{"id":36945518,"url":"https://github.com/maximewewer/wazuh-operator","last_synced_at":"2026-07-15T10:00:39.180Z","repository":{"id":327391957,"uuid":"1107497919","full_name":"MaximeWewer/wazuh-operator","owner":"MaximeWewer","description":"Wazuh kubernetes operator","archived":false,"fork":false,"pushed_at":"2026-07-15T08:37:42.000Z","size":5022,"stargazers_count":8,"open_issues_count":1,"forks_count":2,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-07-15T09:17:07.846Z","etag":null,"topics":["crd","gitops","kubernetes","kubernetes-operator","operator","siem","wazuh","xdr"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/MaximeWewer.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2025-12-01T08:14:32.000Z","updated_at":"2026-07-15T08:33:29.000Z","dependencies_parsed_at":null,"dependency_job_id":"207617cb-3b2c-45f6-9c60-c243d13ee64d","html_url":"https://github.com/MaximeWewer/wazuh-operator","commit_stats":null,"previous_names":["maximewewer/wazuh-operator"],"tags_count":25,"template":false,"template_full_name":null,"purl":"pkg:github/MaximeWewer/wazuh-operator","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/MaximeWewer%2Fwazuh-operator","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/MaximeWewer%2Fwazuh-operator/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/MaximeWewer%2Fwazuh-operator/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/MaximeWewer%2Fwazuh-operator/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/MaximeWewer","download_url":"https://codeload.github.com/MaximeWewer/wazuh-operator/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/MaximeWewer%2Fwazuh-operator/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":35499864,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-07-15T02:00:06.706Z","response_time":131,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["crd","gitops","kubernetes","kubernetes-operator","operator","siem","wazuh","xdr"],"created_at":"2026-01-13T11:19:23.701Z","updated_at":"2026-07-15T10:00:39.174Z","avatar_url":"https://github.com/MaximeWewer.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Wazuh Kubernetes Operator\n\nA Kubernetes operator for managing Wazuh clusters, providing a declarative way to deploy and configure Wazuh security monitoring platforms.\n\n## Features\n\n- **Declarative Cluster Management** - Define your entire Wazuh cluster using Kubernetes custom resources\n- **Automated Deployment** - Automatically provisions Manager, Indexer, and Dashboard components\n- **Rule \u0026 Decoder Management** - Manage Wazuh detection rules and log decoders as CRDs\n- **CDB Lists \u0026 Active Response** - Manage CDB lists and custom active response scripts declaratively\n- **Integrations \u0026 Agent Groups** - Configure external integrations (Slack, VirusTotal, …) and shared agent group configuration declaratively\n- **OpenSearch Security CRDs** - Manage users, roles, role mappings, and tenants declaratively\n- **Wazuh API RBAC CRDs** - Manage Manager API roles, policies, rules, and users; restrict dashboard menus per user via run_as\n- **Index Lifecycle Management** - Configure ISM policies, index templates, and snapshot policies\n- **Backup \u0026 Restore** - OpenSearch snapshots and Wazuh Manager backups to S3, GCS, Azure, HDFS\n- **TLS Automation** - Auto-generated certificates with hot reload support (Wazuh 4.9+)\n- **High Availability** - Multi-node deployments with pod disruption budgets\n- **Safe Rollouts** - Controlled indexer/manager drain with retry and rollback\n- **Networking** - Gateway API and Ingress for dashboard/manager exposure\n- **Storage Ops** - Online PVC volume expansion and log rotation\n- **Monitoring \u0026 Tracing** - Prometheus metrics, ServiceMonitor, and OpenTelemetry distributed tracing\n\n## Architecture\n\nThe operator watches `resources.wazuh.com` custom resources and reconciles the\nWazuh stack: it deploys and configures the Manager, Indexer, and Dashboard, and\npushes RBAC / rules / index config to their APIs.