Maybe it is insecure by default because it was faster to build it that way. (Totes understandable.)

However, if there are other reasons, e.g., default-secure clusters would break use cases and make things harder for internal folks, then that could be a great incentive to make it easier to do the right thing!

Suggestion: flip the default, and if internal users need an insecure cluster, they need to pass --insecure and we print the same warning we provide to our users. Delicious dog food!

(Filing because my experience working on adding secure options to the "Build an App" docs is teaching me that (at least from Java) doing it the "right way" is quite complex! But in the bad, uninteresting, fiddly and hard-to-get-right way, not in any of the good ways.)

Epic CRDB-10428

Jira issue: CRDB-5690