feat: added logall_json + filebeat archive configurations to enhance …

charts/wazuh/README.md

@@ -269,6 +269,7 @@ Same applies when changing `dashboard.cred.password`
 | `wazuh.serviceAccount.annotations`                 | Annotations for service account                                                        | `{}`                                   |
 | `wazuh.serviceAccount.name`                        | Name of the service account                                                            | `wazuh-manager`                        |
 | `wazuh.syslog_enable`                              | Enables the syslog of the wazuh instance.                                              | `true`                                 |
+| `wazuh.archives.enabled`                           | Index every event, not just alerts.                                                    | `false`                                |
 | `wazuh.key`                                        | Defines the key of the wazuh cluster.                                                  | `c98b62a9b6169ac5f67dae55ae4a9088`     |
 | `wazuh.images.repository`                          | name of the image used.                                                                | `wazuh/wazuh-manager`                  |
 | `wazuh.images.tag`                                 | Tag of the image.                                                                      | `4.14.3`                               |
@@ -303,6 +304,7 @@ Same applies when changing `dashboard.cred.password`
 | `wazuh.localDecoder`                               | Override for local_decoder.xml. If empty, files/local_decoder.xml is used.             | `""`                                   |
 | `wazuh.localRules`                                 | Override for local_rules.xml. If empty, files/local_rules.xml is used.                 | `""`                                   |
 | `wazuh.internalOptions`                            | Override for internal_options.conf. If empty, files/internal_options.conf is used.     | `""`                                   |
+| `wazuh.filebeat.config`                            | Override for filebeat.yml. If empty, the generated config is used.                     | `""`                                   |
 | `wazuh.master.enabled`                             | Enable the master                                                                      | `true`                                 |
 | `wazuh.master.annotations`                         | additional annotations set on statefulset.                                             | `{}`                                   |
 | `wazuh.master.extraPodLabels`                      | Extra labels to add to the master pods.                                                | `{}`                                   |

charts/wazuh/templates/_filebeat_config.tpl

@@ -0,0 +1,33 @@
+{{/* vim: set filetype=mustache: */}}
+{{- define "wazuh.filebeat_config" -}}
+# Wazuh - Filebeat configuration file
+filebeat.modules:
+  - module: wazuh
+    alerts:
+      enabled: true
+    archives:
+      enabled: {{ .Values.wazuh.archives.enabled }}
+
+setup.template.json.enabled: true
+setup.template.overwrite: true
+setup.template.json.path: '/etc/filebeat/wazuh-template.json'
+setup.template.json.name: 'wazuh'
+setup.ilm.enabled: false
+output.elasticsearch:
+  hosts: ['https://wazuh.indexer:9200']
+  #username:
+  #password:
+  #ssl.verification_mode:
+  #ssl.certificate_authorities:
+  #ssl.certificate:
+  #ssl.key:
+
+logging.metrics.enabled: false
+
+seccomp:
+  default_action: allow
+  syscalls:
+  - action: allow
+    names:
+    - rseq
+{{ end -}}

charts/wazuh/templates/_helpers.tpl

@@ -186,6 +186,16 @@ Define serviceaccount names
 {{- end -}}
 {{- end -}}
 
+{{/*
+Whether to mount our own filebeat.yml. Only when asked for, so existing releases keep
+using the image's own file.
+*/}}
+{{- define "wazuh.filebeat.overridden" -}}
+{{- if or .Values.wazuh.archives.enabled .Values.wazuh.filebeat.config -}}
+true
+{{- end -}}
+{{- end -}}
+
 {{- define "wazuh.manager.serviceAccountName" -}}
 {{- if .Values.wazuh.serviceAccount.create -}}
     {{ default (printf "%s-manager" (include "wazuh.fullname" .)) .Values.wazuh.serviceAccount.name }}