\n\n```mermaid\ngraph LR\n    crs[\"Custom Resources\u003cbr/\u003eWazuhCluster, Wazuh*, OpenSearch*\"]\n    operator[\"Wazuh Operator\u003cbr/\u003e(controllers)\"]\n    crs --\u003e|watch / reconcile| operator\n\n    agents[\"Wazuh agents\"]\n\n    subgraph cluster[\"WazuhCluster (managed)\"]\n        manager[\"Manager\u003cbr/\u003eMaster + Workers\"]\n        indexer[\"Indexer\u003cbr/\u003e(modified OpenSearch)\"]\n        dashboard[\"Dashboard\u003cbr/\u003e(modified OpenSearch Dashboards)\"]\n    end\n\n    operator --\u003e|deploy + configure| manager\n    operator --\u003e|deploy + configure| indexer\n    operator --\u003e|deploy + configure| dashboard\n\n    agents --\u003e|events| manager\n    manager --\u003e|alerts via Filebeat| indexer\n    dashboard --\u003e|query / search| indexer\n    dashboard --\u003e|Manager API :55000| manager\n```\n\n## Quick Start\n\n### Prerequisites\n\n- Kubernetes 1.25+\n- kubectl configured\n- 16GB+ RAM recommended\n\n### Installation with Helm\n\nDue to CRD size, use `helm template` + `kubectl apply` instead of `helm install`:\n\n```bash\n# Install the operator\nhelm template wazuh-operator oci://ghcr.io/maximewewer/charts/wazuh-operator \\\n  --namespace wazuh-operator --create-namespace | kubectl apply -f -\n\n# Deploy a Wazuh cluster\nhelm template wazuh-cluster oci://ghcr.io/maximewewer/charts/wazuh-cluster \\\n  --namespace wazuh | kubectl apply -f -\n\n# Check status\nkubectl get wazuhcluster -n wazuh\n```\n\n### Access Dashboard\n\n```bash\nkubectl port-forward svc/wazuh-cluster-dashboard -n wazuh 5601:5601\n```\n\nOpen \u003chttps://localhost:5601\u003e - Credentials are auto-generated in secrets.\n\n\u003e See [Quick Start Guide](docs/usage/getting-started/quick-start.md) for detailed instructions.\n\n## Supported Wazuh Versions\n\n| Wazuh           | OpenSearch    | Notes                                                                               |\n| --------------- | ------------- | ----------------------------------------------------------------------------------- |\n| 4.12.x - 4.14.x | 2.19.0+       | Automatic TLS certificate hot reload (file-watch).                                  |\n| 4.10.x - 4.11.x | 2.16.0        |                                                                                     |\n| 4.9.x           | 2.13.0        | TLS certificate hot reload via API call. Minimum version supported by the operator. |\n| \u003c 4.9.0         | Not supported | Might work, but it hasn't been tested.                                              |\n\n## Custom Resource Definitions\n\n**API Group**: `resources.wazuh.com/v1`\n\n| Category                | CRDs                                                                                                                           | Short Names                                                        |\n| ----------------------- | ------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------ |\n| **Wazuh Core**          | WazuhCluster                                                                                                                   | wc                                                                 |\n| **Wazuh Config**        | WazuhRule, WazuhDecoder, WazuhIntegration, WazuhCDBList, WazuhActiveResponse, WazuhCertificate, WazuhFilebeat, WazuhAgentGroup | wrule, wdecoder, wintegration, wcdb, war, wzcert, wfb, wagentgroup |\n| **Wazuh API RBAC**      | WazuhRole, WazuhUser                                                                                                           | wrole, wuser                                                       |\n| **Wazuh Backup**        | WazuhBackup, WazuhRestore                                                                                                      | wbak, wrest                                                        |\n| **OpenSearch Security** | OpenSearchUser, OpenSearchRole, OpenSearchRoleMapping, OpenSearchActionGroup, OpenSearchTenant, OpenSearchAuthConfig           | osuser, osrole, osrmap, osag, ostenant, osauth                     |\n| **OpenSearch Index**    | OpenSearchIndex, OpenSearchIndexTemplate, OpenSearchComponentTemplate, OpenSearchISMPolicy, OpenSearchSnapshotPolicy           | osidx, osidxt, osctpl, osism, ossnap                               |\n| **OpenSearch Backup**   | OpenSearchSnapshotRepository, OpenSearchSnapshot, OpenSearchRestore                                                            | osrepo, ossnapshot, osrestore                                      |\n\n\u003e See [CRD Reference](docs/usage/CRD-REFERENCE.md) for complete API documentation.