Today CockroachDB requires TLS for all client connections on TCP soon as a cluster is runnign securely.

(Unix socket connections already do not require TLS).

As discussed in #16188 (comment) and following, it may be interesting to introduce an alternate listener when the network environment (e.g. k8s) provides its own layer of transport security.

When this becomes available, the authentication should be configurable in a different way than TLS certificates (for example, to require passwords).

PostgreSQL already supports this by distinguishing hostssl and hostnossl rules in the HBA configuration. CockroachDB could do something similar.

Note that this enhancement does not require separate listeners, because the pg protocol already supports mixed TLS / non-TLS connections over a single port.