Migrating sensor config to centralized module (#7)

corelight · Jul 1, 2024 · 18e722d · 18e722d
1 parent d997643
commit 18e722d
Show file tree

Hide file tree

Showing 6 changed files with 24 additions and 105 deletions.
diff --git a/data.tf b/data.tf
diff --git a/scale_set.tf b/scale_set.tf
@@ -9,7 +9,7 @@ resource "azurerm_linux_virtual_machine_scale_set" "sensor_scale_set" {
   resource_group_name = var.resource_group_name
   sku                 = var.virtual_machine_size
   instances           = 1
-  custom_data         = var.enrichment_storage_account_name == "" ? data.cloudinit_config.config.rendered : data.cloudinit_config.config_with_enrichment.rendered
+  custom_data         = module.sensor_config.cloudinit_config.rendered
 
   source_image_id = var.corelight_sensor_image_id
 
@@ -31,8 +31,8 @@ resource "azurerm_linux_virtual_machine_scale_set" "sensor_scale_set" {
     primary = true
 
     ip_configuration {
-      primary   = false
       name      = "management-nic-ip-cfg"
+      primary   = true
       subnet_id = azurerm_subnet.subnet.id
       load_balancer_backend_address_pool_ids = [
         azurerm_lb_backend_address_pool.management_pool.id
@@ -43,8 +43,8 @@ resource "azurerm_linux_virtual_machine_scale_set" "sensor_scale_set" {
   network_interface {
     name = "monitoring-nic"
     ip_configuration {
-      primary   = false
       name      = "monitoring-nic-ip-cfg"
+      primary   = true
       subnet_id = azurerm_subnet.subnet.id
       load_balancer_backend_address_pool_ids = [
         azurerm_lb_backend_address_pool.monitoring_pool.id

diff --git a/sensor_config.tf b/sensor_config.tf
@@ -0,0 +1,21 @@
+locals {
+  # https://learn.microsoft.com/en-us/azure/load-balancer/load-balancer-custom-probe-overview#probe-source-ip-address
+  azure_lb_health_check_probe_ip = "168.63.129.16/32"
+}
+
+module "sensor_config" {
+  source = "github.com/corelight/terraform-config-sensor"
+
+  fleet_community_string                       = var.community_string
+  sensor_license                               = var.license_key
+  sensor_management_interface_name             = "eth0"
+  sensor_monitoring_interface_name             = "eth1"
+  sensor_health_check_probe_source_ranges_cidr = [local.azure_lb_health_check_probe_ip]
+  sensor_health_check_http_port                = 443
+  gzip_config                                  = true
+  base64_encode_config                         = true
+  enrichment_enabled                           = var.enrichment_storage_account_name != "" && var.enrichment_storage_container_name != ""
+  enrichment_cloud_provider_name               = "azure"
+  enrichment_storage_account_name              = var.enrichment_storage_account_name
+  enrichment_bucket_name                       = var.enrichment_storage_container_name
+}
diff --git a/templates/sensor_init.tpl b/templates/sensor_init.tpl
diff --git a/templates/sensor_init_with_enrichment.tpl b/templates/sensor_init_with_enrichment.tpl
diff --git a/variables.tf b/variables.tf
@@ -159,8 +159,6 @@ variable "lb_ssh_rule_name" {
   default     = "management-ssh-lb-rule"
 }
 
-
-
 variable "tags" {
   description = "Any tags that should be applied to resources deployed by the module"
   type        = object({})