Use TLS in CLI client

Signed-off-by: Mathias L. Baumann <[email protected]>

Author: Marenz

RELEASE_NOTES.md

@@ -11,7 +11,7 @@
 
 ## New Features
 
-<!-- Here goes the main new features and examples or instructions on how to use them -->
+* TLS is now enabled by default for the CLI client.
 
 ## Bug Fixes
 

src/frequenz/client/dispatch/__main__.py

@@ -36,6 +36,46 @@
 DEFAULT_DISPATCH_API_PORT = 50051
 
 
+def ssl_channel_credentials_from_files(
+    root_cert_path: str | None = None,
+    client_cert_path: str | None = None,
+    client_key_path: str | None = None,
+) -> grpc.ChannelCredentials:
+    """Create credentials for use with an SSL-enabled Channel.
+
+    Using the provided certificate and key files.
+
+    Args:
+      root_cert_path: Path to the PEM-encoded root certificates file,
+                      or None to retrieve them from a default location chosen by gRPC runtime.
+      client_cert_path: Path to the PEM-encoded client certificate file.
+      client_key_path: Path to the PEM-encoded client private key file.
+
+    Returns:
+      A ChannelCredentials for use with an SSL-enabled Channel.
+    """
+    root_certificates = None
+    if root_cert_path is not None:
+        with open(root_cert_path, "rb") as f:
+            root_certificates = f.read()
+
+    certificate_chain = None
+    if client_cert_path is not None:
+        with open(client_cert_path, "rb") as f:
+            certificate_chain = f.read()
+
+    private_key = None
+    if client_key_path is not None:
+        with open(client_key_path, "rb") as f:
+            private_key = f.read()
+
+    return grpc.ssl_channel_credentials(
+        root_certificates=root_certificates,
+        private_key=private_key,
+        certificate_chain=certificate_chain,
+    )
+
+
 def get_client(*, host: str, port: int, key: str) -> Client:
     """Get a new client instance.
 
@@ -47,7 +87,10 @@ def get_client(*, host: str, port: int, key: str) -> Client:
     Returns:
         Client: A new client instance.
     """
-    channel = grpc.aio.insecure_channel(f"{host}:{port}")
+    channel = grpc.aio.secure_channel(
+        f"{host}:{port}",
+        credentials=ssl_channel_credentials_from_files(),
+    )
     return Client(grpc_channel=channel, svc_addr=f"{host}:{port}", key=key)