forked from wazuh/wazuh-docker
Compare commits
8
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 Wazuh CI
|
f645653af9 | ||
|
wazuhci
|
13629cc549 | ||
|
Wazuh CI
|
fe2fc14a3c | ||
|
wazuhci
|
1358738d53 | ||
|
Wazuh CI
|
0bcd2409ce | ||
|
wazuhci
|
db9406b6d1 | ||
|
Wazuh CI
|
ec777f0653 | ||
|
wazuhci
|
e1e8dab086 |
@@ -1,4 +1,3 @@
|
||||
WAZUH_VERSION=5.0.0
|
||||
WAZUH_IMAGE_VERSION=5.0.0
|
||||
WAZUH_REGISTRY=docker.io
|
||||
IMAGE_TAG=5.0.0
|
||||
|
||||
@@ -1,305 +0,0 @@
|
||||
run-name: (4.x) Build and push images - ${{ inputs.dev && 'dev' || 'release' }} - ${{ inputs.id }}
|
||||
name: (4.x) Build and push images
|
||||
|
||||
on:
|
||||
workflow_dispatch:
|
||||
inputs:
|
||||
image_tag:
|
||||
description: 'Docker image tag'
|
||||
default: '4.14.8'
|
||||
required: true
|
||||
docker_reference:
|
||||
description: 'wazuh-docker reference'
|
||||
required: true
|
||||
filebeat_module_version:
|
||||
description: 'Filebeat module version'
|
||||
default: '0.5'
|
||||
required: true
|
||||
type: string
|
||||
products:
|
||||
description: 'Comma-separated list of the image names to build and push'
|
||||
default: 'wazuh-manager,wazuh-dashboard,wazuh-indexer,wazuh-agent'
|
||||
required: false
|
||||
type: string
|
||||
revision:
|
||||
description: 'Package revision'
|
||||
default: '1'
|
||||
required: true
|
||||
id:
|
||||
description: "ID used to identify the workflow uniquely."
|
||||
type: string
|
||||
required: false
|
||||
dev:
|
||||
description: "Add tag suffix '-dev' to the image tag ?"
|
||||
type: boolean
|
||||
default: true
|
||||
required: false
|
||||
workflow_call:
|
||||
inputs:
|
||||
image_tag:
|
||||
description: 'Docker image tag'
|
||||
default: '4.14.8'
|
||||
required: true
|
||||
type: string
|
||||
docker_reference:
|
||||
description: 'wazuh-docker reference'
|
||||
required: false
|
||||
type: string
|
||||
filebeat_module_version:
|
||||
description: 'Filebeat module version'
|
||||
default: '0.5'
|
||||
required: true
|
||||
type: string
|
||||
products:
|
||||
description: 'Comma-separated list of the image names to build and push'
|
||||
default: 'wazuh-manager,wazuh-dashboard,wazuh-indexer,wazuh-agent'
|
||||
required: false
|
||||
type: string
|
||||
revision:
|
||||
description: 'Package revision'
|
||||
default: '1'
|
||||
required: true
|
||||
type: string
|
||||
id:
|
||||
description: "ID used to identify the workflow uniquely."
|
||||
type: string
|
||||
required: false
|
||||
dev:
|
||||
description: "Add tag suffix '-dev' to the image tag ?"
