Kubernetes - Ensure correct Wazuh manager certificates ownership

[teddytpc1]

Description

During some 5.0.0 tests, some issues related to the Wazuh manager were found. The cause is an incorrect ownership of the certificate files (root:root). According to the Wazuh manager installation documentation, the right owner is wazuh-manager:wazuh-manager:

• https://documentation.xdrsiem.wazuh.info/repos/wazuh/main/ref/getting-started/installation.html#deploy-certificates

Command:
sudo chown -R wazuh-manager:wazuh-manager /var/wazuh-manager/etc/certs

Tasks

• Analyze the impact of the change
• Apply the solution
• Update the documentation (if applicable)
• Test the changes (local and EKS) and provide evidence of the files' ownership

DRI

• @teddytpc1

[vcerenu]

Update

I adapted the certificate configuration script applied to the wazuh-docker repository, modifying some certificate permission parameters, since kubectl does not have the same file access permissions as the Docker daemon on the host.

[vcerenu]

Update

I added extra steps in the pods' initContainer to modify the permissions of the certificates that need to be added to the path /var/wazuh-manager/etc/certs/, because the Wazuh manager container starts with the root user and uses that same user when mounting the files, so those files must be processed before mounting them in the final container

$ kubectl exec -it pod/wazuh-manager-master-0 -n wazuh -- /bin/bash
Defaulted container "wazuh-manager" out of: wazuh-manager, init-wazuh-etc (init)
bash-5.2# ls -ltr /var/wazuh-manager/etc/
total 36
-rw-r-----. 1 root          root           114 Mar 27 21:53 localtime
-rw-r-----. 1 root          wazuh-manager  319 Apr  6 13:51 wazuh-manager-internal-options.conf
-rw-rw----. 1 wazuh-manager wazuh-manager    0 Apr  6 13:51 client.keys
drwxrws---. 3 wazuh-manager wazuh-manager 4096 Apr  6 16:13 outputs
drwxrws---. 3 root          wazuh-manager 4096 Apr  6 16:13 shared
dr-x--S---. 2 wazuh-manager wazuh-manager 4096 Apr  7 12:56 certs
-rw-------. 1 root          wazuh-manager 3272 Apr  7 12:56 sslmanager.key
-rw-r--r--. 1 root          wazuh-manager 1842 Apr  7 12:56 sslmanager.cert
-rw-r--r--. 1 root          wazuh-manager    8 Apr  7 12:56 authd.pass
-rw-rw----. 1 root          wazuh-manager 2050 Apr  7 12:56 wazuh-manager.conf
bash-5.2# ls -ltr /var/wazuh-manager/etc/certs/
total 12
-r-x------. 1 wazuh-manager wazuh-manager 1204 Apr  7 13:19 root-ca.pem
-r-x------. 1 wazuh-manager wazuh-manager 1334 Apr  7 13:19 manager.pem
-r-x------. 1 wazuh-manager wazuh-manager 1704 Apr  7 13:19 manager-key.pem
bash-5.2#