Skip to content

Commit f4736f5

Browse files
toniiiiktoniiiik
committed
add overlays
1 parent 608e82d commit f4736f5

19 files changed

Lines changed: 304 additions & 56 deletions

‎README.md‎

Lines changed: 11 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -46,16 +46,23 @@ To deploy a cluster on your local environment (like Minikube, Kind or Microk8s)
4646
├── README.md
4747
├── upgrade.md
4848
├── VERSION.json
49+
├── overlays
50+
| ├── certmanager
51+
| ├── external-certs
52+
| └── local-certs
4953
└── wazuh
5054
├── base
5155
│   ├── storage-class.yaml
52-
│   └── wazuh-ns.yaml
56+
│   ├── wazuh-ns.yaml
57+
│   └── kustomization.yaml
5358
├── certs
59+
│   ├── kustomization.yaml
5460
│   ├── dashboard_http
5561
│   │   └── generate_certs.sh
5662
│   └── indexer_cluster
5763
│   └── generate_certs.sh
5864
├── indexer_stack
65+
│   ├── kustomization.yaml
5966
│   ├── wazuh-dashboard
6067
│   │   ├── dashboard_conf
6168
│   │   │   └── opensearch_dashboards.yml
@@ -75,8 +82,10 @@ To deploy a cluster on your local environment (like Minikube, Kind or Microk8s)
7582
│   ├── indexer-cred-secret.yaml
7683
│   ├── wazuh-api-cred-secret.yaml
7784
│   ├── wazuh-authd-pass-secret.yaml
78-
│   └── wazuh-cluster-key-secret.yaml
85+
│   ├── wazuh-cluster-key-secret.yaml
86+
│   └── kustomization.yaml
7987
└── wazuh_managers
88+
   ├── kustomization.yaml
8089
├── wazuh-cluster-svc.yaml
8190
├── wazuh_conf
8291
│   ├── master.conf

