This addon adds osquery-perf hosts to the Fleet installation. These are generally used for loadtesting or other testing purposes. See https://github.com/fleetdm/fleet/tree/main/cmd/osquery-perf to learn more about osquery-perf itself.

This addon:

Creates an AWS Secrets Manager secret that will be used to store the enroll secret that the osquery-perf hosts use to enroll into Fleet. AND
Optionally takes a string, enroll_secret (string), to create an AWS Secrets Manager secret version, in the AWS Secrets Manager Secret created by the addon. If not specified directly to the module, the secret will need to have its SecretString populated with the enroll secret manually once everything is setup in order for the osquery-perf hosts to connect. OR
Optionally takes a AWS Secrets Manager secret ARN, enroll_secret_arn (string), for an already existing Secrets Manager secret.

If both an enroll_secret and an enroll_secret_arn are defined, the module will prioritize the enroll_secret_arn. If neither an enroll_secret or an enroll_secret_arn are defined, the module will create a placeholder secret, you will need to add a secret_version manually and terraform apply one more time.

Below is an example implementation of the module:

module "osquery_perf" {
  source                     = "github.com/fleetdm/fleet-terraform//addons/osquery-perf?ref=tf-mod-addon-osquery-perf-v1.2.2"
  customer_prefix            = "fleet"
  ecs_cluster                = module.main.byo-vpc.byo-db.byo-ecs.service.cluster
  subnets                    = module.main.byo-vpc.byo-db.byo-ecs.service.network_configuration[0].subnets
  security_groups            = module.main.byo-vpc.byo-db.byo-ecs.service.network_configuration[0].security_groups
  ecs_iam_role_arn           = module.main.byo-vpc.byo-db.byo-ecs.iam_role_arn
  ecs_execution_iam_role_arn = module.main.byo-vpc.byo-db.byo-ecs.execution_iam_role_arn
  server_url                 = "https://${aws_route53_record.main.fqdn}"
  osquery_perf_image         = local.osquery_perf_image
  extra_flags                = ["--os_templates", "mac10.14.6,ubuntu_22.04,windows_11"]
  logging_options            = module.main.byo-vpc.byo-db.byo-ecs.logging_config
  # Optional - One of enroll_secret or enroll_secret_arn can be used, but neither are required.
  #            If neither are passed in, you will need to populate the secret version manually,
  #            in the secret that is created by the addon.
  # enroll_secret            = "mGNJvwKhs4PIa6ZNxMiXqqBfXKO67n2Y"
  # enroll_secret_arn        = "arn:aws:secretsmanager:<region>:<account-id>:secret:<secret-name>"
}

Requirements

No requirements.

Providers

Name	Version
aws	n/a

Modules

No modules.

Resources

Name	Type
aws_ecs_service.osquery_perf	resource
aws_ecs_task_definition.osquery_perf	resource
aws_kms_alias.enroll_secret	resource
aws_kms_key.enroll_secret	resource
aws_secretsmanager_secret.enroll_secret	resource
aws_secretsmanager_secret_version.enroll_secret	resource
aws_secretsmanager_secret_version.enroll_secret	data source

Inputs

Name	Description	Type	Default	Required
customer_prefix	customer prefix to use to namespace all resources	`string`	`"fleet"`	no
ecs_cluster	n/a	`string`	n/a	yes
ecs_execution_iam_role_arn	n/a	`string`	n/a	yes
ecs_iam_role_arn	n/a	`string`	n/a	yes
enroll_secret	Value of the enroll secret to be created, if enroll_secret_arn is not passed in	`string`	`null`	no
enroll_secret_arn	ARN of the AWS Secret Version containing the enroll secret	`string`	`null`	no
extra_flags	n/a	`list(string)`	`[]`	no
loadtest_containers	n/a	`number`	`1`	no
logging_options	n/a	object({ awslogs-group = string awslogs-region = string awslogs-stream-prefix = string })	n/a	yes
osquery_perf_image	n/a	`string`	n/a	yes
security_groups	n/a	`list(string)`	n/a	yes
server_url	n/a	`string`	n/a	yes
subnets	n/a	`list(string)`	n/a	yes
task_size	n/a	object({ cpu = optional(number, 256) memory = optional(number, 1024) })	{ "cpu": 256, "memory": 1024 }	no

Outputs

Name	Description
osquery_perf_enroll_secret_id	n/a
osquery_perf_enroll_secret_name	n/a