From 3a1fe1494244c72a95d66e857b4ca9dabeaf031c Mon Sep 17 00:00:00 2001 From: Richard Moseley Date: Wed, 23 Sep 2020 10:21:59 +0200 Subject: [PATCH 1/2] Combine the wazuh-manager sts definitions --- wazuh_managers/wazuh-worker-1-conf.yaml | 346 ------------------ ...ker-0-conf.yaml => wazuh-worker-conf.yaml} | 6 +- ...orker-0-sts.yaml => wazuh-worker-sts.yaml} | 18 +- 3 files changed, 8 insertions(+), 362 deletions(-) delete mode 100644 wazuh_managers/wazuh-worker-1-conf.yaml rename wazuh_managers/{wazuh-worker-0-conf.yaml => wazuh-worker-conf.yaml} (98%) rename wazuh_managers/{wazuh-worker-0-sts.yaml => wazuh-worker-sts.yaml} (81%) diff --git a/wazuh_managers/wazuh-worker-1-conf.yaml b/wazuh_managers/wazuh-worker-1-conf.yaml deleted file mode 100644 index 1d8f1d6..0000000 --- a/wazuh_managers/wazuh-worker-1-conf.yaml +++ /dev/null @@ -1,346 +0,0 @@ -# Copyright (C) 2018 Wazuh Inc. -# -# This program is a free software; you can redistribute it -# and/or modify it under the terms of the GNU General Public -# License (version 2) as published by the FSF - Free Software -# Foundation. - -# Wazuh worker conf: 1 - -apiVersion: v1 -kind: ConfigMap -metadata: - name: wazuh-manager-worker-1-conf - namespace: wazuh -data: - # /var/ossec/etc-template/ossec.conf - ossec.conf: |- - - - - yes - yes - no - no - no - smtp.example.wazuh.com - ossecm@example.wazuh.com - recipient@example.wazuh.com - 12 - 131072 - - - - 3 - 12 - - - - - plain - - - - secure - 1514 - tcp - 131072 - - - - - no - yes - yes - yes - yes - yes - yes - yes - yes - - - 43200 - - /var/ossec/etc/rootcheck/rootkit_files.txt - /var/ossec/etc/rootcheck/rootkit_trojans.txt - - /var/ossec/etc/rootcheck/system_audit_rcl.txt - /var/ossec/etc/rootcheck/system_audit_ssh.txt - - yes - - - - yes - 1800 - 1d - yes - - - - yes - 1800 - 1d - yes - - wodles/java - wodles/ciscat - - - - - yes - yes - /var/log/osquery/osqueryd.results.log - /etc/osquery/osquery.conf - yes - - - - - no - 1h - yes - yes - yes - yes - yes - yes - yes - - - - yes - 1m - yes - - yes - 1h - - - yes - 1h - - - yes - 1h - - - - - - no - - - 43200 - - yes - - - yes - - - no - - - /etc,/usr/bin,/usr/sbin - /bin,/sbin,/boot - - - /etc/mtab - /etc/hosts.deny - /etc/mail/statistics - /etc/random-seed - /etc/random.seed - /etc/adjtime - /etc/httpd/logs - /etc/utmpx - /etc/wtmpx - /etc/cups/certs - /etc/dumpdates - /etc/svc/volatile - /sys/kernel/security - /sys/kernel/debug - - - /etc/ssl/private.key - - yes - - - yes - - - yes - - - - - 127.0.0.1 - ^localhost.localdomain$ - 10.66.0.2 - - - - disable-account - disable-account.sh - user - yes - - - - restart-ossec - restart-ossec.sh - - - - - firewall-drop - firewall-drop.sh - srcip - yes - - - - host-deny - host-deny.sh - srcip - yes - - - - route-null - route-null.sh - srcip - yes - - - - win_route-null - route-null.cmd - srcip - yes - - - - win_route-null-2012 - route-null-2012.cmd - srcip - yes - - - - netsh - netsh.cmd - srcip - yes - - - - netsh-win-2016 - netsh-win-2016.cmd - srcip - yes - - - - - - - command - df -P - 360 - - - - full_command - netstat -tulpn | sed 's/\([[:alnum:]]\+\)\ \+[[:digit:]]\+\ \+[[:digit:]]\+\ \+\(.