‎instructions.md‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -110,6 +110,12 @@ $ git clone https://github.com/wazuh/wazuh-kubernetes.git
110110
$ cd wazuh-kubernetes
111111
```
112112

113+
there are three options how to deploy wazuh.
114+
1. deploy using generated certificates. Follow instruction in 3.1
115+
2. deploy using certmanager. This requires certmanager is deployed in the cluster. To deploy cluster please follow [https://cert-manager.io/docs/installation/](https://cert-manager.io/docs/installation/)
116+
2.1. deploy using certmanager overlay. `kustomize build overlays/certmanager | kubectl apply -f -`
117+
3. deploy using external certs (external secrets or other option). `kustomize build overlays/external-certs | kubectl apply -f -`
118+
113119
### Step 3.1: Setup SSL certificates
114120

115121
You can generate self-signed certificates for the Wazuh indexer cluster using the script at `wazuh/certs/indexer_cluster/generate_certs.sh` or provide your own.

‎overlays/certmanager/certmanager/ca-certificate.yaml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
apiVersion: cert-manager.io/v1
2+
kind: Certificate
3+
metadata:
4+
name: wazuh-ca
5+
namespace: wazuh
6+
spec:
7+
isCA: true
8+
commonName: wazuh-ca
9+
secretName: wazuh-ca
10+
issuerRef:
11+
name: selfsigned-bootstrap
12+
kind: Issuer
13+
14+

‎overlays/certmanager/certmanager/certificates.yaml‎

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
apiVersion: cert-manager.io/v1
2+
kind: Certificate
3+
metadata:
4+
name: wazuh-dashboard-cert
5+
namespace: wazuh
6+
spec:
7+
secretName: dashboard-certs
8+
dnsNames:
9+
- dashboard
10+
- dashboard.wazuh
11+
- dashboard.wazuh.svc
12+
issuerRef:
13+
name: wazuh-ca-issuer
14+
kind: Issuer
15+
---
16+
apiVersion: cert-manager.io/v1
17+
kind: Certificate
18+
metadata:
19+
name: wazuh-indexer-node
20+
namespace: wazuh
21+
spec:
22+
secretName: indexer-node
23+
commonName: indexer
24+
subject:
25+
organizations:
26+
- Company
27+
localities:
28+
- California
29+
countries:
30+
- US
31+
issuerRef:
32+
name: wazuh-ca-issuer
33+
kind: Issuer
34+
---
35+
apiVersion: cert-manager.io/v1
36+
kind: Certificate
37+
metadata:
38+
name: wazuh-indexer-admin
39+
namespace: wazuh
40+
spec:
41+
secretName: indexer-admin
42+
commonName: admin
43+
subject:
44+
organizations:
45+
- Company
46+
localities:
47+
- California
48+
countries:
49+
- US
50+
issuerRef:
51+
name: wazuh-ca-issuer
52+
kind: Issuer
53+
---
54+
apiVersion: cert-manager.io/v1
55+
kind: Certificate
56+
metadata:
57+
name: wazuh-filebeat-client
58+
namespace: wazuh
59+
spec:
60+
secretName: filebeat-client
61+
commonName: filebeat
62+
subject:
63+
organizations:
64+
- Company
65+
localities:
66+
- California
67+
countries:
68+
- US
69+
issuerRef:
70+
name: wazuh-ca-issuer
71+
kind: Issuer
72+
73+

‎overlays/certmanager/certmanager/issuer-selfsigned.yaml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
apiVersion: cert-manager.io/v1
2+
kind: Issuer
3+
metadata:
4+
name: selfsigned-bootstrap
5+
namespace: wazuh
6+
spec:
7+
selfSigned: {}
8+
9+

‎overlays/certmanager/certmanager/issuer-wazuh-ca.yaml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
apiVersion: cert-manager.io/v1
2+
kind: Issuer
3+
metadata:
4+
name: wazuh-ca-issuer
5+
namespace: wazuh
6+
spec:
7+
ca:
8+
secretName: wazuh-ca
9+
10+

‎overlays/certmanager/kustomization.yaml‎

Lines changed: 19 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,23 @@
11
kind: Kustomization
22
apiVersion: kustomize.config.k8s.io/v1beta1
33

4-
bases:
5-
- ../../wazuh
4+
namespace: wazuh
65

7-
# components:
8-
# - ../../wazuh/certs
6+
resources:
7+
- ../../wazuh/base
8+
- ../../wazuh/secrets
9+
- ../../wazuh/wazuh_managers
10+
- ../../wazuh/indexer_stack
11+
- certmanager/issuer-selfsigned.yaml
12+
- certmanager/ca-certificate.yaml
13+
- certmanager/issuer-wazuh-ca.yaml
14+
- certmanager/certificates.yaml
15+
16+
patches:
17+
- path: patches/patch-dashboard-vol.yaml
18+
- path: patches/patch-indexer-vol.yaml
19+
- path: patches/patch-manager-master-vol.yaml
20+
- path: patches/patch-manager-worker-vol.yaml
21+
22+
23+

‎overlays/certmanager/patches/patch-dashboard-vol.yaml‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
apiVersion: apps/v1
2+
kind: Deployment
3+
metadata:
4+
name: wazuh-dashboard
5+
namespace: wazuh
6+
spec:
7+
template:
8+
spec:
9+
volumes:
10+
- name: dashboard-certs
11+
secret: null
12+
projected:
13+
sources:
14+
- secret:
15+
name: dashboard-certs
16+
items:
17+
- key: tls.crt
18+
path: cert.pem
19+
- key: tls.key
20+
path: key.pem
21+
- key: ca.crt
22+
path: root-ca.pem
23+
24+

‎overlays/certmanager/patches/patch-indexer-vol.yaml‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
apiVersion: apps/v1
2+
kind: StatefulSet
3+
metadata:
4+
name: wazuh-indexer
5+
namespace: wazuh
6+
spec:
7+
template:
8+
spec:
9+
volumes:
10+
- name: indexer-certs
11+
secret: null
12+
projected:
13+
defaultMode: 0600
14+
sources:
15+
- secret:
16+
name: indexer-node
17+
items:
18+
- key: tls.crt
19+
path: node.pem
20+
- key: tls.key
21+
path: node-key.pem
22+
- key: ca.crt
23+
path: root-ca.pem
24+
- secret:
25+
name: indexer-admin
26+
items:
27+
- key: tls.crt
28+
path: admin.pem
29+
- key: tls.key
30+
path: admin-key.pem
31+
- name: indexer-conf
32+
configMap:
33+
name: indexer-conf
34+
defaultMode: 0600
35+
36+

‎overlays/certmanager/patches/patch-manager-master-vol.yaml‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
apiVersion: apps/v1
2+
kind: StatefulSet
3+
metadata:
4+
name: wazuh-manager-master
5+
namespace: wazuh
6+
spec:
7+
template:
8+
spec:
9+
volumes:
10+
- name: filebeat-certs
11+
secret: null
12+
projected:
13+
defaultMode: 0600
14+
sources:
15+
- secret:
16+
name: filebeat-client
17+
items:
18+
- key: tls.crt
19+
path: filebeat.pem
20+
- key: tls.key
21+
path: filebeat-key.pem
22+
- key: ca.crt
23+
path: root-ca.pem
24+
25+

0 commit comments

Comments
 (0)
⚡