charts/wazuh/templates/_ossec_conf.tpl

@@ -6,7 +6,7 @@
     <jsonout_output>yes</jsonout_output>
     <alerts_log>yes</alerts_log>
     <logall>no</logall>
-    <logall_json>no</logall_json>
+    <logall_json>{{ ternary "yes" "no" $root.Values.wazuh.archives.enabled }}</logall_json>
     <email_notification>no</email_notification>
     <smtp_server>smtp.example.wazuh.com</smtp_server>
     <email_from>ossecm@example.wazuh.com</email_from>

charts/wazuh/templates/manager/configmap.yaml

@@ -11,6 +11,9 @@ data:
   local_decoder.xml: {{ .Values.wazuh.localDecoder | default (.Files.Get "files/local_decoder.xml") | default "<decoder></decoder>" | quote }}
   local_rules.xml: {{ .Values.wazuh.localRules | default (.Files.Get "files/local_rules.xml") | default "<group></group>" | quote }}
   internal_options.conf: {{ .Values.wazuh.internalOptions | default (.Files.Get "files/internal_options.conf") | default "# fallback" | quote }}
+{{- if include "wazuh.filebeat.overridden" . }}
+  filebeat.yml: {{ .Values.wazuh.filebeat.config | default (include "wazuh.filebeat_config" .) | quote }}
+{{- end }}
 
 {{- if .Values.wazuh.agentGroupConf }}
 {{- range .Values.wazuh.agentGroupConf }}

charts/wazuh/templates/manager/master/statefulset.yaml

@@ -185,6 +185,12 @@ spec:
               name: config
               readOnly: true
               subPath: local_rules.xml
+            {{- if include "wazuh.filebeat.overridden" . }}
+            - mountPath: /var/ossec/data_tmp/exclusion/etc/filebeat/filebeat.yml
+              name: config
+              readOnly: true
+              subPath: filebeat.yml
+            {{- end }}
             # PVC
             - name: {{ include "wazuh.fullname" . }}-manager-master
               mountPath: /var/ossec/api/configuration

charts/wazuh/templates/manager/worker/statefulset.yaml

@@ -184,6 +184,12 @@ spec:
               name: filebeat-certs
               readOnly: true
               subPath: tls.key
+            {{- if include "wazuh.filebeat.overridden" . }}
+            - mountPath: /var/ossec/data_tmp/exclusion/etc/filebeat/filebeat.yml
+              name: config
+              readOnly: true
+              subPath: filebeat.yml
+            {{- end }}
             # PVC
             - name: {{ include "wazuh.fullname" . }}-manager-worker
               mountPath: /var/ossec/api/configuration

charts/wazuh/tests/render_test.sh

@@ -63,6 +63,17 @@ assert_contains() {
   fi
 }
 
+assert_not_contains() {
+  local name="$1" haystack="$2" needle="$3"
+  if grep -qF -- "$needle" <<<"$haystack"; then
+    echo "FAIL: $name (expected NOT to find: $needle)"
+    fail=$((fail + 1))
+  else
+    echo "PASS: $name"
+    pass=$((pass + 1))
+  fi
+}
+
 LISTENERSET=templates/dashboard/listenerset.yaml
 HTTPROUTE=templates/dashboard/httproute.yaml
 BACKENDTLSPOLICY=templates/dashboard/backendtlspolicy.yaml
@@ -152,6 +163,45 @@ assert_contains "internalUsers.hash is templated to the actual password hash" "$
   "hash: '\$2a\$12\$zGWIT7wkPKT/zww3bmMyp.KuWXH4RzgxiB91Q8NGFcqpyPy.R2Rcq'"
 rm -f /tmp/wazuh-render-test-173-values.yaml
 
