fix(temporal): let SDK handle TLS when using API key auth

[rohansood10]

Description

Fixes the recurring 'tls: certificate required' error when connecting to Temporal Cloud using API key authentication.

Root Cause

When apiKey is provided, KEDA explicitly creates a TLS config via CreateTLSClientConfig() and passes it to the Temporal SDK. This overrides the SDK's built-in auto-TLS behavior for API key auth. The Temporal Go SDK (since temporalio/sdk-go#2126) auto-enables TLS with the correct configuration when an API key is provided and TLS is not explicitly set/disabled.

By explicitly setting a TLS config, KEDA was preventing the SDK from applying its own Temporal Cloud-compatible TLS settings, resulting in the server rejecting the connection because no client certificate was presented.

Fix

Only create an explicit TLS config when the user has provided custom TLS settings (CA cert, server name, or unsafeSsl). For the standard API key auth case, let the SDK handle TLS automatically.

Testing

All existing Temporal scaler tests pass. This fix requires integration testing with Temporal Cloud (API key auth) to fully validate — @cheelim1 has previously offered to test builds.

Checklist

• When introducing a new scaler, I agree with the scaling governance policy
• I have verified that my change is according to the deprecations & breaking changes policy
• Tests have been added (if applicable)
• Ensure make generate-scalers-schema has been run to update any outdated generated files
• Changelog has been updated and is aligned with our changelog requirements, only when the change impacts end users
• A PR is opened to update our Helm chart (repo) (if applicable, ie. when deployment manifests are modified)
• A PR is opened to update the documentation on (repo) (if applicable)
• Commits are signed with Developer Certificate of Origin (DCO - learn more)

Fixes #7443
Related: #7343, #6865

[github-actions]

Thank you for your contribution! 🙏

Please understand that we will do our best to review your PR and give you feedback as soon as possible, but please bear with us if it takes a little longer as expected.

While you are waiting, make sure to:

• Add an entry in our changelog in alphabetical order and link related issue
• Update the documentation, if needed
• Add unit & e2e tests for your changes
• GitHub checks are passing
• Is the DCO check failing? Here is how you can fix DCO issues

Once the initial tests are successful, a KEDA member will ensure that the e2e tests are run. Once the e2e tests have been successfully completed, the PR may be merged at a later date. Please be patient.

Learn more about our contribution guide.

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scanner	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[rickbrouwer]

All existing Temporal scaler tests pass. This fix requires integration testing with Temporal Cloud (API key auth) to fully validate — @cheelim1 has previously offered to test builds.

@cheelim1 I see from the description that you want to test this. If so, will you create a build yourself to test it? Or would you like me to create one for you? Thanks 🙂

[cheelim1]

@rickbrouwer i will build it myself and test it.