|
||||
type: boolean
|
||||
default: false
|
||||
required: false
|
||||
|
||||
jobs:
|
||||
setup:
|
||||
runs-on: codebuild-github-actions-codebuild-runner-devops-amd-${{ github.run_id }}-${{ github.run_attempt }}
|
||||
|
||||
permissions:
|
||||
id-token: write
|
||||
contents: read
|
||||
|
||||
env:
|
||||
IMAGE_REGISTRY: ${{ inputs.dev && vars.IMAGE_REGISTRY_DEV || vars.IMAGE_REGISTRY_PROD }}
|
||||
IMAGE_TAG: ${{ inputs.image_tag }}
|
||||
FILEBEAT_MODULE_VERSION: ${{ inputs.filebeat_module_version }}
|
||||
REVISION: ${{ inputs.revision }}
|
||||
|
||||
outputs:
|
||||
WAZUH_COMPONENTS: ${{ steps.compute-outputs.outputs.WAZUH_COMPONENTS }}
|
||||
ALL_PRODUCTS_SELECTED: ${{ steps.compute-outputs.outputs.ALL_PRODUCTS_SELECTED }}
|
||||
|
||||
steps:
|
||||
- name: Print inputs
|
||||
run: |
|
||||
echo "---------------------------------------------"
|
||||
echo "Running 4_build_and_push_images workflow"
|
||||
echo "---------------------------------------------"
|
||||
echo "* BRANCH: ${{ github.ref }}"
|
||||
echo "* COMMIT: ${{ github.sha }}"
|
||||
echo "---------------------------------------------"
|
||||
echo "Inputs provided:"
|
||||
echo "---------------------------------------------"
|
||||
echo "* id: ${{ inputs.id }}"
|
||||
echo "* image_tag: ${{ inputs.image_tag }}"
|
||||
echo "* docker_reference: ${{ inputs.docker_reference }}"
|
||||
echo "* filebeat_module_version: ${{ inputs.filebeat_module_version }}"
|
||||
echo "* products: ${{ inputs.products }}"
|
||||
echo "* revision: ${{ inputs.revision }}"
|
||||
echo "* dev: ${{ inputs.dev }}"
|
||||
echo "---------------------------------------------"
|
||||
|
||||
- name: Set up variables
|
||||
id: compute-outputs
|
||||
run: |
|
||||
# Use the default list if products is empty
|
||||
PRODUCTS="${{ inputs.products }}"
|
||||
if [[ -z "$PRODUCTS" || "$PRODUCTS" == "null" ]]; then
|
||||
PRODUCTS="wazuh-manager,wazuh-dashboard,wazuh-indexer,wazuh-agent"
|
||||
fi
|
||||
|
||||
# Check if all 4 core components are present in the string
|
||||
if [[ "$PRODUCTS" == *"wazuh-manager"* && "$PRODUCTS" == *"wazuh-dashboard"* && "$PRODUCTS" == *"wazuh-indexer"* && "$PRODUCTS" == *"wazuh-agent"* ]]; then
|
||||
echo "ALL_PRODUCTS_SELECTED=true" >> $GITHUB_OUTPUT
|
||||
else
|
||||
echo "ALL_PRODUCTS_SELECTED=false" >> $GITHUB_OUTPUT
|
||||
fi
|
||||
|
||||
# Convert to JSON for the matrix (Your existing logic)
|
||||
IFS=',' read -ra COMPONENTS <<< "$PRODUCTS"
|
||||
JSON_ARRAY=$(printf '%s\n' "${COMPONENTS[@]}" | jq -R . | jq -s -c .)