*\):\([[:digit:]]*\)\ \+\([0-9\.\:\*]\+\).\+\ \([[:digit:]]*\/[[:alnum:]\-]*\).*/\1 \2 == \3 == \4 \5/' | sort -k 4 -g | sed 's/ == \(.*\) ==/:\1/' | sed 1,2d - netstat listening ports - 360 - - - - full_command - last -n 20 - 360 - - - - - ruleset/decoders - ruleset/rules - 0215-policy_rules.xml - etc/lists/audit-keys - etc/lists/amazon/aws-sources - etc/lists/amazon/aws-eventnames - - - etc/decoders - etc/rules - - - - - no - 1515 - no - no - 0 - no - no - yes - HIGH:!ADH:!EXP:!MD5:!RC4:!3DES:!CAMELLIA:@STRENGTH - - no - /var/ossec/etc/sslmanager.cert - /var/ossec/etc/sslmanager.key - no - - - - wazuh - wazuh-manager-worker-1 - worker - - 123a45bc67def891gh23i45jk67l8mn9 - 1516 - 0.0.0.0 - - wazuh-manager-master-0.wazuh-cluster.wazuh.svc.cluster.local - - no - no - - - - - - syslog - /var/ossec/logs/active-responses.log - - - - syslog - /var/log/syslog - - - - syslog - /var/log/dpkg.log - - diff --git a/wazuh_managers/wazuh-worker-0-conf.yaml b/wazuh_managers/wazuh-worker-conf.yaml similarity index 98% rename from wazuh_managers/wazuh-worker-0-conf.yaml rename to wazuh_managers/wazuh-worker-conf.yaml index ced38e8..cdd3eb9 100644 --- a/wazuh_managers/wazuh-worker-0-conf.yaml +++ b/wazuh_managers/wazuh-worker-conf.yaml @@ -5,12 +5,12 @@ # License (version 2) as published by the FSF - Free Software # Foundation. -# Wazuh worker conf: 0 +# Wazuh worker conf apiVersion: v1 kind: ConfigMap metadata: - name: wazuh-manager-worker-0-conf + name: wazuh-manager-worker-conf namespace: wazuh data: # /var/ossec/etc-template/ossec.conf @@ -314,7 +314,7 @@ data: wazuh - wazuh-manager-worker-0 + to_be_replaced_by_hostname worker 123a45bc67def891gh23i45jk67l8mn9 diff --git a/wazuh_managers/wazuh-worker-0-sts.yaml b/wazuh_managers/wazuh-worker-sts.yaml similarity index 81% rename from wazuh_managers/wazuh-worker-0-sts.yaml rename to wazuh_managers/wazuh-worker-sts.yaml index f4f7a77..df848bd 100644 --- a/wazuh_managers/wazuh-worker-0-sts.yaml +++ b/wazuh_managers/wazuh-worker-sts.yaml @@ -10,15 +10,14 @@ apiVersion: apps/v1 kind: StatefulSet metadata: - name: wazuh-manager-worker-0 + name: wazuh-manager-worker namespace: wazuh spec: - replicas: 1 + replicas: 2 selector: matchLabels: app: wazuh-manager node-type: worker - sts-id: '0' serviceName: wazuh-cluster podManagementPolicy: Parallel template: @@ -26,28 +25,21 @@ spec: labels: app: wazuh-manager node-type: worker - sts-id: '0' - name: wazuh-manager-worker-0 + name: wazuh-manager-worker spec: affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: - weight: 100 podAffinityTerm: - labelSelector: - matchExpressions: - - key: sts-id - operator: In - values: - - '1' topologyKey: kubernetes.io/hostname volumes: - name: config configMap: - name: wazuh-manager-worker-0-conf + name: wazuh-manager-worker-conf containers: - name: wazuh-manager - image: 'wazuh/wazuh:3.13.2_7.9.1' + image: "wazuh/wazuh:3.13.2_7.9.1" resources: requests: cpu: 2 From bfe0ae28026a9308d5e31a4bfd8043c307a5c501 Mon Sep 17 00:00:00 2001 From: Richard Moseley Date: Wed, 23 Sep 2020 10:22:18 +0200 Subject: [PATCH 2/2] Update docs for single worker sts --- cleanup.md | 42 ++++++++++++++++-------------------------- instructions.md | 13 +++++-------- upgrade.md | 3 +-- 3 files changed, 22 insertions(+), 36 deletions(-) diff --git a/cleanup.md b/cleanup.md index c2450d1..28f3923 100644 --- a/cleanup.md +++ b/cleanup.md @@ -16,8 +16,8 @@ NAME READY STATUS RESTARTS AGE wazuh-elasticsearch-0 1/1 Running 0 6d wazuh-kibana-78cb4bbb7-xf4s8 1/1 Running 0 6d wazuh-manager-master-0 1/1 Running 0 6d -wazuh-manager-worker-0-0 1/1 Running 0 6d -wazuh-manager-worker-1-0 1/1 Running 0 6d +wazuh-manager-worker-0 1/1 Running 0 6d +wazuh-manager-worker-1 1/1 Running 0 6d wazuh-nginx-57c8c65486-7crh2 1/1 Running 0 6d ``` @@ -28,11 +28,11 @@ ubuntu@k8s-control-server:~$ kubectl delete pod wazuh-manager-master-0 --namespa ``` ``` -ubuntu@k8s-control-server:~$ kubectl delete pod wazuh-manager-worker-0-0 --namespace wazuh +ubuntu@k8s-control-server:~$ kubectl delete pod wazuh-manager-worker-0 --namespace wazuh ``` ``` -ubuntu@k8s-control-server:~$ kubectl delete pod wazuh-manager-worker-1-0 --namespace wazuh +ubuntu@k8s-control-server:~$ kubectl delete pod wazuh-manager-worker-1 --namespace wazuh ``` @@ -73,8 +73,7 @@ ubuntu@k8s-control-server:~$ kubectl get StatefulSet --namespace wazuh NAME DESIRED CURRENT AGE wazuh-elasticsearch 1 1 6d wazuh-manager-master 1 1 6d -wazuh-manager-worker-0 1 1 6d -wazuh-manager-worker-1 1 1 6d +wazuh-manager-worker 1 1 6d ``` Remove the three StatefulSets from the Wazuh cluster managers. @@ -84,11 +83,7 @@ ubuntu@k8s-control-server:~$ kubectl delete StatefulSet wazuh-manager-master --n ``` ``` -ubuntu@k8s-control-server:~$ kubectl delete StatefulSet wazuh-manager-worker-0 --namespace wazuh -``` - -``` -ubuntu@k8s-control-server:~$ kubectl delete StatefulSet wazuh-manager-worker-1 --namespace wazuh +ubuntu@k8s-control-server:~$ kubectl delete StatefulSet wazuh-manager-worker --namespace wazuh ``` ### 4. Take care of deleting the configuration maps. @@ -97,8 +92,7 @@ ubuntu@k8s-control-server:~$ kubectl delete StatefulSet wazuh-manager-worker-1 - ubuntu@k8s-control-server:~$ kubectl get ConfigMap --namespace wazuh NAME DATA AGE wazuh-manager-master-conf 1 6d -wazuh-manager-worker-0-conf 1 6d -wazuh-manager-worker-1-conf 1 6d +wazuh-manager-worker-conf 1 6d ``` ``` @@ -106,11 +100,7 @@ ubuntu@k8s-control-server:~$ kubectl delete ConfigMap wazuh-manager-master-conf ``` ``` -ubuntu@k8s-control-server:~$ kubectl delete ConfigMap wazuh-manager-worker-0-conf --namespace wazuh -``` - -``` -ubuntu@k8s-control-server:~$ kubectl delete ConfigMap wazuh-manager-worker-1-conf --namespace wazuh +ubuntu@k8s-control-server:~$ kubectl delete ConfigMap wazuh-manager-worker-conf --namespace wazuh ``` ### 5. Now eliminate the persistent volume claims. @@ -120,8 +110,8 @@ ubuntu@k8s-control-server:~$ kubectl get persistentvolumeclaim --namespace wazuh NAME STATUS VOLUME CAPACITY ACCESS MODES STORAGECLASS AGE wazuh-elasticsearch-wazuh-elasticsearch-0 Bound pvc-b3226ad3-f7c4-11e8-b9b8-022ada63b4ac 30Gi RWO gp2-encrypted-retained 6d wazuh-manager-master-wazuh-manager-master-0 Bound pvc-fb821971-f7c4-11e8-b9b8-022ada63b4ac 10Gi RWO gp2-encrypted-retained 6d -wazuh-manager-worker-wazuh-manager-worker-0-0 Bound pvc-ffe7bf66-f7c4-11e8-b9b8-022ada63b4ac 10Gi RWO gp2-encrypted-retained 6d -wazuh-manager-worker-wazuh-manager-worker-1-0 Bound pvc-024466da-f7c5-11e8-b9b8-022ada63b4ac 10Gi RWO gp2-encrypted-retained 6d +wazuh-manager-worker-wazuh-manager-worker-0 Bound pvc-ffe7bf66-f7c4-11e8-b9b8-022ada63b4ac 10Gi RWO gp2-encrypted-retained 6d +wazuh-manager-worker-wazuh-manager-worker-1 Bound pvc-024466da-f7c5-11e8-b9b8-022ada63b4ac 10Gi RWO gp2-encrypted-retained 6d ``` ``` @@ -129,11 +119,11 @@ ubuntu@k8s-control-server:~$ kubectl delete persistentvolumeclaim wazuh-manager- ``` ``` -ubuntu@k8s-control-server:~$ kubectl delete persistentvolumeclaim wazuh-manager-master-wazuh-manager-worker-0-0 --namespace wazuh +ubuntu@k8s-control-server:~$ kubectl delete persistentvolumeclaim wazuh-manager-master-wazuh-manager-worker-0 --namespace wazuh ``` ``` -ubuntu@k8s-control-server:~$ kubectl delete persistentvolumeclaim wazuh-manager-master-wazuh-manager-worker-1-0 --namespace wazuh +ubuntu@k8s-control-server:~$ kubectl delete persistentvolumeclaim wazuh-manager-master-wazuh-manager-worker-1 --namespace wazuh ``` ### 6. Finally eliminate the persistent volumes. @@ -141,10 +131,10 @@ ubuntu@k8s-control-server:~$ kubectl delete persistentvolumeclaim wazuh-manager- ``` ubuntu@k8s-control-server:~$ kubectl get persistentvolume NAME CAPACITY ACCESS MODES RECLAIM POLICY STATUS CLAIM STORAGECLASS REASON AGE -pvc-024466da-f7c5-11e8-b9b8-022ada63b4ac 10Gi RWO Retain Bound wazuh/wazuh-manager-worker-wazuh-manager-worker-1-0 gp2-encrypted-retained 6d +pvc-024466da-f7c5-11e8-b9b8-022ada63b4ac 10Gi RWO Retain Bound wazuh/wazuh-manager-worker-wazuh-manager-worker-1 gp2-encrypted-retained 6d pvc-b3226ad3-f7c4-11e8-b9b8-022ada63b4ac 30Gi RWO Retain Bound wazuh/wazuh-elasticsearch-wazuh-elasticsearch-0 gp2-encrypted-retained 6d pvc-fb821971-f7c4-11e8-b9b8-022ada63b4ac 10Gi RWO Retain Bound wazuh/wazuh-manager-master-wazuh-manager-master-0 gp2-encrypted-retained 6d -pvc-ffe7bf66-f7c4-11e8-b9b8-022ada63b4ac 10Gi RWO Retain Bound wazuh/wazuh-manager-worker-wazuh-manager-worker-0-0 gp2-encrypted-retained 6d +pvc-ffe7bf66-f7c4-11e8-b9b8-022ada63b4ac 10Gi RWO Retain Bound wazuh/wazuh-manager-worker-wazuh-manager-worker-0 