code: func connectToAuthService(cfg *service.Config) (client auth.ClientI, err error) {
  	// connect to the local auth server by default:
  	cfg.Auth.Enabled = true
  	if len(cfg.AuthServers) == 0 {
  		cfg.AuthServers = []utils.NetAddr{
  			*defaults.AuthConnectAddr(),
  		}
  	}
  	// read the host SSH keys and use them to open an SSH connection to the auth service
  	i, err := auth.ReadLocalIdentity(filepath.Join(cfg.DataDir, teleport.ComponentProcess), auth.IdentityID{Role: teleport.RoleAdmin, HostUUID: cfg.HostUUID})
  	if err != nil {
  		// the "admin" identity is not present? this means the tctl is running NOT on the auth server.
  		if trace.IsNotFound(err) {
  			return nil, trace.AccessDenied("tctl must be used on the auth server")
  		}
  		return nil, trace.Wrap(err)
  	}
  	tlsConfig, err := i.TLSConfig(cfg.CipherSuites)
  	if err != nil {
  		return nil, trace.Wrap(err)
  	}
  	client, err = auth.NewTLSClient(auth.ClientConfig{Addrs: cfg.AuthServers, TLS: tlsConfig})
  	if err != nil {
  		return nil, trace.Wrap(err)
  	}
  
  	// Check connectivity by calling something on the client.
  	_, err = client.GetClusterName()
  	if err != nil {
  		utils.Consolef(os.Stderr, teleport.ComponentClient,
  			"Cannot connect to the auth server: %v.\nIs the auth server running on %v?",
  			err, cfg.AuthServers[0].Addr)
  		os.Exit(1)
  	}
  	return client, nil
  }
docs: // connectToAuthService creates a valid client connection to the auth service