\n\n## Documentation\n\n### User Guide\n\n| Topic                                                                 | Description                                 |\n| --------------------------------------------------------------------- | ------------------------------------------- |\n| [Installation](docs/usage/getting-started/installation.md)            | How to install the operator                 |\n| [Quick Start](docs/usage/getting-started/quick-start.md)              | Deploy your first cluster                   |\n| [Credentials](docs/usage/features/credentials.md)                     | Auto-generated passwords, secrets           |\n| [TLS Configuration](docs/usage/features/tls.md)                       | Certificate management                      |\n| [Wazuh API RBAC](docs/usage/features/wazuh-api-rbac.md)               | Manager API roles/users, run_as restriction |\n| [Monitoring](docs/usage/features/monitoring.md)                       | Prometheus integration                      |\n| [Backup \u0026 Restore](docs/usage/features/backup-restore.md)             | Data protection (S3, GCS, Azure, HDFS)      |\n| [Repository Plugins](docs/usage/features/repository-plugins.md)       | Auto plugin install \u0026 keystore              |\n| [OpenSearch Security](docs/usage/features/opensearch-security.md)     | Indexer users, roles, tenants               |\n| [Gateway API \u0026 Ingress](docs/usage/features/gateway-api.md)           | Expose dashboard/manager                    |\n| [Drain Strategy](docs/usage/features/drain-strategy.md)               | Safe node drain, retry, rollback            |\n| [Log Rotation](docs/usage/features/log-rotation.md)                   | Component log rotation                      |\n| [Volume Expansion](docs/usage/features/volume-expansion.md)           | Online PVC growth                           |\n| [Filebeat](docs/usage/features/filebeat-configuration.md)             | Manager→indexer shipping config             |\n| [Advanced Topology](docs/usage/features/advanced-indexer-topology.md) | NodePools, dedicated roles                  |\n| [Sizing](docs/usage/features/sizing.md)                               | Resource sizing guidance                    |\n| [Examples](docs/usage/examples/)                                      | Configuration examples                      |\n| [Troubleshooting](docs/usage/troubleshooting/)                        | Common issues and debugging                 |\n\n### Developer Guide\n\n| Topic                                                    | Description                |\n| -------------------------------------------------------- | -------------------------- |\n| [Architecture](docs/dev/architecture/operator-design.md) | Overall design             |\n| [Testing Guide](docs/dev/testing/testing-guide.md)       | How to run and write tests |\n| [Contributing](docs/dev/contributing/CONTRIBUTING.md)    | How to contribute          |\n\n## Development\n\n```bash\n# Generate manifests and code\nmake manifests generate\n\n# Build and test\nmake build test\n\n# Build Docker image\nmake docker-build IMG=myregistry/wazuh-operator:dev\n\n# Run locally\nmake install run\n```\n\n\u003e See [Testing Guide](docs/dev/testing/testing-guide.md) for complete testing instructions.\n\n## Contributing\n\nWe welcome contributions! Please see [CONTRIBUTING.md](docs/dev/contributing/CONTRIBUTING.md) for details.\n\n## License\n\nThis project is licensed under the Apache License 2.0 - see the [LICENSE](LICENSE) file for details.\n\n## Support\n\n- [GitHub Issues](https://github.com/MaximeWewer/wazuh-operator/issues)\n- [Wazuh Documentation](https://documentation.wazuh.com/)\n\n## Acknowledgments\n\n- Built with [Kubebuilder](https://book.kubebuilder.io/)\n- Inspired by [opensearch-k8s-operator](https://github.com/opensearch-project/opensearch-k8s-operator)\n- Based on [Wazuh](https://wazuh.com/) security platform\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmaximewewer%2Fwazuh-operator","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fmaximewewer%2Fwazuh-operator","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmaximewewer%2Fwazuh-operator/lists"}