yahoo_1999/fk-wazuh
1
0
Fork 0
forked from wazuh/wazuh-docker
Code Pull Requests Activity

Testing the docker images build with filebeat reference removed

Browse Source
This commit is contained in:
Carlos Bordon
2025-12-03 11:49:22 -03:00
parent ccbb78131b
commit 9ebecf410e
13 changed files with 56 additions and 137 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/.goss.yaml
-13
View File
@@ -1,11 +1,4 @@
file: file:
/etc/filebeat/filebeat.yml:
exists: true
mode: "0644"
owner: root
group: root
filetype: file
contains: []
/var/ossec/bin/wazuh-control: /var/ossec/bin/wazuh-control:
exists: true exists: true
mode: "0750" mode: "0750"
@@ -49,10 +42,6 @@ file:
filetype: file filetype: file
contains: [] contains: []
package: package:
filebeat:
installed: true
versions:
- 7.10.2
wazuh-manager: wazuh-manager:
installed: true installed: true
versions: versions:
@@ -71,8 +60,6 @@ port:
ip: ip:
- 0.0.0.0 - 0.0.0.0
process: process:
filebeat:
running: true
wazuh-analysisd: wazuh-analysisd:
running: true running: true
wazuh-authd: wazuh-authd:
.github/multi-node-filebeat-check.sh
-39
View File
@@ -1,39 +0,0 @@
COMMAND_TO_EXECUTE="filebeat test output"
MASTER_CONTAINERS=$(docker ps --format '{{.Names}}' | grep -E 'master')
if [ -z "$MASTER_CONTAINERS" ]; then
echo "No containers were found with 'master' in their name."
else
for MASTER_CONTAINERS in $MASTER_CONTAINERS; do
FILEBEAT_OUTPUT=$(docker exec "$MASTER_CONTAINERS" $COMMAND_TO_EXECUTE)
FILEBEAT_STATUS=$(echo "${FILEBEAT_OUTPUT}" | grep -c OK)
if [[ $FILEBEAT_STATUS -eq 7 ]]; then
echo "No errors in filebeat"
echo "${FILEBEAT_OUTPUT}"
else
echo "Errors in filebeat"
echo "${FILEBEAT_OUTPUT}"
exit 1
fi
done
fi
MASTER_CONTAINERS=$(docker ps --format '{{.Names}}' | grep -E 'worker')
if [ -z "$MASTER_CONTAINERS" ]; then
echo "No containers were found with 'worker' in their name."
else
for MASTER_CONTAINERS in $MASTER_CONTAINERS; do
FILEBEAT_OUTPUT=$(docker exec "$MASTER_CONTAINERS" $COMMAND_TO_EXECUTE)
FILEBEAT_STATUS=$(echo "${FILEBEAT_OUTPUT}" | grep -c OK)
if [[ $FILEBEAT_STATUS -eq 7 ]]; then
echo "No errors in filebeat"
echo "${FILEBEAT_OUTPUT}"
else
echo "Errors in filebeat"
echo "${FILEBEAT_OUTPUT}"
exit 1
fi
done
fi
.github/single-node-filebeat-check.sh
-20
View File
@@ -1,20 +0,0 @@
COMMAND_TO_EXECUTE="filebeat test output"
MASTER_CONTAINERS=$(docker ps --format '{{.Names}}' | grep -E 'manager')
if [ -z "$MASTER_CONTAINERS" ]; then
echo "No containers were found with 'manager' in their name."
else
for MASTER_CONTAINERS in $MASTER_CONTAINERS; do
FILEBEAT_OUTPUT=$(docker exec "$MASTER_CONTAINERS" $COMMAND_TO_EXECUTE)
FILEBEAT_STATUS=$(echo "${FILEBEAT_OUTPUT}" | grep -c OK)
if [[ $FILEBEAT_STATUS -eq 7 ]]; then
echo "No errors in filebeat"
echo "${FILEBEAT_OUTPUT}"
else
echo "Errors in filebeat"
echo "${FILEBEAT_OUTPUT}"
exit 1
fi
done
fi
.github/workflows/push.yml
-6
View File
@@ -175,9 +175,6 @@ jobs:
env: env:
TOKEN: $(curl -s -u wazuh-wui:MyS3cr37P450r.*- -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true") TOKEN: $(curl -s -u wazuh-wui:MyS3cr37P450r.*- -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true")
- name: Check filebeat output
run: ./.github/single-node-filebeat-check.sh
- name: Check Wazuh dashboard service URL - name: Check Wazuh dashboard service URL
run: | run: |
status=$(curl -XGET --silent https://0.0.0.0:443/app/status -k -u admin:SecretPassword -I -s | grep -E "^HTTP" | awk '{print $2}') status=$(curl -XGET --silent https://0.0.0.0:443/app/status -k -u admin:SecretPassword -I -s | grep -E "^HTTP" | awk '{print $2}')
@@ -338,9 +335,6 @@ jobs:
env: env:
TOKEN: $(curl -s -u wazuh-wui:MyS3cr37P450r.*- -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true") TOKEN: $(curl -s -u wazuh-wui:MyS3cr37P450r.*- -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true")
- name: Check filebeat output
run: ./.github/multi-node-filebeat-check.sh
- name: Check Wazuh dashboard service URL - name: Check Wazuh dashboard service URL
run: | run: |
status=$(curl -XGET --silent https://0.0.0.0:443/app/status -k -u admin:SecretPassword -I | grep -E "^HTTP" | awk '{print $2}') status=$(curl -XGET --silent https://0.0.0.0:443/app/status -k -u admin:SecretPassword -I | grep -E "^HTTP" | awk '{print $2}')
build-docker-images/README.md
-1
View File
@@ -24,7 +24,6 @@ $ build-docker-images/build-images.sh -h
Usage: build-docker-images/build-images.sh [OPTIONS] Usage: build-docker-images/build-images.sh [OPTIONS]
-d, --dev <ref> [Optional] Set the development stage you want to build, example rc1 or beta1, not used by default. -d, --dev <ref> [Optional] Set the development stage you want to build, example rc1 or beta1, not used by default.
-f, --filebeat-module <ref> [Optional] Set Filebeat module version. By default 0.4.
-r, --revision <rev> [Optional] Package revision. By default 1 -r, --revision <rev> [Optional] Package revision. By default 1
-v, --version <ver> [Optional] Set the Wazuh version should be builded. By default, 5.0.0. -v, --version <ver> [Optional] Set the Wazuh version should be builded. By default, 5.0.0.
-h, --help Show this help. -h, --help Show this help.
build-docker-images/wazuh-dashboard/config/wazuh_app_config.sh
+9 -9
View File
@@ -7,7 +7,7 @@ api_username="${API_USERNAME:-wazuh-wui}"
api_password="${API_PASSWORD:-wazuh-wui}" api_password="${API_PASSWORD:-wazuh-wui}"
api_run_as="${RUN_AS:-false}" api_run_as="${RUN_AS:-false}"
dashboard_config_file="/usr/share/wazuh-dashboard/data/wazuh/config/wazuh.yml" dashboard_config_file="/usr/share/wazuh-dashboard/config/opensearch_dashboards.yml"
declare -A CONFIG_MAP=( declare -A CONFIG_MAP=(
[pattern]=$PATTERN [pattern]=$PATTERN
@@ -32,18 +32,18 @@ do
fi fi
done done
grep -q 1513629884013 $dashboard_config_file grep -q default $dashboard_config_file
_config_exists=$? _config_exists=$?
if [[ $_config_exists -ne 0 ]]; then if [[ $_config_exists -ne 0 ]]; then
cat << EOF >> $dashboard_config_file cat << EOF >> $dashboard_config_file
hosts: wazuh_core.hosts:
- 1513629884013: default:
url: $wazuh_url url: $wazuh_url
port: $wazuh_port port: $wazuh_port
username: $api_username username: $api_username
password: $api_password password: $api_password
run_as: $api_run_as run_as: $api_run_as
EOF EOF
else else
echo "Wazuh APP already configured" echo "Wazuh APP already configured"
build-docker-images/wazuh-manager/config/config.sh
+1 -1
View File
@@ -4,7 +4,7 @@
# Variables for certificate generation # Variables for certificate generation
CERT_TOOL="wazuh-certs-tool.sh" CERT_TOOL="wazuh-certs-tool.sh"
CERT_CONFIG_FILE="config.yml" CERT_CONFIG_FILE="config.yml"
CERT_DIR=/etc/filebeat/certs CERT_DIR=/etc/wazuh/certs
download_package() { download_package() {
local url=$1 local url=$1
local package=$2 local package=$2
docs/README.md
+3 -5
View File
@@ -7,7 +7,7 @@
In this repository you will find the containers to run: In this repository you will find the containers to run:
* Wazuh manager: it runs the Wazuh manager, Wazuh API and Filebeat OSS * Wazuh manager: it runs the Wazuh manager, and Wazuh API
* Wazuh dashboard: provides a web user interface to browse through alert data and allows you to visualize the agents configuration and status. * Wazuh dashboard: provides a web user interface to browse through alert data and allows you to visualize the agents configuration and status.
