Optional Kali Linux attack box for Azure deployments by mkultraWasHere · Pull Request #354 · dreadnode/DreadGOAD

mkultraWasHere · 2026-07-12T17:40:30Z

Added

modules/terraform-azure-kali/ — Terraform module deploying a headless Kali VM on a dedicated /28 subnet with NSG locked to bastion-only SSH
--with-kali flag on infra apply/plan/destroy to opt in to the attack box
dreadgoad bastion ssh kali auto-detects AttackBox role tag, SSH key, and username
dreadgoad doctor warns if Kali marketplace terms are not accepted
env create auto-derives kali subnet CIDR (10.X.4.0/28) from the VNet CIDR
Terragrunt wiring in infra/azure/goad-deployment/test/centralus/kali/ gated by DREADGOAD_ENABLE_AZURE_KALI

Changed

deriveAzureSubnets returns an azureSubnets struct (bastion, controller, kali) instead of two strings
createAzureEnvHCL template includes kali subnet/instance variables
Default kali VM size is Standard_D2s_v3 (2 vCPU, 8 GB) — B2s is capacity-restricted in centralus

Fixed

bastion command PersistentPreRunE now calls config.Init() — previously skipped config file loading entirely (pre-existing bug)
infra destroy always includes the kali module when the kali/ directory exists, preventing orphaned VMs

Notes

Kali marketplace image (kali-linux:kali:kali-2026-2) requires one-time az vm image terms accept per subscription
Tested live against dreadindex deployment in braddreadnode tenant — VM deployed, bastion SSH verified

Adds an opt-in Kali VM that deploys on its own subnet inside the lab VNet, accessible only via Azure Bastion SSH. Marketplace image, headless, no provisioning needed — stock Kali tooling for AD attack exercises. - New `terraform-azure-kali` module (subnet, NSG, NIC, VM with marketplace plan) - `--with-kali` flag on infra apply/plan/destroy - Destroy always includes kali to prevent orphaned VMs - `dreadgoad bastion ssh kali` auto-detects AttackBox role, user, and key - Doctor check warns if marketplace terms not accepted - `env create` auto-derives kali subnet CIDR from VNet - Fix: bastion PersistentPreRunE now calls config.Init() (pre-existing bug) Co-Authored-By: Claude <noreply@anthropic.com>

Copilot

Pull request overview

Adds an optional Azure “attack box” (headless Kali VM) that can be deployed alongside existing Azure lab infrastructure, wired through Terragrunt and surfaced via CLI flags and Bastion SSH conveniences.

Changes:

Introduces a new terraform-azure-kali module that provisions a Kali VM on a dedicated subnet with Bastion-scoped SSH and emits connection outputs.
Adds --with-kali wiring to Azure infra plan/apply/destroy, plus environment config generation for the derived Kali subnet.
Enhances CLI UX: Bastion SSH auto-detects the Kali “AttackBox” role/key/user, and doctor checks Kali marketplace terms acceptance.

Reviewed changes

Copilot reviewed 12 out of 12 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
modules/terraform-azure-kali/versions.tf	Defines Terraform/provider constraints for the new Kali module.
modules/terraform-azure-kali/variables.tf	Declares inputs for Kali subnet, VM sizing, SSH key handling, and image/plan metadata.
modules/terraform-azure-kali/README.md	Documents module requirements/inputs/outputs (terraform-docs-style).
modules/terraform-azure-kali/outputs.tf	Exposes VM/subnet/NSG IDs, private IP, and SSH key info for consumers.
modules/terraform-azure-kali/main.tf	Implements subnet + NSG + NIC + Kali VM provisioning and optional ephemeral SSH key generation.
infra/azure/goad-deployment/test/env.hcl	Adds Kali subnet/SSH source/instance size locals for the test environment.
infra/azure/goad-deployment/test/centralus/kali/terragrunt.hcl	Adds gated Terragrunt module wiring for the optional Kali deployment.
cli/internal/doctor/checks.go	Adds a `doctor` warning/pass check for Kali Azure Marketplace terms acceptance.
cli/cmd/infra_cmd.go	Adds `--with-kali` and ensures destroy includes Kali when the `kali/` module directory exists.
cli/cmd/env_cmd.go	Extends Azure subnet derivation to include Kali and emits Kali locals in generated `env.hcl`.
cli/cmd/env_cmd_test.go	Updates subnet derivation tests to validate the new Kali subnet output.
cli/cmd/bastion.go	Fixes config initialization and auto-detects Kali AttackBox role for Bastion SSH defaults.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Co-Authored-By: Claude <noreply@anthropic.com>

