Wazuh Kubernetes Deployment

[Max]

Hi all!

just a simple inquiry when it comes to the Wazuh Kubernetes Deployment I've seen the documentation on here: https://documentation.wazuh.com/current/deployment-options/deploying-with-kubernetes/kubernetes-conf.html

However, I just want to know how much resources would the cluster actually take?

Both in a single node instance and then upgrade to multi node?

how much RAM, CPU and Storage would I need and so forth.

Also, for context I would be deploying on an Azure subscription so trying to figure out these costs would be great.

[Lucas Santiago Viñals]

Hi Max, 

Hope this message finds you well.

As you may see in the documentation, you have to have these value at least.

From a per-component point of view from the manifests, you have:

• Wazuh Manager Master
  • CPU: 400m
  • RAM: 512 Mi
  • Storage (PVC): 500Mi
• Wazuh Manager Worker
  • CPU: 400m
  • RAM: 512 Mi
  • Storage (PVC): 500Mi
• Wazuh Indexer
  • CPU: 500m
  • RAM: 1564 Mi
  • Storage (PVC): 500Mi
• Wazuh Dashboard
  • CPU: 500Mi
  • RAM: 1024Mi

For a single-node setup (master only, 1 indexer, 1 dashboard):

• CPU: ~1.4 cores (limits) — a 2–4 vCPU node is recommended
• RAM: ~3.1 Gi (limits) — a node with 8 Gi RAM gives comfortable headroom
• Storage: ~1 Gi PVC minimum — plan for at least 50–100 Gi depending on how many agents and retention period you need (event data grows fast)

For Azure specifically, you can use a Standard_D4s_v3 for a solid starting point in dev/test or light production environment.

For a multi-node setup (Manager master +  3 workers, 3 indexer, 1 dashboard):

• CPU: a 4–6 vCPU node is recommended
• RAM: a node with 8 -12 Gi RAM 
• Storage: 50–300 Gi (as said before, this depends entirely on your agents qty and how many events are ingested)

For Azure specifically, you can use multiple Standard_D4s_v3 or Standard_D8s_v3 for production environment.

For costs estimation, here's the Azure calculator to check associated costs.

Hope this helps clarifying the requirements.

Regards, 

Lucas

[Max]

Hi Lucas,

Thank you for the detailed answer!

Cheers,
Max