From 076ee199df459d579bff6ac7085364287173c971 Mon Sep 17 00:00:00 2001 From: Mohammed Date: Thu, 6 Aug 2026 16:48:14 +0200 Subject: [PATCH] feat: added logall_json + filebeat archive configurations to enhance syslog integration --- charts/wazuh/README.md | 2 + charts/wazuh/templates/_filebeat_config.tpl | 33 ++++++++++++ charts/wazuh/templates/_helpers.tpl | 10 ++++ charts/wazuh/templates/_ossec_conf.tpl | 2 +- charts/wazuh/templates/manager/configmap.yaml | 3 ++ .../templates/manager/master/statefulset.yaml | 6 +++ .../templates/manager/worker/statefulset.yaml | 6 +++ charts/wazuh/tests/render_test.sh | 50 +++++++++++++++++++ charts/wazuh/values.yaml | 13 +++++ 9 files changed, 124 insertions(+), 1 deletion(-) create mode 100644 charts/wazuh/templates/_filebeat_config.tpl diff --git a/charts/wazuh/README.md b/charts/wazuh/README.md index 2e3d754..f8e1b92 100644 --- a/charts/wazuh/README.md +++ b/charts/wazuh/README.md @@ -269,6 +269,7 @@ Same applies when changing `dashboard.cred.password` | `wazuh.serviceAccount.annotations` | Annotations for service account | `{}` | | `wazuh.serviceAccount.name` | Name of the service account | `wazuh-manager` | | `wazuh.syslog_enable` | Enables the syslog of the wazuh instance. | `true` | +| `wazuh.archives.enabled` | Index every event, not just alerts. | `false` | | `wazuh.key` | Defines the key of the wazuh cluster. | `c98b62a9b6169ac5f67dae55ae4a9088` | | `wazuh.images.repository` | name of the image used. | `wazuh/wazuh-manager` | | `wazuh.images.tag` | Tag of the image. | `4.14.3` | @@ -303,6 +304,7 @@ Same applies when changing `dashboard.cred.password` | `wazuh.localDecoder` | Override for local_decoder.xml. If empty, files/local_decoder.xml is used. | `""` | | `wazuh.localRules` | Override for local_rules.xml. If empty, files/local_rules.xml is used. | `""` | | `wazuh.internalOptions` | Override for internal_options.conf. If empty, files/internal_options.conf is used. | `""` | +| `wazuh.filebeat.config` | Override for filebeat.yml. If empty, the generated config is used. | `""` | | `wazuh.master.enabled` | Enable the master | `true` | | `wazuh.master.annotations` | additional annotations set on statefulset. | `{}` | | `wazuh.master.extraPodLabels` | Extra labels to add to the master pods. | `{}` | diff --git a/charts/wazuh/templates/_filebeat_config.tpl b/charts/wazuh/templates/_filebeat_config.tpl new file mode 100644 index 0000000..63084a5 --- /dev/null +++ b/charts/wazuh/templates/_filebeat_config.tpl @@ -0,0 +1,33 @@ +{{/* vim: set filetype=mustache: */}} +{{- define "wazuh.filebeat_config" -}} +# Wazuh - Filebeat configuration file +filebeat.modules: + - module: wazuh + alerts: + enabled: true + archives: + enabled: {{ .Values.wazuh.archives.enabled }} + +setup.template.json.enabled: true +setup.template.overwrite: true +setup.template.json.path: '/etc/filebeat/wazuh-template.json' +setup.template.json.name: 'wazuh' +setup.ilm.enabled: false +output.elasticsearch: + hosts: ['https://wazuh.indexer:9200'] + #username: + #password: + #ssl.verification_mode: + #ssl.certificate_authorities: + #ssl.certificate: + #ssl.key: + +logging.metrics.enabled: false + +seccomp: + default_action: allow + syscalls: + - action: allow + names: + - rseq +{{ end -}} diff --git a/charts/wazuh/templates/_helpers.tpl b/charts/wazuh/templates/_helpers.tpl index 82d40d9..b78d96c 100644 --- a/charts/wazuh/templates/_helpers.tpl +++ b/charts/wazuh/templates/_helpers.tpl @@ -186,6 +186,16 @@ Define serviceaccount names {{- end -}} {{- end -}} +{{/* +Whether to mount our own filebeat.yml. Only when asked for, so existing releases keep +using the image's own file. +*/}} +{{- define "wazuh.filebeat.overridden" -}} +{{- if or .Values.wazuh.archives.enabled .Values.wazuh.filebeat.config -}} +true +{{- end -}} +{{- end -}} + {{- define "wazuh.manager.serviceAccountName" -}} {{- if .Values.wazuh.serviceAccount.create -}} {{ default (printf "%s-manager" (include "wazuh.fullname" .)) .Values.wazuh.serviceAccount.name }} diff --git a/charts/wazuh/templates/_ossec_conf.tpl b/charts/wazuh/templates/_ossec_conf.tpl index 3199cfd..08f251e 100644 --- a/charts/wazuh/templates/_ossec_conf.tpl +++ b/charts/wazuh/templates/_ossec_conf.tpl @@ -6,7 +6,7 @@ yes yes no - no + {{ ternary "yes" "no" $root.Values.wazuh.archives.enabled }} no smtp.example.wazuh.com ossecm@example.wazuh.com diff --git a/charts/wazuh/templates/manager/configmap.yaml b/charts/wazuh/templates/manager/configmap.yaml index c013638..21a38f0 100644 --- a/charts/wazuh/templates/manager/configmap.yaml +++ b/charts/wazuh/templates/manager/configmap.yaml @@ -11,6 +11,9 @@ data: local_decoder.xml: {{ .Values.wazuh.localDecoder | default (.Files.Get "files/local_decoder.xml") | default "" | quote }} local_rules.xml: {{ .Values.wazuh.localRules | default (.Files.Get "files/local_rules.xml") | default "" | quote }} internal_options.conf: {{ .Values.wazuh.internalOptions | default (.Files.Get "files/internal_options.conf") | default "# fallback" | quote }} +{{- if include "wazuh.filebeat.overridden" . }} + filebeat.yml: {{ .Values.wazuh.filebeat.config | default (include "wazuh.filebeat_config" .) | quote }} +{{- end }} {{- if .Values.wazuh.agentGroupConf }} {{- range .Values.wazuh.agentGroupConf }} diff --git a/charts/wazuh/templates/manager/master/statefulset.yaml b/charts/wazuh/templates/manager/master/statefulset.yaml index f307bd7..86b71fe 100644 --- a/charts/wazuh/templates/manager/master/statefulset.yaml +++ b/charts/wazuh/templates/manager/master/statefulset.yaml @@ -185,6 +185,12 @@ spec: name: config readOnly: true subPath: local_rules.xml + {{- if include "wazuh.filebeat.overridden" . }} + - mountPath: /var/ossec/data_tmp/exclusion/etc/filebeat/filebeat.yml + name: config + readOnly: true + subPath: filebeat.yml + {{- end }} # PVC - name: {{ include "wazuh.fullname" . }}-manager-master mountPath: /var/ossec/api/configuration diff --git a/charts/wazuh/templates/manager/worker/statefulset.yaml b/charts/wazuh/templates/manager/worker/statefulset.yaml index 6f7ba31..d47e157 100644 --- a/charts/wazuh/templates/manager/worker/statefulset.yaml +++ b/charts/wazuh/templates/manager/worker/statefulset.yaml @@ -184,6 +184,12 @@ spec: name: filebeat-certs readOnly: true subPath: tls.key + {{- if include "wazuh.filebeat.overridden" . }} + - mountPath: /var/ossec/data_tmp/exclusion/etc/filebeat/filebeat.yml + name: config + readOnly: true + subPath: filebeat.yml + {{- end }} # PVC - name: {{ include "wazuh.fullname" . }}-manager-worker mountPath: /var/ossec/api/configuration diff --git a/charts/wazuh/tests/render_test.sh b/charts/wazuh/tests/render_test.sh index 87e2cdd..aee23dc 100755 --- a/charts/wazuh/tests/render_test.sh +++ b/charts/wazuh/tests/render_test.sh @@ -63,6 +63,17 @@ assert_contains() { fi } +assert_not_contains() { + local name="$1" haystack="$2" needle="$3" + if grep -qF -- "$needle" <<<"$haystack"; then + echo "FAIL: $name (expected NOT to find: $needle)" + fail=$((fail + 1)) + else + echo "PASS: $name" + pass=$((pass + 1)) + fi +} + LISTENERSET=templates/dashboard/listenerset.yaml HTTPROUTE=templates/dashboard/httproute.yaml BACKENDTLSPOLICY=templates/dashboard/backendtlspolicy.yaml @@ -152,6 +163,45 @@ assert_contains "internalUsers.hash is templated to the actual password hash" "$ "hash: '\$2a\$12\$zGWIT7wkPKT/zww3bmMyp.KuWXH4RzgxiB91Q8NGFcqpyPy.R2Rcq'" rm -f /tmp/wazuh-render-test-173-values.yaml +MANAGER_CONFIGMAP=templates/manager/configmap.yaml +MASTER_STS=templates/manager/master/statefulset.yaml +WORKER_STS=templates/manager/worker/statefulset.yaml +FILEBEAT_MOUNT=/var/ossec/data_tmp/exclusion/etc/filebeat/filebeat.yml + +echo "== #174: archives disabled (default) leaves the image's filebeat.yml alone ==" +out=$(render_only "$MANAGER_CONFIGMAP") +assert_contains "logall_json stays off on the master" "$out" 'no' +assert_not_contains "no filebeat.yml is added to the ConfigMap" "$out" "filebeat.yml:" +for sts in "$MASTER_STS" "$WORKER_STS"; do + out=$(render_only "$sts") + assert_not_contains "no filebeat.yml mount in ${sts##*/manager/}" "$out" "$FILEBEAT_MOUNT" +done + +echo "== #174: wazuh.archives.enabled turns on both halves at once ==" +archives_args=(--set wazuh.archives.enabled=true) +out=$(render_only "$MANAGER_CONFIGMAP" "${archives_args[@]}") +assert_not_contains "logall_json is on for master and worker alike" "$out" 'no' +assert_contains "filebeat ships the archives fileset" "$out" 'archives:\n enabled: true' +assert_contains "the alerts fileset is left enabled" "$out" 'alerts:\n enabled: true' +# The entrypoint seds these lines in place; without them filebeat ships nothing. +for placeholder in "hosts: ['https://wazuh.indexer:9200']" '#username:' '#password:' \ + '#ssl.verification_mode:' '#ssl.certificate_authorities:' '#ssl.certificate:' '#ssl.key:'; do + assert_contains "entrypoint placeholder is preserved: $placeholder" "$out" "$placeholder" +done +for sts in "$MASTER_STS" "$WORKER_STS"; do + out=$(render_only "$sts" "${archives_args[@]}") + assert_contains "filebeat.yml is mounted in ${sts##*/manager/}" "$out" "$FILEBEAT_MOUNT" +done + +echo "== #174: wazuh.filebeat.config replaces the file without enabling archives ==" +override_args=(--set 'wazuh.filebeat.config=# my own filebeat') +out=$(render_only "$MANAGER_CONFIGMAP" "${override_args[@]}") +assert_contains "the override replaces the generated config" "$out" '# my own filebeat' +assert_not_contains "the generated config is not also emitted" "$out" 'filebeat.modules' +assert_contains "an override alone does not enable archives" "$out" 'no' +out=$(render_only "$MASTER_STS" "${override_args[@]}") +assert_contains "an override alone still mounts filebeat.yml" "$out" "$FILEBEAT_MOUNT" + echo echo "===================================" echo "PASS: $pass FAIL: $fail" diff --git a/charts/wazuh/values.yaml b/charts/wazuh/values.yaml index df7a415..99eef65 100644 --- a/charts/wazuh/values.yaml +++ b/charts/wazuh/values.yaml @@ -659,6 +659,13 @@ wazuh: name: "wazuh-manager" ## @param wazuh.syslog_enable Enables the syslog of the wazuh instance. syslog_enable: true + ## By default only alerts are indexed, so events matching no rule (forwarded syslog, for + ## instance) never reach the dashboard. This sets on master and worker and + ## enables filebeat's archives fileset; both are needed, hence one switch. + ## Archives are unfiltered, so expect a large increase in indexer storage. + ## @param wazuh.archives.enabled Index every event, not just alerts. + archives: + enabled: false ## @param wazuh.key Defines the key of the wazuh cluster. key: "c98b62a9b6169ac5f67dae55ae4a9088" ## @param wazuh.images.repository name of the image used. @@ -745,6 +752,12 @@ wazuh: localRules: "" ## @param wazuh.internalOptions Override for internal_options.conf. If empty, files/internal_options.conf is used. internalOptions: "" + ## Replaces the whole filebeat.yml. Keep the `hosts:` line and the commented-out + ## `#username:` / `#password:` / `#ssl.*` keys of the default: the entrypoint fills them + ## in from the chart's env vars, and ships nothing if they are missing. + ## @param wazuh.filebeat.config Override for filebeat.yml. If empty, the generated config is used. + filebeat: + config: "" ## @skip wazuh.agentGroupConf agentGroupConf: - name: example