636f1fcc373/tools/cli/factory.go#L182
This requires specifying unnecessary flags in the case authorization is not mTLS but rather another method just to activate the TLS.
Describe the solution you'd like
Instead of activating TLS via flags, format of the temporal address can be like this grpc://<IP or DNS>:<port>
for plain connection and grpcs://<IP or DNS>:<port>
for the TLS. If preffix is not specified then connection can still revert to the non-TLS OR TLS based on one of the flags added. Adding this feature would help with making the Temporal protocol communication intent between the client and the frontend clean.
Describe alternatives you've considered
Adding flags we don't need to force tctl use TLS
e.g. for the valid public certificate we can activate the TLS by using the tls_server_name which is not really needed cause the cert is valid for the server name.
tctl --ad 'public-frontend.superhost.com:443' --tls_server_name 'public-frontend.superhost.com' namespace list