Wazuh kubernetes installation

[Pablo Sartor]

The Wazuh documentation it's not very clear to me

https://documentation.wazuh.com/current/deployment-options/deploying-with-kubernetes/kubernetes-conf.html

In this section the first requisite is:

A Kubernetes cluster already deployed. (How initialize this cluster for multiple nodes on another VM?)

https://documentation.wazuh.com/current/deployment-options/deploying-with-kubernetes/kubernetes-deployment.html

In this section envs/local-env/ seems to install all nodes in the same VM.

Please explain to me how to make expansion nodes for this cluster  on another VM to increase the number of agents monitored.

Regards.

Pablo Sartor

[Stuti Gupta]

Hi Pablo,

The first article talks about using Kubernetes to configure Wazuh. It discusses resource requirements and an overview of the process. It also provides information on specific configurations for different pods and services.

The second article talks about installing Wazuh on Kubernetes. It discusses the process of installing Wazuh and its various components like Wazuh indexer, Wazuh server, Wazuh dashboard, and Wazuh agent. The article also provides instructions on how to configure Wazuh and its features, such as file integrity monitoring, log analysis, and threat detection.

Neither of the articles mention how to make expansion nodes for a Kubernetes cluster on another VM to increase the number of agents monitored.

You can Auto-scalable Wazuh Cluster with Docker-Compose for that you can refer to s://wazuh.com/blog/auto-scalable-wazuh-cluster-with-docker-compose/. Kubernetes is the appropriate technology to focus on when discussing container orchestration on a single host or vm. While Kubernetes offers powerful capabilities for managing containerized applications, its complexity and operational overhead can present significant challenges for scaling security-critical workloads like SIEM across multiple nodes or VMs. So I would recommend the https://documentation.wazuh.com/current/user-manual/manager/wazuh-server-cluster.html

Hope this helps