Copilot

Pull request overview

Copilot reviewed 12 out of 12 changed files in this pull request and generated 2 comments.

Match the controller module's description pattern. Co-Authored-By: Claude <noreply@anthropic.com>

Extract role-based SSH defaults into resolveRoleDefaults() to bring runBastionSSH below the gocyclo threshold of 15. Add BEGIN/END_TF_DOCS markers to the kali README to match the controller module pattern. Co-Authored-By: Claude <noreply@anthropic.com>

Copilot

Pull request overview

Copilot reviewed 12 out of 12 changed files in this pull request and generated 1 comment.

Match the pattern of other Azure modules that track their lock files. Co-Authored-By: Claude <noreply@anthropic.com>

Copilot

Pull request overview

Copilot reviewed 12 out of 13 changed files in this pull request and generated 3 comments.

Files not reviewed (1)

modules/terraform-azure-kali/.terraform.lock.hcl: Generated file

Same pre-existing bug as bastion — child commands override the root PersistentPreRunE without calling config.Init(), so the config file is never loaded. Co-Authored-By: Claude <noreply@anthropic.com>

Replace tofu-generated lock file (registry.opentofu.org) with terraform registry hashes to match the other modules. Also only set authType to ssh-key when the ephemeral key file actually exists on disk. Co-Authored-By: Claude <noreply@anthropic.com>

Copilot

Pull request overview

Copilot reviewed 14 out of 15 changed files in this pull request and generated 2 comments.

Files not reviewed (1)

modules/terraform-azure-kali/.terraform.lock.hcl: Generated file

…ms check Only apply role-based username/authType when the ephemeral key file exists, preventing password-auth fallback on key-only VMs. Also use EqualFold for the marketplace terms check since az CLI may return "True" instead of "true". Co-Authored-By: Claude <noreply@anthropic.com>

Copilot

Pull request overview

Copilot reviewed 14 out of 15 changed files in this pull request and generated 2 comments.

Files not reviewed (1)

modules/terraform-azure-kali/.terraform.lock.hcl: Generated file

mkultraWasHere · 2026-07-12T20:19:54Z

+  validation {
+    condition     = can(cidrhost(var.kali_subnet_cidr, 0))
+    error_message = "kali_subnet_cidr must be a valid IPv4 CIDR block."
+  }


Refuted. The controller module uses the identical validation pattern and error message (variables.tf:31-34). Azure subnets reject IPv6 at the API level anyway — tightening HCL validation for an impossible scenario that existing modules also don't guard against is unnecessary churn.

mkultraWasHere · 2026-07-12T20:19:56Z

+	// Auto-pick the ephemeral key for known VM roles. A failed live lookup
+	// is non-fatal — we just fall back to the user-supplied flag values.
+	if defaults := resolveRoleDefaults(client, ctx, cfg.Env, args[0]); defaults != nil && defaults.sshKey != "" {


Refuted. resolveAzureHost (line 195) already called FindInstanceByHostname to resolve the VM ID moments earlier — the data is cached or at worst one extra API call (~200ms) before an interactive SSH session. The pre-existing controller code made the same unconditional lookup. Adding flag-changed guards would add complexity for negligible gain.

