Move to new RDS CAs

[Mark-Simulacrum]

The current RDS instances we use ~all (as far as I know) use a soon-to-be-expired root CA to authenticate the TLS connections. That CA is going to expire on August 22, 2024, so we need to migrate to the new set of CAs.

I've put up a sample PR doing so in rust-lang/triagebot#1772. Presuming that goes well it'd be great to get PRs for:

• rustc-perf (code)
• docs.rs (unclear whether code to connect to RDS is checked in or affected)
• discord-mods-bot (unclear whether still in use or affected, I do see some references to postgres) (repo)

cc @jdno - possibly a good onboarding issue for code changes but also time-sensitive

Once these are all done we should update our terraform config for the shared DB to use the new set of roots. It probably doesn't matter which we pick but I'd lean towards the rds-ca-ecc384-g1 root.

[syphar]

docs.rs (unclear whether code to connect to RDS is checked in or affected)

production docs.rs doesn't use RDS, so you're safe to do whatever you want :)

To my knowledge there is a test environment where a new ECS based setup was tested, where we have RDS, perhaps @jdno knows more

[Mark-Simulacrum]

Yeah, I know there's no production usage, but it likely makes sense to update code at the same time while it's in cache for the non-prod usage.

[jdno]

Once these are all done we should update our terraform config for the shared DB to use the new set of roots.

We still need to update RDS to actually use the new CA.

[MarcoIeni]

Updated docs.rs staging DB 👍

terragrunt plan detects no changes 🎉

[MarcoIeni]

I found a db called docs-rs-prod in the legacy account. Terraform here.

syphar said that docs.rs doesn't use RDS, so now I'm wondering if this DB used.

• If it's used we need to do the code change before updating the RDS certificate authority.
• If it's not used, shall we delete it?

[MarcoIeni]

I'm checking the data of this DB to understand if it's still used.

Apparently the releases table wasn't updated in 2 years

Same is true for the queue table

The crates table also stopped updating after the same date.

Same for the builds table.

I think we got the idea 😅

Probably this DB was used until 2 years ago and now isn't used anymore.

How to proceed

1. First step: stop the DB and wait 1 week to see if somebody is mad
2. Second step: delete the DB if the data is available somewhere else (e.g. in the crates.io db?)

Of course I need approval from the docs-rs team to proceed 👍

@syphar what do you think?

[MarcoIeni]

Deleted the docs-rs-prod DBs in rust-lang/simpleinfra#474 and rust-lang/simpleinfra#475 👍

Tomorrow I will update the CA of the shared db. Then we can close this issue 💪

[MarcoIeni]

Updated the CA of shared DB. Zulip discussion here