From b5e6cee516e74bcf091b6d075e76873dcb929e2f Mon Sep 17 00:00:00 2001
From: Victor Carlos Erenu <victor.erenu@wazuh.com>
Date: Thu, 30 Jul 2026 17:44:58 +0700
Subject: [PATCH] Add ISM plugin configuration after opensearch start

---
 .../wazuh-indexer/config/entrypoint.sh        | 31 +++++++++++++++++++
 1 file changed, 31 insertions(+)

diff --git a/build-docker-images/wazuh-indexer/config/entrypoint.sh b/build-docker-images/wazuh-indexer/config/entrypoint.sh
index 5fac7974..5ac74a75 100644
--- a/build-docker-images/wazuh-indexer/config/entrypoint.sh
+++ b/build-docker-images/wazuh-indexer/config/entrypoint.sh
@@ -64,11 +64,42 @@ function runOpensearch {
         echo $! > /run/wazuh-indexer/wazuh-engine.pid
     fi
 
+    # Index State Management (ISM) creates its audit history index
+    # (.opendistro-ism-managed-index-history-*) with 1 replica by default,
+    # regardless of cluster.default_number_of_replicas. On a single-node
+    # cluster that replica shard can never be assigned, leaving the cluster
+    # permanently yellow. Set the ISM-specific default to 0 in the
+    # background once the API is reachable, before ISM's first sweep runs.
+    applyIsmHistoryReplicaDefault > /dev/null 2>&1 &
+
     # Start opensearch
     exec "$@" "${opensearch_opts[@]}"
 
 }
 
+function applyIsmHistoryReplicaDefault {
+    local admin_cert="$OPENSEARCH_PATH_CONF/certs/admin.pem"
+    local admin_key="$OPENSEARCH_PATH_CONF/certs/admin-key.pem"
+
+    if [ ! -f "$admin_cert" ] || [ ! -f "$admin_key" ]; then
+        return 0
+    fi
+
+    # -k: the server cert's SAN matches the node DNS name, not "localhost"
+    # (same reason the wazuh.indexer healthcheck in docker-compose uses -k).
+    local attempt=0
+    until curl -sk -o /dev/null --cert "$admin_cert" --key "$admin_key" "https://localhost:9200" \
+       || [ "$attempt" -ge 60 ]; do
+        attempt=$((attempt + 1))
+        sleep 5
+    done
+
+    curl -sk -o /dev/null --cert "$admin_cert" --key "$admin_key" \
+        -X PUT "https://localhost:9200/_cluster/settings" \
+        -H 'Content-Type: application/json' \
+        -d '{"persistent":{"plugins.index_state_management.history.number_of_replicas":0}}'
+}
+
 function configureOpensearch {
 # Update opensearch.yml with NODES_DN if set
 if [ -n "$NODES_DN" ]; then