+MANAGER_CONFIGMAP=templates/manager/configmap.yaml
+MASTER_STS=templates/manager/master/statefulset.yaml
+WORKER_STS=templates/manager/worker/statefulset.yaml
+FILEBEAT_MOUNT=/var/ossec/data_tmp/exclusion/etc/filebeat/filebeat.yml
+
+echo "== #174: archives disabled (default) leaves the image's filebeat.yml alone =="
+out=$(render_only "$MANAGER_CONFIGMAP")
+assert_contains "logall_json stays off on the master" "$out" '<logall_json>no</logall_json>'
+assert_not_contains "no filebeat.yml is added to the ConfigMap" "$out" "filebeat.yml:"
+for sts in "$MASTER_STS" "$WORKER_STS"; do
+  out=$(render_only "$sts")
+  assert_not_contains "no filebeat.yml mount in ${sts##*/manager/}" "$out" "$FILEBEAT_MOUNT"
+done
+
+echo "== #174: wazuh.archives.enabled turns on both halves at once =="
+archives_args=(--set wazuh.archives.enabled=true)
+out=$(render_only "$MANAGER_CONFIGMAP" "${archives_args[@]}")
+assert_not_contains "logall_json is on for master and worker alike" "$out" '<logall_json>no</logall_json>'
+assert_contains "filebeat ships the archives fileset" "$out" 'archives:\n      enabled: true'
+assert_contains "the alerts fileset is left enabled" "$out" 'alerts:\n      enabled: true'
+# The entrypoint seds these lines in place; without them filebeat ships nothing.
+for placeholder in "hosts: ['https://wazuh.indexer:9200']" '#username:' '#password:' \
+                   '#ssl.verification_mode:' '#ssl.certificate_authorities:' '#ssl.certificate:' '#ssl.key:'; do
+  assert_contains "entrypoint placeholder is preserved: $placeholder" "$out" "$placeholder"
+done
+for sts in "$MASTER_STS" "$WORKER_STS"; do
+  out=$(render_only "$sts" "${archives_args[@]}")
+  assert_contains "filebeat.yml is mounted in ${sts##*/manager/}" "$out" "$FILEBEAT_MOUNT"
+done
+
+echo "== #174: wazuh.filebeat.config replaces the file without enabling archives =="
+override_args=(--set 'wazuh.filebeat.config=# my own filebeat')
+out=$(render_only "$MANAGER_CONFIGMAP" "${override_args[@]}")
+assert_contains "the override replaces the generated config" "$out" '# my own filebeat'
+assert_not_contains "the generated config is not also emitted" "$out" 'filebeat.modules'
+assert_contains "an override alone does not enable archives" "$out" '<logall_json>no</logall_json>'
+out=$(render_only "$MASTER_STS" "${override_args[@]}")
+assert_contains "an override alone still mounts filebeat.yml" "$out" "$FILEBEAT_MOUNT"
+
 echo
 echo "==================================="
 echo "PASS: $pass  FAIL: $fail"

charts/wazuh/values.yaml

@@ -659,6 +659,13 @@ wazuh:
     name: "wazuh-manager"
   ## @param wazuh.syslog_enable Enables the syslog of the wazuh instance.
   syslog_enable: true
+  ## By default only alerts are indexed, so events matching no rule (forwarded syslog, for
+  ## instance) never reach the dashboard. This sets <logall_json> on master and worker and
+  ## enables filebeat's archives fileset; both are needed, hence one switch.
+  ## Archives are unfiltered, so expect a large increase in indexer storage.
+  ## @param wazuh.archives.enabled Index every event, not just alerts.
+  archives:
+    enabled: false
   ## @param wazuh.key Defines the key of the wazuh cluster.
   key: "c98b62a9b6169ac5f67dae55ae4a9088"
   ## @param wazuh.images.repository name of the image used.
@@ -745,6 +752,12 @@ wazuh:
   localRules: ""
   ## @param wazuh.internalOptions Override for internal_options.conf. If empty, files/internal_options.conf is used.
   internalOptions: ""
+  ## Replaces the whole filebeat.yml. Keep the `hosts:` line and the commented-out
+  ## `#username:` / `#password:` / `#ssl.*` keys of the default: the entrypoint fills them
+  ## in from the chart's env vars, and ships nothing if they are missing.
+  ## @param wazuh.filebeat.config Override for filebeat.yml. If empty, the generated config is used.
+  filebeat:
+    config: ""
   ## @skip wazuh.agentGroupConf
   agentGroupConf:
     - name: example