diff --git a/wazuh_managers/wazuh-worker-1-conf.yaml b/wazuh_managers/wazuh-worker-1-conf.yaml deleted file mode 100644 index 1d8f1d6..0000000 --- a/wazuh_managers/wazuh-worker-1-conf.yaml +++ /dev/null @@ -1,346 +0,0 @@ -# Copyright (C) 2018 Wazuh Inc. -# -# This program is a free software; you can redistribute it -# and/or modify it under the terms of the GNU General Public -# License (version 2) as published by the FSF - Free Software -# Foundation. - -# Wazuh worker conf: 1 - -apiVersion: v1 -kind: ConfigMap -metadata: - name: wazuh-manager-worker-1-conf - namespace: wazuh -data: - # /var/ossec/etc-template/ossec.conf - ossec.conf: |- - - - - yes - yes - no - no - no - smtp.example.wazuh.com - ossecm@example.wazuh.com - recipient@example.wazuh.com - 12 - 131072 - - - - 3 - 12 - - - - - plain - - - - secure - 1514 - tcp - 131072 - - - - - no - yes - yes - yes - yes - yes - yes - yes - yes - - - 43200 - - /var/ossec/etc/rootcheck/rootkit_files.txt - /var/ossec/etc/rootcheck/rootkit_trojans.txt - - /var/ossec/etc/rootcheck/system_audit_rcl.txt - /var/ossec/etc/rootcheck/system_audit_ssh.txt - - yes - - - - yes - 1800 - 1d - yes - - - - yes - 1800 - 1d - yes - - wodles/java - wodles/ciscat - - - - - yes - yes - /var/log/osquery/osqueryd.results.log - /etc/osquery/osquery.conf - yes - - - - - no - 1h - yes - yes - yes - yes - yes - yes - yes - - - - yes - 1m - yes - - yes - 1h - - - yes - 1h - - - yes - 1h - - - - - - no - - - 43200 - - yes - - - yes - - - no - - - /etc,/usr/bin,/usr/sbin - /bin,/sbin,/boot - - - /etc/mtab - /etc/hosts.deny - /etc/mail/statistics - /etc/random-seed - /etc/random.seed - /etc/adjtime - /etc/httpd/logs - /etc/utmpx - /etc/wtmpx - /etc/cups/certs - /etc/dumpdates - /etc/svc/volatile - /sys/kernel/security - /sys/kernel/debug - - - /etc/ssl/private.key - - yes - - - yes - - - yes - - - - - 127.0.0.1 - ^localhost.localdomain$ - 10.66.0.2 - - - - disable-account - disable-account.sh - user - yes - - - - restart-ossec - restart-ossec.sh - - - - - firewall-drop - firewall-drop.sh - srcip - yes - - - - host-deny - host-deny.sh - srcip - yes - - - - route-null - route-null.sh - srcip - yes - - - - win_route-null - route-null.cmd - srcip - yes - - - - win_route-null-2012 - route-null-2012.cmd - srcip - yes - - - - netsh - netsh.cmd - srcip - yes - - - - netsh-win-2016 - netsh-win-2016.cmd - srcip - yes - - - - - - - command - df -P - 360 - - - - full_command - netstat -tulpn | sed 's/\([[:alnum:]]\+\)\ \+[[:digit:]]\+\ \+[[:digit:]]\+\ \+\(.*\):\([[:digit:]]*\)\ \+\([0-9\.\:\*]\+\).\+\ \([[:digit:]]*\/[[:alnum:]\-]*\).*/\1 \2 == \3 == \4 \5/' | sort -k 4 -g | sed 's/ == \(.*\) ==/:\1/' | sed 1,2d - netstat listening ports - 360 - - - - full_command - last -n 20 - 360 - - - - - ruleset/decoders - ruleset/rules - 0215-policy_rules.xml - etc/lists/audit-keys - etc/lists/amazon/aws-sources - etc/lists/amazon/aws-eventnames - - - etc/decoders - etc/rules - - - - - no - 1515 - no - no - 0 - no - no - yes - HIGH:!ADH:!EXP:!MD5:!RC4:!3DES:!CAMELLIA:@STRENGTH - - no - /var/ossec/etc/sslmanager.cert - /var/ossec/etc/sslmanager.key - no - - - - wazuh - wazuh-manager-worker-1 - worker - - 123a45bc67def891gh23i45jk67l8mn9 - 1516 - 0.0.0.0 - - wazuh-manager-master-0.wazuh-cluster.wazuh.svc.cluster.local - - no - no - - - - - - syslog - /var/ossec/logs/active-responses.log - - - - syslog - /var/log/syslog - - - - syslog - /var/log/dpkg.log - - diff --git a/wazuh_managers/wazuh-worker-0-conf.yaml b/wazuh_managers/wazuh-worker-conf.yaml similarity index 98% rename from wazuh_managers/wazuh-worker-0-conf.yaml rename to wazuh_managers/wazuh-worker-conf.yaml index ced38e8..cdd3eb9 100644 --- a/wazuh_managers/wazuh-worker-0-conf.yaml +++ b/wazuh_managers/wazuh-worker-conf.yaml @@ -5,12 +5,12 @@ # License (version 2) as published by the FSF - Free Software # Foundation. -# Wazuh worker conf: 0 +# Wazuh worker conf apiVersion: v1 kind: ConfigMap metadata: - name: wazuh-manager-worker-0-conf + name: wazuh-manager-worker-conf namespace: wazuh data: # /var/ossec/etc-template/ossec.conf @@ -314,7 +314,7 @@ data: wazuh - wazuh-manager-worker-0 + to_be_replaced_by_hostname worker 123a45bc67def891gh23i45jk67l8mn9 diff --git a/wazuh_managers/wazuh-worker-0-sts.yaml b/wazuh_managers/wazuh-worker-sts.yaml similarity index 81% rename from wazuh_managers/wazuh-worker-0-sts.yaml rename to wazuh_managers/wazuh-worker-sts.yaml index f4f7a77..df848bd 100644 --- a/wazuh_managers/wazuh-worker-0-sts.yaml +++ b/wazuh_managers/wazuh-worker-sts.yaml @@ -10,15 +10,14 @@ apiVersion: apps/v1 kind: StatefulSet metadata: - name: wazuh-manager-worker-0 + name: wazuh-manager-worker namespace: wazuh spec: - replicas: 1 + replicas: 2 selector: matchLabels: app: wazuh-manager node-type: worker - sts-id: '0' serviceName: wazuh-cluster podManagementPolicy: Parallel template: @@ -26,28 +25,21 @@ spec: labels: app: wazuh-manager node-type: worker - sts-id: '0' - name: wazuh-manager-worker-0 + name: wazuh-manager-worker spec: affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: - weight: 100 podAffinityTerm: - labelSelector: - matchExpressions: - - key: sts-id - operator: In - values: - - '1' topologyKey: kubernetes.io/hostname volumes: - name: config configMap: - name: wazuh-manager-worker-0-conf + name: wazuh-manager-worker-conf containers: - name: wazuh-manager - image: 'wazuh/wazuh:3.13.2_7.9.1' + image: "wazuh/wazuh:3.13.2_7.9.1" resources: requests: cpu: 2