gp2-encrypted-retained 6d ``` Master. @@ -233,10 +223,10 @@ ubuntu@k8s-control-server:~$ kubectl delete persistentvolumeclaim wazuh-elastics ``` ubuntu@k8s-control-server:~$ kubectl get persistentvolume NAME CAPACITY ACCESS MODES RECLAIM POLICY STATUS CLAIM STORAGECLASS REASON AGE -pvc-024466da-f7c5-11e8-b9b8-022ada63b4ac 10Gi RWO Retain Released wazuh/wazuh-manager-worker-wazuh-manager-worker-1-0 gp2-encrypted-retained 6d +pvc-024466da-f7c5-11e8-b9b8-022ada63b4ac 10Gi RWO Retain Released wazuh/wazuh-manager-worker-wazuh-manager-worker-1 gp2-encrypted-retained 6d pvc-b3226ad3-f7c4-11e8-b9b8-022ada63b4ac 30Gi RWO Retain Bound wazuh/wazuh-elasticsearch-wazuh-elasticsearch-0 gp2-encrypted-retained 6d pvc-fb821971-f7c4-11e8-b9b8-022ada63b4ac 10Gi RWO Retain Released wazuh/wazuh-manager-master-wazuh-manager-master-0 gp2-encrypted-retained 6d -pvc-ffe7bf66-f7c4-11e8-b9b8-022ada63b4ac 10Gi RWO Retain Released wazuh/wazuh-manager-worker-wazuh-manager-worker-0-0 gp2-encrypted-retained 6d +pvc-ffe7bf66-f7c4-11e8-b9b8-022ada63b4ac 10Gi RWO Retain Released wazuh/wazuh-manager-worker-wazuh-manager-worker-0 gp2-encrypted-retained 6d ``` Master. diff --git a/instructions.md b/instructions.md index 3dd5ed4..902b152 100644 --- a/instructions.md +++ b/instructions.md @@ -166,12 +166,10 @@ $ kubectl apply -f wazuh_managers/wazuh-cluster-svc.yaml $ kubectl apply -f wazuh_managers/wazuh-workers-svc.yaml $ kubectl apply -f wazuh_managers/wazuh-master-conf.yaml -$ kubectl apply -f wazuh_managers/wazuh-worker-0-conf.yaml -$ kubectl apply -f wazuh_managers/wazuh-worker-1-conf.yaml +$ kubectl apply -f wazuh_managers/wazuh-worker-conf.yaml $ kubectl apply -f wazuh_managers/wazuh-master-sts.yaml -$ kubectl apply -f wazuh_managers/wazuh-worker-0-sts.yaml -$ kubectl apply -f wazuh_managers/wazuh-worker-1-sts.yaml +$ kubectl apply -f wazuh_managers/wazuh-worker-sts.yaml ``` ### Verifying the deployment @@ -213,8 +211,7 @@ $ kubectl get statefulsets -n wazuh NAME DESIRED CURRENT AGE wazuh-elasticsearch 1 1 13m wazuh-manager-master 1 1 9m -wazuh-manager-worker-0 1 1 9m -wazuh-manager-worker-1 1 1 9m +wazuh-manager-worker 1 1 9m ``` @@ -226,8 +223,8 @@ NAME READY STATUS RESTARTS AGE wazuh-elasticsearch-0 1/1 Running 0 15m wazuh-kibana-f4d9c7944-httsd 1/1 Running 0 14m wazuh-manager-master-0 1/1 Running 0 12m -wazuh-manager-worker-0-0 1/1 Running 0 11m -wazuh-manager-worker-1-0 1/1 Running 0 11m +wazuh-manager-worker-0 1/1 Running 0 11m +wazuh-manager-worker-1 1/1 Running 0 11m wazuh-nginx-748fb8494f-xwwhw 1/1 Running 0 14m ``` diff --git a/upgrade.md b/upgrade.md index 121fe9a..0a611d9 100644 --- a/upgrade.md +++ b/upgrade.md @@ -171,8 +171,7 @@ The first step is to change the image of the pod in each file that deploys each These files are the statefulSet files: - wazuh-master-sts.yaml -- wazuh-worker-0-sts.yaml -- wazuh-worker-1-sts.yaml +- wazuh-worker-sts.yaml For example we had this version before: