Merge pull request #2251 from wazuh/enhancement/2229-start-healthchecks

Add deployment healthchecks

CHANGELOG.md

@@ -9,6 +9,7 @@ All notable changes to this project will be documented in this file.
 
 ### Changed
 
+- Add deployment healthchecks ([#2251](https://github.com/wazuh/wazuh-docker/pull/2251))
 - Update artifact generation jobs to use wz-linux dedicated runner group ([#2242](https://github.com/wazuh/wazuh-docker/pull/2242))
 - Fix set_correct_permOwner function ([#2238](https://github.com/wazuh/wazuh-docker/pull/2238))
 - Add workflow dispatch option ([#2231](https://github.com/wazuh/wazuh-docker/pull/2231))

build-docker-images/wazuh-manager/config/permanent_data.env

@@ -5,28 +5,12 @@ PERMANENT_DATA[((i++))]="/var/wazuh-manager/etc"
 PERMANENT_DATA[((i++))]="/var/wazuh-manager/logs"
 PERMANENT_DATA[((i++))]="/var/wazuh-manager/queue"
 PERMANENT_DATA[((i++))]="/var/wazuh-manager/var/multigroups"
-PERMANENT_DATA[((i++))]="/var/wazuh-manager/active-response/bin"
 
 export PERMANENT_DATA
 
 # Files mounted in a volume that should not be permanent
 i=0
 PERMANENT_DATA_EXCP[((i++))]="/var/wazuh-manager/etc/internal_options.conf"
-PERMANENT_DATA_EXCP[((i++))]="/var/wazuh-manager/active-response/bin/default-firewall-drop"
-PERMANENT_DATA_EXCP[((i++))]="/var/wazuh-manager/active-response/bin/disable-account"
-PERMANENT_DATA_EXCP[((i++))]="/var/wazuh-manager/active-response/bin/firewalld-drop"
-PERMANENT_DATA_EXCP[((i++))]="/var/wazuh-manager/active-response/bin/firewall-drop"
-PERMANENT_DATA_EXCP[((i++))]="/var/wazuh-manager/active-response/bin/host-deny"
-PERMANENT_DATA_EXCP[((i++))]="/var/wazuh-manager/active-response/bin/ip-customblock"
-PERMANENT_DATA_EXCP[((i++))]="/var/wazuh-manager/active-response/bin/ipfw"
-PERMANENT_DATA_EXCP[((i++))]="/var/wazuh-manager/active-response/bin/kaspersky.py"
-PERMANENT_DATA_EXCP[((i++))]="/var/wazuh-manager/active-response/bin/kaspersky"
-PERMANENT_DATA_EXCP[((i++))]="/var/wazuh-manager/active-response/bin/npf"
-PERMANENT_DATA_EXCP[((i++))]="/var/wazuh-manager/active-response/bin/wazuh-slack"
-PERMANENT_DATA_EXCP[((i++))]="/var/wazuh-manager/active-response/bin/pf"
-PERMANENT_DATA_EXCP[((i++))]="/var/wazuh-manager/active-response/bin/restart-wazuh"
-PERMANENT_DATA_EXCP[((i++))]="/var/wazuh-manager/active-response/bin/restart.sh"
-PERMANENT_DATA_EXCP[((i++))]="/var/wazuh-manager/active-response/bin/route-null"
 
 export PERMANENT_DATA_EXCP
 

multi-node/docker-compose.yml

@@ -5,6 +5,14 @@ services:
     hostname: wazuh.master
     container_name: multi-node-wazuh.master
     restart: always
+    depends_on:
+      wazuh1.indexer:
+        condition: service_healthy
+    healthcheck:
+      test: [ "CMD-SHELL", "curl -s -k -I -u $$API_USERNAME:$$API_PASSWORD https://localhost:55000/security/user/authenticate > /dev/null || exit 1" ]
+      interval: 15s
+      timeout: 5s
+      retries: 5
     ulimits:
       memlock:
         soft: -1
@@ -32,15 +40,21 @@ services:
       - master-wazuh-logs:/var/wazuh-manager/logs
       - master-wazuh-queue:/var/wazuh-manager/queue
       - master-wazuh-var-multigroups:/var/wazuh-manager/var/multigroups
-      - master-wazuh-active-response:/var/wazuh-manager/active-response/bin
       - ./wazuh-certificates/root-ca.pem:/var/wazuh-manager/etc/certs/root-ca.pem
       - ./wazuh-certificates/wazuh.master.pem:/var/wazuh-manager/etc/certs/manager.pem
       - ./wazuh-certificates/wazuh.master-key.pem:/var/wazuh-manager/etc/certs/manager-key.pem
+
   wazuh.worker:
     image: wazuh/wazuh-manager:5.0.0
     hostname: wazuh.worker
     container_name: multi-node-wazuh.worker
     restart: always
+    healthcheck:
+      test: [ "CMD-SHELL", "timeout 2 bash -c '</dev/tcp/localhost/1514' || exit 1" ]
+      interval: 5s
+      timeout: 5s
+      retries: 10
+      start_period: 30s
     ulimits:
       memlock:
         soft: -1
@@ -48,6 +62,9 @@ services:
       nofile:
         soft: 655360
         hard: 655360
+    depends_on:
+      wazuh.master:
+        condition: service_healthy
     environment:
       - WAZUH_INDEXER_HOSTS=wazuh1.indexer:9200,wazuh2.indexer:9200,wazuh3.indexer:9200
       - WAZUH_NODE_NAME=worker01
@@ -64,7 +81,6 @@ services:
       - worker-wazuh-logs:/var/wazuh-manager/logs
       - worker-wazuh-queue:/var/wazuh-manager/queue
       - worker-wazuh-var-multigroups:/var/wazuh-manager/var/multigroups
-      - worker-wazuh-active-response:/var/wazuh-manager/active-response/bin
       - ./wazuh-certificates/root-ca.pem:/var/wazuh-manager/etc/certs/root-ca.pem
       - ./wazuh-certificates/wazuh.worker.pem:/var/wazuh-manager/etc/certs/manager.pem
       - ./wazuh-certificates/wazuh.worker-key.pem:/var/wazuh-manager/etc/certs/manager-key.pem
@@ -79,7 +95,7 @@ services:
     environment:
       - OPENSEARCH_JAVA_OPTS=-Xms1g -Xmx1g
       - bootstrap.memory_lock=true
-      - network.host=wazuh1.indexer
+      - network.host=0.0.0.0
       - node.name=wazuh1.indexer
       - cluster.initial_cluster_manager_nodes=wazuh1.indexer,wazuh2.indexer,wazuh3.indexer
       - discovery.seed_hosts=wazuh1.indexer,wazuh2.indexer,wazuh3.indexer
@@ -93,6 +109,12 @@ services:
       nofile:
         soft: 65536
         hard: 65536
+    healthcheck:
+      test: [ "CMD-SHELL", "curl -s -k -u $$INDEXER_USERNAME:$$INDEXER_PASSWORD https://localhost:9200/_cluster/health" ]
+      interval: 10s
+      timeout: 5s
+      retries: 10
+      start_period: 30s
     volumes:
       - wazuh-indexer-data-1:/var/lib/wazuh-indexer
       - ./wazuh-certificates/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem
@@ -106,10 +128,14 @@ services:
     hostname: wazuh2.indexer
     container_name: multi-node-wazuh2.indexer
     restart: always
+    entrypoint: >
+      /bin/sh -c " echo 'Waiting for wazuh1.indexer...'; sleep 5; until getent hosts wazuh1.indexer; do sleep 2; done; /entrypoint.sh opensearch"
+    depends_on:
+      - wazuh1.indexer
     environment:
       - OPENSEARCH_JAVA_OPTS=-Xms1g -Xmx1g
       - bootstrap.memory_lock=true
-      - network.host=wazuh2.indexer
+      - network.host=0.0.0.0
       - node.name=wazuh2.indexer
       - cluster.initial_cluster_manager_nodes=wazuh1.indexer,wazuh2.indexer,wazuh3.indexer
       - discovery.seed_hosts=wazuh1.indexer,wazuh2.indexer,wazuh3.indexer
@@ -123,6 +149,12 @@ services:
       nofile:
         soft: 65536
         hard: 65536
+    healthcheck:
+      test: [ "CMD-SHELL", "curl -s -k -u $$INDEXER_USERNAME:$$INDEXER_PASSWORD https://localhost:9200/_cluster/health" ]
+      interval: 10s
+      timeout: 5s
+      retries: 10
+      start_period: 30s
     volumes:
       - wazuh-indexer-data-2:/var/lib/wazuh-indexer
       - ./wazuh-certificates/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem
@@ -134,10 +166,14 @@ services:
     hostname: wazuh3.indexer
     container_name: multi-node-wazuh3.indexer
     restart: always
+    entrypoint: >
+      /bin/sh -c " echo 'Waiting for wazuh1.indexer...'; sleep 5;until getent hosts wazuh1.indexer; do sleep 2; done; /entrypoint.sh opensearch"
+    depends_on:
+      - wazuh1.indexer
     environment:
       - OPENSEARCH_JAVA_OPTS=-Xms1g -Xmx1g
       - bootstrap.memory_lock=true
-      - network.host=wazuh3.indexer
+      - network.host=0.0.0.0
       - node.name=wazuh3.indexer
       - cluster.initial_cluster_manager_nodes=wazuh1.indexer,wazuh2.indexer,wazuh3.indexer
       - discovery.seed_hosts=wazuh1.indexer,wazuh2.indexer,wazuh3.indexer
@@ -151,6 +187,12 @@ services:
       nofile:
         soft: 65536
         hard: 65536
+    healthcheck:
+      test: [ "CMD-SHELL", "curl -s -k -u $$INDEXER_USERNAME:$$INDEXER_PASSWORD https://localhost:9200/_cluster/health" ]
+      interval: 10s
+      timeout: 5s
+      retries: 10
+      start_period: 30s
     volumes:
       - wazuh-indexer-data-3:/var/lib/wazuh-indexer
       - ./wazuh-certificates/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem
@@ -162,6 +204,12 @@ services:
     hostname: wazuh.dashboard
     container_name: multi-node-wazuh.dashboard
     restart: always
+    healthcheck:
+      test: [ "CMD", "curl", "-k", "-s", "-o", "/dev/null", "https://localhost:5601/login" ]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 30s
     ports:
       - 443:5601
     environment:
@@ -185,11 +233,10 @@ services:
       - wazuh-dashboard-config:/usr/share/wazuh-dashboard/config
       - wazuh-dashboard-custom:/usr/share/wazuh-dashboard/plugins/wazuh/public/assets/custom
     depends_on:
-      - wazuh1.indexer
+      wazuh1.indexer:
-      - wazuh.master
+        condition: service_healthy
-    links:
+      wazuh.master:
-      - wazuh1.indexer:wazuh1.indexer
+        condition: service_healthy
-      - wazuh.master:wazuh.master
 
   nginx:
     image: nginx:stable
@@ -202,10 +249,6 @@ services:
       - wazuh.master
       - wazuh.worker
       - wazuh.dashboard
-    links:
-      - wazuh.master:wazuh.master
-      - wazuh.worker:wazuh.worker
-      - wazuh.dashboard:wazuh.dashboard
     volumes:
       - ./config/nginx/nginx.conf:/etc/nginx/nginx.conf:ro
 

single-node/docker-compose.yml

@@ -5,6 +5,14 @@ services:
     hostname: wazuh.manager
     container_name: single-node-wazuh.manager
     restart: always
+    depends_on:
+      wazuh.indexer:
+        condition: service_healthy
+    healthcheck:
+      test: [ "CMD-SHELL", "curl -s -k -I -u $$API_USERNAME:$$API_PASSWORD https://localhost:55000/security/user/authenticate > /dev/null || exit 1" ]
+      interval: 15s
+      timeout: 5s
+      retries: 5
     ulimits:
       memlock:
         soft: -1
@@ -32,7 +40,6 @@ services:
       - wazuh_logs:/var/wazuh-manager/logs
       - wazuh_queue:/var/wazuh-manager/queue
       - wazuh_var_multigroups:/var/wazuh-manager/var/multigroups
-      - wazuh_active_response:/var/wazuh-manager/active-response/bin
       - ./wazuh-certificates/root-ca.pem:/var/wazuh-manager/etc/certs/root-ca.pem
       - ./wazuh-certificates/wazuh.manager.pem:/var/wazuh-manager/etc/certs/manager.pem
       - ./wazuh-certificates/wazuh.manager-key.pem:/var/wazuh-manager/etc/certs/manager-key.pem
@@ -47,7 +54,7 @@ services:
     environment:
       - OPENSEARCH_JAVA_OPTS=-Xms1g -Xmx1g
       - bootstrap.memory_lock=true
-      - network.host=wazuh.indexer
+      - network.host=0.0.0.0
       - node.name=wazuh.indexer
       - cluster.initial_cluster_manager_nodes=wazuh.indexer
       - node.max_local_storage_nodes=1
@@ -60,6 +67,12 @@ services:
       nofile:
         soft: 65536
         hard: 65536
+    healthcheck:
+      test: [ "CMD-SHELL", "curl -s -k -u $$INDEXER_USERNAME:$$INDEXER_PASSWORD https://localhost:9200/_cluster/health" ]
+      interval: 10s
+      timeout: 5s
+      retries: 10
+      start_period: 30s
     volumes:
       - wazuh-indexer-data:/var/lib/wazuh-indexer
       - ./wazuh-certificates/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem
@@ -73,6 +86,12 @@ services:
     hostname: wazuh.dashboard
     container_name: single-node-wazuh.dashboard
     restart: always
+    healthcheck:
+      test: [ "CMD", "curl", "-k", "-s", "-o", "/dev/null", "https://localhost:5601/login" ]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 30s
     ports:
       - 443:5601
     environment:
@@ -96,10 +115,10 @@ services:
       - wazuh-dashboard-config:/usr/share/wazuh-dashboard/config
       - wazuh-dashboard-custom:/usr/share/wazuh-dashboard/plugins/wazuh/public/assets/custom
     depends_on:
-      - wazuh.indexer
+      wazuh.indexer:
-    links:
+        condition: service_healthy
-      - wazuh.indexer:wazuh.indexer
+      wazuh.manager:
-      - wazuh.manager:wazuh.manager
+        condition: service_healthy
 
 volumes:
   wazuh_api_configuration: