From 45c4e47fab07fe6522b40cfe800e9d650e1d4a8b Mon Sep 17 00:00:00 2001 From: Jorge Falcon <22119513+BCTBB@users.noreply.github.com> Date: Fri, 20 Feb 2026 15:57:10 -0500 Subject: [PATCH] Dogfood and loadtest - mysql require secure transport on (#40211) - Adds require_secure_transport for mysql connections to the db_cluster parameter group for dogfood and loadtest environments. ``` db_cluster_parameters = { require_secure_transport = "ON" } ``` --- infrastructure/dogfood/terraform/aws-tf-module/free.tf | 3 +++ infrastructure/dogfood/terraform/aws-tf-module/main.tf | 5 ++++- infrastructure/loadtesting/terraform/infra/locals.tf | 4 +++- infrastructure/loadtesting/terraform/infra/main.tf | 3 +++ 4 files changed, 13 insertions(+), 2 deletions(-) diff --git a/infrastructure/dogfood/terraform/aws-tf-module/free.tf b/infrastructure/dogfood/terraform/aws-tf-module/free.tf index d396a6ada0..916b300282 100644 --- a/infrastructure/dogfood/terraform/aws-tf-module/free.tf +++ b/infrastructure/dogfood/terraform/aws-tf-module/free.tf @@ -77,6 +77,9 @@ module "free" { # 8mb up from 262144 (256k) default sort_buffer_size = 8388608 } + db_cluster_parameters = { + require_secure_transport = "ON" + } # VPN allowed_cidr_blocks = ["10.255.1.0/24", "10.255.2.0/24", "10.255.3.0/24"] subnets = module.main.vpc.database_subnets diff --git a/infrastructure/dogfood/terraform/aws-tf-module/main.tf b/infrastructure/dogfood/terraform/aws-tf-module/main.tf index 62ab7df86c..613f2fc98b 100644 --- a/infrastructure/dogfood/terraform/aws-tf-module/main.tf +++ b/infrastructure/dogfood/terraform/aws-tf-module/main.tf @@ -79,7 +79,7 @@ locals { # Webhook Results & Status Logging Destination FLEET_SERVER_VPP_VERIFY_TIMEOUT = "20m" FLEET_SERVER_GZIP_RESPONSES = "true" - + # Load TLS Certificate for RDS Authentication FLEET_MYSQL_TLS_CA = local.cert_path FLEET_MYSQL_READ_REPLICA_TLS_CA = local.cert_path @@ -154,6 +154,9 @@ module "main" { # 8mb up from 262144 (256k) default sort_buffer_size = 8388608 } + db_cluster_parameters = { + require_secure_transport = "ON" + } # VPN allowed_cidr_blocks = ["10.255.1.0/24", "10.255.2.0/24", "10.255.3.0/24"] backup_retention_period = 30 diff --git a/infrastructure/loadtesting/terraform/infra/locals.tf b/infrastructure/loadtesting/terraform/infra/locals.tf index 9dfa2abd54..70e96e2e98 100644 --- a/infrastructure/loadtesting/terraform/infra/locals.tf +++ b/infrastructure/loadtesting/terraform/infra/locals.tf @@ -42,8 +42,10 @@ locals { FLEET_OSQUERY_ASYNC_HOST_REDIS_SCAN_KEYS_COUNT = "10000" FLEET_REDIS_MAX_OPEN_CONNS = "500" FLEET_REDIS_MAX_IDLE_CONNS = "500" + FLEET_AUTH_SSO_SESSION_VALIDITY_PERIOD = "15m" + FLEET_MDM_SSO_RATE_LIMIT_PER_MINUTE = "500" FLEET_SERVER_GZIP_RESPONSES = "true" - + # Load TLS Certificate for RDS Authentication FLEET_MYSQL_TLS_CA = local.cert_path diff --git a/infrastructure/loadtesting/terraform/infra/main.tf b/infrastructure/loadtesting/terraform/infra/main.tf index 66fd315883..9b4d2a3b3a 100644 --- a/infrastructure/loadtesting/terraform/infra/main.tf +++ b/infrastructure/loadtesting/terraform/infra/main.tf @@ -52,6 +52,9 @@ module "loadtest" { # 8mb up from 262144 (256k) default sort_buffer_size = 8388608 } + db_cluster_parameters = { + require_secure_transport = "ON" + } } redis_config = { name = local.customer