* Wazuh indexer: Wazuh indexer container (working as a single-node cluster or as a multi-node cluster). **Be aware to increase the `vm.max_map_count` setting, as it's detailed in the [Wazuh documentation](https://documentation.wazuh.com/current/docker/wazuh-container.html#increase-max-map-count-on-your-host-linux).** * Wazuh indexer: Wazuh indexer container (working as a single-node cluster or as a multi-node cluster). **Be aware to increase the `vm.max_map_count` setting, as it's detailed in the [Wazuh documentation](https://documentation.wazuh.com/current/docker/wazuh-container.html#increase-max-map-count-on-your-host-linux).**
* Wazuh agent: This container contains the Wazuh agent services. Current functionality is limited. * Wazuh agent: This container contains the Wazuh agent services. Current functionality is limited.
@@ -70,16 +70,14 @@ The folder `wazuh-agent` contains a README explaining how to run a container wit
│   │   ├── etc │   │   ├── etc
│   │   │   ├── cont-init.d │   │   │   ├── cont-init.d
│   │   │   │   ├── 0-wazuh-init │   │   │   │   ├── 0-wazuh-init
│   │   │   │   ├── 1-config-filebeat │   │   │   │   ├── 1-config-
│   │   │   │   └── 2-manager │   │   │   │   └── 2-manager
│   │   │   └── services.d │   │   │   └── services.d
│   │   │   ├── filebeat │   │   │   ├──
│   │   │   │   ├── finish │   │   │   │   ├── finish
│   │   │   │   └── run │   │   │   │   └── run
│   │   │   └── ossec-logs │   │   │   └── ossec-logs
│   │   │   └── run │   │   │   └── run
│   │   ├── filebeat_module.sh
│   │   ├── filebeat.yml
│   │   ├── permanent_data.env │   │   ├── permanent_data.env
│   │   └── permanent_data.sh │   │   └── permanent_data.sh
│   └── Dockerfile │   └── Dockerfile
multi-node/Migration-to-Wazuh-4.4.md
+16 -16
View File
@@ -97,15 +97,15 @@ docker volume create \
docker volume create \ docker volume create \
--label com.docker.compose.project=multi-node \ --label com.docker.compose.project=multi-node \
--label com.docker.compose.version=1.25.0 \ --label com.docker.compose.version=1.25.0 \
--label com.docker.compose.volume=master-filebeat-etc \ --label com.docker.compose.volume=master-wazuh-etc \
multi-node_master-filebeat-etc multi-node_master-wazuh-etc
``` ```
``` ```
docker volume create \ docker volume create \
--label com.docker.compose.project=multi-node \ --label com.docker.compose.project=multi-node \
--label com.docker.compose.version=1.25.0 \ --label com.docker.compose.version=1.25.0 \
--label com.docker.compose.volume=master-filebeat-var \ --label com.docker.compose.volume=master-wazuh-var \
multi-node_master-filebeat-var multi-node_master-wazuh-var
``` ```
``` ```
docker volume create \ docker volume create \
@@ -160,15 +160,15 @@ docker volume create \
docker volume create \ docker volume create \
--label com.docker.compose.project=multi-node \ --label com.docker.compose.project=multi-node \
--label com.docker.compose.version=1.25.0 \ --label com.docker.compose.version=1.25.0 \
--label com.docker.compose.volume=worker-filebeat-etc \ --label com.docker.compose.volume=worker-wazuh-etc \
multi-node_worker-filebeat-etc multi-node_worker-wazuh-etc
``` ```
``` ```
docker volume create \ docker volume create \
--label com.docker.compose.project=multi-node \ --label com.docker.compose.project=multi-node \
--label com.docker.compose.version=1.25.0 \ --label com.docker.compose.version=1.25.0 \
--label com.docker.compose.volume=worker-filebeat-var \ --label com.docker.compose.volume=worker-wazuh-var \
multi-node_worker-filebeat-var multi-node_worker-wazuh-var
``` ```
**6. Copy the volume content from elasticsearch to Wazuh indexer volumes and old Wazuh manager content to new volumes.** **6. Copy the volume content from elasticsearch to Wazuh indexer volumes and old Wazuh manager content to new volumes.**
``` ```
@@ -233,14 +233,14 @@ docker container run --rm -it \
``` ```
``` ```
docker container run --rm -it \ docker container run --rm -it \
-v wazuh-docker_filebeat-etc:/from \ -v wazuh-docker-etc:/from \
-v multi-node_master-filebeat-etc:/to \ -v multi-node_master-etc:/to \
alpine ash -c "cd /from ; cp -avp . /to" alpine ash -c "cd /from ; cp -avp . /to"
``` ```
``` ```
docker container run --rm -it \ docker container run --rm -it \
-v wazuh-docker_filebeat-var:/from \ -v wazuh-docker-var:/from \
-v multi-node_master-filebeat-var:/to \ -v multi-node_master-wazuh-var:/to \
alpine ash -c "cd /from ; cp -avp . /to" alpine ash -c "cd /from ; cp -avp . /to"
``` ```
``` ```
@@ -287,14 +287,14 @@ docker container run --rm -it \
``` ```
``` ```
docker container run --rm -it \ docker container run --rm -it \
-v wazuh-docker_worker-filebeat-etc:/from \ -v wazuh-docker_worker-etc:/from \
-v multi-node_worker-filebeat-etc:/to \ -v multi-node_worker-wazuh-etc:/to \
alpine ash -c "cd /from ; cp -avp . /to" alpine ash -c "cd /from ; cp -avp . /to"
``` ```
``` ```
docker container run --rm -it \ docker container run --rm -it \
-v wazuh-docker_worker-filebeat-var:/from \ -v wazuh-docker_worker-var:/from \
-v multi-node_worker-filebeat-var:/to \ -v multi-node_worker-wazuh-var:/to \
alpine ash -c "cd /from ; cp -avp . /to" alpine ash -c "cd /from ; cp -avp . /to"
``` ```
multi-node/docker-compose.yml
+5 -5
View File
@@ -34,8 +34,8 @@ services:
- master-wazuh-active-response:/var/ossec/active-response/bin - master-wazuh-active-response:/var/ossec/active-response/bin
- master-wazuh-wodles:/var/ossec/wodles - master-wazuh-wodles:/var/ossec/wodles
- ./wazuh-certificates/root-ca.pem:/etc/ssl/root-ca.pem - ./wazuh-certificates/root-ca.pem:/etc/ssl/root-ca.pem
- ./wazuh-certificates/wazuh.master.pem:/etc/ssl/filebeat.pem - ./wazuh-certificates/wazuh.master.pem:/etc/ssl/wazuh.master.pem
- ./wazuh-certificates/wazuh.master-key.pem:/etc/ssl/filebeat.key - ./wazuh-certificates/wazuh.master-key.pem:/etc/ssl/wazuh.master.key
wazuh.worker: wazuh.worker:
image: wazuh/wazuh-manager:5.0.0 image: wazuh/wazuh-manager:5.0.0
hostname: wazuh.worker hostname: wazuh.worker
@@ -65,9 +65,9 @@ services:
- worker-wazuh-var-multigroups:/var/ossec/var/multigroups - worker-wazuh-var-multigroups:/var/ossec/var/multigroups
- worker-wazuh-active-response:/var/ossec/active-response/bin - worker-wazuh-active-response:/var/ossec/active-response/bin
- worker-wazuh-wodles:/var/ossec/wodles - worker-wazuh-wodles:/var/ossec/wodles
- ./wazuh-certificates/root-ca.pem:/etc/filebeat/certs/root-ca.pem - ./wazuh-certificates/root-ca.pem:/etc/wazuh/certs/root-ca.pem
- ./wazuh-certificates/wazuh.worker.pem:/etc/filebeat/certs/filebeat.pem - ./wazuh-certificates/wazuh.worker.pem:/etc/wazuh/certs/wazuh.worker.pem
- ./wazuh-certificates/wazuh.worker-key.pem:/etc/filebeat/certs/filebeat-key.pem - ./wazuh-certificates/wazuh.worker-key.pem:/etc/wazuh/certs/wazuh.worker.key
wazuh1.indexer: wazuh1.indexer:
image: wazuh/wazuh-indexer:5.0.0 image: wazuh/wazuh-indexer:5.0.0
multi-node/volume-migrator.sh
+18 -18
View File
@@ -61,14 +61,14 @@ docker volume create \
docker volume create \ docker volume create \
--label com.docker.compose.project=$2 \ --label com.docker.compose.project=$2 \
--label com.docker.compose.version=$1 \ --label com.docker.compose.version=$1 \
--label com.docker.compose.volume=master-filebeat-etc \ --label com.docker.compose.volume=master-wazuh-etc \
$2_master-filebeat-etc $2_master-wazuh-etc
docker volume create \ docker volume create \
--label com.docker.compose.project=$2 \ --label com.docker.compose.project=$2 \
--label com.docker.compose.version=$1 \ --label com.docker.compose.version=$1 \