mkultraWasHere requested a review from Copilot July 12, 2026 17:41

Copilot started reviewing on behalf of mkultraWasHere July 12, 2026 17:42 View session

Copilot AI reviewed Jul 12, 2026

View reviewed changes

Comment thread modules/terraform-azure-kali/README.md Outdated

chore: regenerate terraform-azure-kali docs after instance_size change

3f6ce1c

Co-Authored-By: Claude <noreply@anthropic.com>

mkultraWasHere requested a review from Copilot July 12, 2026 17:58

Copilot started reviewing on behalf of mkultraWasHere July 12, 2026 17:58 View session

Copilot AI reviewed Jul 12, 2026

View reviewed changes

Comment thread modules/terraform-azure-kali/variables.tf

Comment thread cli/internal/doctor/checks.go

mkultraWasHere and others added 2 commits July 12, 2026 14:07

fix: clarify ephemeral_key_output_path is conditionally required

e1b62a7

Match the controller module's description pattern. Co-Authored-By: Claude <noreply@anthropic.com>

Merge branch 'main' into feat/azure-kali-attack-box

f8afcf8

mkultraWasHere marked this pull request as ready for review July 12, 2026 18:37

mkultraWasHere requested a review from Copilot July 12, 2026 18:49

Copilot started reviewing on behalf of mkultraWasHere July 12, 2026 18:50 View session

Copilot AI reviewed Jul 12, 2026

View reviewed changes

Comment thread modules/terraform-azure-kali/versions.tf

chore: commit terraform-azure-kali lock file

18af48d

Match the pattern of other Azure modules that track their lock files. Co-Authored-By: Claude <noreply@anthropic.com>

mkultraWasHere requested a review from Copilot July 12, 2026 18:57

Copilot started reviewing on behalf of mkultraWasHere July 12, 2026 18:58 View session

Copilot AI reviewed Jul 12, 2026

View reviewed changes

Comment thread modules/terraform-azure-kali/.terraform.lock.hcl Outdated

Comment thread cli/cmd/bastion.go

Comment thread cli/cmd/infra_cmd.go

mkultraWasHere and others added 2 commits July 12, 2026 15:00

fix: add config.Init() to runcmd and ssm PersistentPreRunE

df98874

Same pre-existing bug as bastion — child commands override the root PersistentPreRunE without calling config.Init(), so the config file is never loaded. Co-Authored-By: Claude <noreply@anthropic.com>

mkultraWasHere requested a review from Copilot July 12, 2026 19:12

Copilot started reviewing on behalf of mkultraWasHere July 12, 2026 19:13 View session

Copilot AI reviewed Jul 12, 2026

View reviewed changes

Comment thread cli/cmd/bastion.go Outdated

Comment thread cli/internal/doctor/checks.go Outdated

mkultraWasHere requested a review from Copilot July 12, 2026 20:04

Copilot started reviewing on behalf of mkultraWasHere July 12, 2026 20:04 View session

Copilot AI reviewed Jul 12, 2026

View reviewed changes

mkultraWasHere added this pull request to the merge queue Jul 12, 2026

Merged via the queue into main with commit 53f1c43 Jul 12, 2026
14 checks passed

mkultraWasHere deleted the feat/azure-kali-attack-box branch July 12, 2026 20:40

Navigation Menu

Uh oh!

Optional Kali Linux attack box for Azure deployments - #354

Optional Kali Linux attack box for Azure deployments#354
mkultraWasHere merged 9 commits into
mainfrom
feat/azure-kali-attack-box

mkultraWasHere commented Jul 12, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

mkultraWasHere Jul 12, 2026

Uh oh!

mkultraWasHere Jul 12, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

mkultraWasHere commented Jul 12, 2026

Added

Changed

Fixed

Notes

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

mkultraWasHere Jul 12, 2026

Choose a reason for hiding this comment

Uh oh!

mkultraWasHere Jul 12, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants