latest changes working in local testing

corelight · Jun 27, 2024 · 171ed17 · 171ed17
1 parent 01ff41c
commit 171ed17
Show file tree

Hide file tree

Showing 4 changed files with 12 additions and 15 deletions.
diff --git a/load_balancer.tf b/load_balancer.tf
@@ -25,7 +25,7 @@ resource "azurerm_lb_backend_address_pool" "monitoring_pool" {
 resource "azurerm_lb_probe" "sensor_health_check_probe" {
   loadbalancer_id     = azurerm_lb.scale_set_lb.id
   name                = var.lb_health_check_probe_name
-  port                = 41080
+  port                = 443
   request_path        = "/api/system/healthcheck/"
   protocol            = "Https"
   interval_in_seconds = 30
@@ -62,8 +62,8 @@ resource "azurerm_lb_rule" "monitoring_health_check_rule" {
   name                           = var.lb_health_check_rule_name
   loadbalancer_id                = azurerm_lb.scale_set_lb.id
   protocol                       = "Tcp"
-  backend_port                   = var.health_check_port
-  frontend_port                  = var.health_check_port
+  backend_port                   = 443
+  frontend_port                  = 443
   frontend_ip_configuration_name = azurerm_lb.scale_set_lb.frontend_ip_configuration[0].name
   backend_address_pool_ids = [
     azurerm_lb_backend_address_pool.management_pool.id

diff --git a/scale_set.tf b/scale_set.tf
@@ -31,8 +31,8 @@ resource "azurerm_linux_virtual_machine_scale_set" "sensor_scale_set" {
     primary = true
 
     ip_configuration {
-      primary   = false
       name      = "management-nic-ip-cfg"
+      primary   = true
       subnet_id = azurerm_subnet.subnet.id
       load_balancer_backend_address_pool_ids = [
         azurerm_lb_backend_address_pool.management_pool.id
@@ -43,8 +43,8 @@ resource "azurerm_linux_virtual_machine_scale_set" "sensor_scale_set" {
   network_interface {
     name = "monitoring-nic"
     ip_configuration {
-      primary   = false
       name      = "monitoring-nic-ip-cfg"
+      primary   = true
       subnet_id = azurerm_subnet.subnet.id
       load_balancer_backend_address_pool_ids = [
         azurerm_lb_backend_address_pool.monitoring_pool.id

diff --git a/sensor_config.tf b/sensor_config.tf
@@ -1,12 +1,17 @@
+locals {
+  # https://learn.microsoft.com/en-us/azure/load-balancer/load-balancer-custom-probe-overview#probe-source-ip-address
+  azure_lb_health_check_probe_ip = "168.63.129.16/32"
+}
+
 module "sensor_config" {
   source = "github.com/corelight/terraform-config-sensor"
 
   fleet_community_string                       = var.community_string
   sensor_license                               = var.license_key
   sensor_management_interface_name             = "eth0"
   sensor_monitoring_interface_name             = "eth1"
-  sensor_health_check_probe_source_ranges_cidr = azurerm_subnet.subnet.address_prefixes
-  sensor_health_check_http_port                = var.health_check_port
+  sensor_health_check_probe_source_ranges_cidr = [local.azure_lb_health_check_probe_ip]
+  sensor_health_check_http_port                = 443
   gzip_config                                  = true
   base64_encode_config                         = true
   enrichment_enabled                           = var.enrichment_storage_account_name != "" && var.enrichment_storage_container_name != ""

diff --git a/variables.tf b/variables.tf
@@ -153,20 +153,12 @@ variable "lb_health_check_rule_name" {
   default     = "healthcheck-lb-rule"
 }
 
-variable "health_check_port" {
-  description = "the port number for the HTTP health check request"
-  type        = string
-  default     = "41080"
-}
-
 variable "lb_ssh_rule_name" {
   description = "Name of the load balancer rule for SSH traffic"
   type        = string
   default     = "management-ssh-lb-rule"
 }
 
-
-
 variable "tags" {
   description = "Any tags that should be applied to resources deployed by the module"
   type        = object({})