--label com.docker.compose.volume=master-filebeat-var \ --label com.docker.compose.volume=master-wazuh-var \
$2_master-filebeat-var $2_master-wazuh-var
docker volume create \ docker volume create \
--label com.docker.compose.project=$2 \ --label com.docker.compose.project=$2 \
@@ -115,18 +115,18 @@ docker volume create \
docker volume create \ docker volume create \
--label com.docker.compose.project=$2 \ --label com.docker.compose.project=$2 \
--label com.docker.compose.version=$1 \ --label com.docker.compose.version=$1 \
--label com.docker.compose.volume=worker-filebeat-etc \ --label com.docker.compose.volume=worker-wazuh-etc \
$2_worker-filebeat-etc $2_worker-wazuh-etc
docker volume create \ docker volume create \
--label com.docker.compose.project=$2 \ --label com.docker.compose.project=$2 \
--label com.docker.compose.version=$1 \ --label com.docker.compose.version=$1 \
--label com.docker.compose.volume=worker-filebeat-var \ --label com.docker.compose.volume=worker-wazuh-var \
$2_worker-filebeat-var $2_worker-wazuh-var
docker container run --rm -it \ docker container run --rm -it \
-v wazuh-docker_worker-filebeat-var:/from \ -v wazuh-docker_worker-var:/from \
-v $2_worker-filebeat-var:/to \ -v $2_worker-wazuh-var:/to \
alpine ash -c "cd /from ; cp -avp . /to" alpine ash -c "cd /from ; cp -avp . /to"
docker container run --rm -it \ docker container run --rm -it \
@@ -180,13 +180,13 @@ docker container run --rm -it \
alpine ash -c "cd /from ; cp -avp . /to" alpine ash -c "cd /from ; cp -avp . /to"
docker container run --rm -it \ docker container run --rm -it \
-v wazuh-docker_filebeat-etc:/from \ -v wazuh-docker-etc:/from \
-v $2_master-filebeat-etc:/to \ -v $2_master-wazuh-etc:/to \
alpine ash -c "cd /from ; cp -avp . /to" alpine ash -c "cd /from ; cp -avp . /to"
docker container run --rm -it \ docker container run --rm -it \
-v wazuh-docker_filebeat-var:/from \ -v wazuh-docker-var:/from \
-v $2_master-filebeat-var:/to \ -v $2_master-wazuh-var:/to \
alpine ash -c "cd /from ; cp -avp . /to" alpine ash -c "cd /from ; cp -avp . /to"
docker container run --rm -it \ docker container run --rm -it \
@@ -225,11 +225,11 @@ docker container run --rm -it \
alpine ash -c "cd /from ; cp -avp . /to" alpine ash -c "cd /from ; cp -avp . /to"
docker container run --rm -it \ docker container run --rm -it \
-v wazuh-docker_worker-filebeat-etc:/from \ -v wazuh-docker_worker-etc:/from \
-v $2_worker-filebeat-etc:/to \ -v $2_worker-wazuh-etc:/to \
alpine ash -c "cd /from ; cp -avp . /to" alpine ash -c "cd /from ; cp -avp . /to"
docker container run --rm -it \ docker container run --rm -it \
-v wazuh-docker_worker-filebeat-var:/from \ -v wazuh-docker_worker-var:/from \
-v $2_worker-filebeat-var:/to \ -v $2_worker-wazuh-var:/to \
alpine ash -c "cd /from ; cp -avp . /to" alpine ash -c "cd /from ; cp -avp . /to"
single-node/docker-compose.yml
+3 -3
View File
@@ -32,9 +32,9 @@ services:
- wazuh_var_multigroups:/var/ossec/var/multigroups - wazuh_var_multigroups:/var/ossec/var/multigroups
- wazuh_active_response:/var/ossec/active-response/bin - wazuh_active_response:/var/ossec/active-response/bin
- wazuh_wodles:/var/ossec/wodles - wazuh_wodles:/var/ossec/wodles
- ./wazuh-certificates/root-ca.pem:/etc/filebeat/certs/root-ca.pem - ./wazuh-certificates/root-ca.pem:/etc/wazuh/certs/root-ca.pem
- ./wazuh-certificates/wazuh.manager.pem:/etc/filebeat/certs/filebeat.pem - ./wazuh-certificates/wazuh.manager.pem:/etc/wazuh/certs/wazuh.manager.pem
- ./wazuh-certificates/wazuh.manager-key.pem:/etc/filebeat/certs/filebeat-key.pem - ./wazuh-certificates/wazuh.manager-key.pem:/etc/wazuh/certs/wazuh.manager-key.pem
wazuh.indexer: wazuh.indexer:
image: wazuh/wazuh-indexer:5.0.0 image: wazuh/wazuh-indexer:5.0.0