|
||||
echo "WAZUH_COMPONENTS=$JSON_ARRAY" >> $GITHUB_OUTPUT
|
||||
|
||||
build-and-push:
|
||||
runs-on: codebuild-github-actions-codebuild-runner-devops-amd-${{ github.run_id }}-${{ github.run_attempt }}
|
||||
|
||||
permissions:
|
||||
id-token: write
|
||||
contents: read
|
||||
|
||||
needs:
|
||||
- setup
|
||||
|
||||
strategy:
|
||||
fail-fast: false # all jobs will run even if one fails
|
||||
matrix:
|
||||
wazuh_component: ${{ fromJson(needs.setup.outputs.WAZUH_COMPONENTS) }}
|
||||
|
||||
env:
|
||||
IMAGE_REGISTRY: ${{ inputs.dev && vars.IMAGE_REGISTRY_DEV || vars.IMAGE_REGISTRY_PROD }}
|
||||
IMAGE_TAG: ${{ inputs.image_tag }}
|
||||
REVISION: ${{ inputs.revision }}
|
||||
|
||||
steps:
|
||||
- name: Checkout repository
|
||||
uses: actions/checkout@v6
|
||||
with:
|
||||
ref: ${{ inputs.docker_reference }}
|
||||
|
||||
- name: Log in to Docker Hub
|
||||
uses: docker/login-action@v4
|
||||
with:
|
||||
username: ${{ secrets.DOCKERHUB_USERNAME }}
|
||||
password: ${{ secrets.DOCKERHUB_PASSWORD }}
|
||||
|
||||
- name: Set up QEMU
|
||||
uses: docker/setup-qemu-action@v4
|
||||
|
||||
- name: Set up Docker Buildx
|
||||
uses: docker/setup-buildx-action@v4
|
||||
|
||||
- name: Configure aws credentials
|
||||
if: ${{ inputs.dev == true }}
|
||||
uses: aws-actions/configure-aws-credentials@v6
|
||||
with:
|
||||
role-to-assume: ${{ secrets.AWS_IAM_DOCKER_ROLE }}
|
||||
aws-region: "${{ secrets.AWS_REGION }}"
|
||||
|
||||
- name: Log in to Amazon ECR
|
||||
if: ${{ inputs.dev == true }}
|
||||
uses: aws-actions/amazon-ecr-login@v2
|
||||
|
||||
- name: Build Wazuh images
|
||||
run: |
|
||||
IMAGE_TAG="${{ inputs.image_tag }}"
|
||||
FILEBEAT_MODULE_VERSION=${{ inputs.filebeat_module_version }}
|
||||
REVISION=${{ inputs.revision }}
|
||||
|
||||
if [[ "$IMAGE_TAG" == *"-"* ]]; then
|
||||
IFS='-' read -r -a tokens <<< "$IMAGE_TAG"
|
||||
if [ -z "${tokens[1]}" ]; then
|
||||
echo "Invalid image tag: $IMAGE_TAG"
|
||||
exit 1
|
||||
fi
|
||||
DEV_STAGE=${tokens[1]}
|
||||
WAZUH_VER=${tokens[0]}
|
||||
./build-images.sh -v $WAZUH_VER -r $REVISION -d $DEV_STAGE -f $FILEBEAT_MODULE_VERSION -rg $IMAGE_REGISTRY -m -c ${{ matrix.wazuh_component }}
|
||||
else
|
||||
./build-images.sh -v $IMAGE_TAG -r $REVISION -f $FILEBEAT_MODULE_VERSION -rg $IMAGE_REGISTRY -m -c ${{ matrix.wazuh_component }}
|
||||
fi
|
||||
|
||||
# Save .env file (generated by build-images.sh) contents to $GITHUB_ENV
|
||||
ENV_FILE_PATH="../.env"
|
||||
|
||||
if [ -f $ENV_FILE_PATH ]; then
|
||||
while IFS= read -r line || [ -n "$line" ]; do
|
||||
echo "$line" >> $GITHUB_ENV
|
||||
done < $ENV_FILE_PATH
|
||||
else
|
||||
echo "The environment file $ENV_FILE_PATH does not exist!"
|
||||
exit 1
|
||||
fi
|
||||
working-directory: ./build-docker-images
|
||||
|
||||
|
||||
notify:
|
||||
runs-on: codebuild-github-actions-codebuild-runner-devops-amd-${{ github.run_id }}-${{ github.run_attempt }}
|
||||
needs: [setup, build-and-push]
|
||||
# Only run if NOT dev AND all products were selected
|
||||
if: ${{ inputs.dev == false && needs.setup.outputs.ALL_PRODUCTS_SELECTED == 'true' }}
|
||||
|
||||
steps:
|
||||
- name: Image exists validation
|
||||
id: validation
|
||||
run: |
|
||||
IMAGE_TAG=${{ inputs.image_tag }}
|
||||
IMAGE_REGISTRY="${{ vars.IMAGE_REGISTRY_PROD }}"
|
||||
PURPOSE=""
|
||||
|
||||
if [[ "$IMAGE_TAG" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
|
||||
if docker manifest inspect $IMAGE_REGISTRY/wazuh/wazuh-manager:$IMAGE_TAG > /dev/null 2>&1; then
|
||||
PURPOSE="regeneration"
|
||||
echo "Image wazuh/wazuh-manager:$IMAGE_TAG exists. Setting PURPOSE to 'regeneration'"
|
||||
else
|
||||
PURPOSE="new release"
|
||||
echo "Image wazuh/wazuh-manager:$IMAGE_TAG does NOT exist. Setting PURPOSE to 'new release'"
|
||||
fi
|
||||
echo "✅ Release tag: '$IMAGE_TAG'"
|
||||
elif [[ "$IMAGE_TAG" =~ ^[0-9]+\.[0-9]+\.[0-9]+-(alpha|beta|rc)[0-9]+$ ]]; then
|
||||
PURPOSE="new stage"
|
||||
echo "✅ Stage tag: '$IMAGE_TAG'. Setting PURPOSE to 'new stage'"
|
||||
else
|
||||
echo "❌ No release or stage tag ('$IMAGE_TAG'), the GH issue will not be created"
|
||||
fi
|
||||
|
||||
echo "purpose=$PURPOSE" >> $GITHUB_OUTPUT
|
||||
|
||||
- name: GH issue notification
|
||||
if: ${{ steps.validation.outputs.purpose != '' }}
|
||||
env:
|
||||
GH_TOKEN: ${{ secrets.NOTIFICATION_GH_ARTIFACT_TOKEN }}
|
||||
run: |
|
||||
IMAGE_TAG=${{ inputs.image_tag }}
|
||||
PURPOSE="${{ steps.validation.outputs.purpose }}"
|
||||
|
||||
GH_TITLE=""
|
||||
GH_MESSAGE=""
|
||||
|
||||
## Setting GH issue title
|
||||
GH_TITLE="Artifactory vulnerabilities update \`v$IMAGE_TAG\`"
|
||||
|
||||
## Setting GH issue body
|
||||
GH_MESSAGE=$(cat <<- EOF | tr -d '\r' | sed 's/^[[:space:]]*//'
|
||||
### Description
|
||||
- [ ] Update the [Artifactory vulnerabilities](${{ secrets.NOTIFICATION_SHEET_URL }}) sheet with the \`v$IMAGE_TAG\` vulnerabilities.
|
||||
|
||||
**Purpose**: $PURPOSE
|
||||
>[!NOTE]
|
||||
>To update the \`Tentative Release\` column, follow these steps:
|
||||
https://github.com/wazuh/${{ secrets.NOTIFICATION_REPO }}/issues/2049#issuecomment-2671590268
|
||||
EOF
|
||||
)
|
||||
|
||||
# Print the GH Variables content
|
||||
echo "--- Variable Content ---"
|
||||
echo "$GH_TITLE"
|
||||
echo "------------------------"
|
||||
|
||||
echo "--- Variable Content ---"
|
||||
echo "$GH_MESSAGE"
|
||||
echo "------------------------"
|
||||
|
||||
## GH issue creation
|
||||
ISSUE_URL=$(gh issue create \
|
||||
-R wazuh/${{ secrets.NOTIFICATION_REPO }} \
|
||||
--title "$GH_TITLE" \
|
||||
--body "$GH_MESSAGE" \
|
||||
--label "level/task" \
|
||||
--label "type/maintenance" \
|
||||
--label "request/operational")
|
||||
|
||||
## Adding the issue to the team project
|
||||
PROJECT_ITEM_ID=$(gh project item-add \
|
||||
${{ secrets.NOTIFICATION_PROJECT_NUMBER }} \
|
||||
--url $ISSUE_URL \
|
||||
--owner wazuh \
|
||||
--format json \
|
||||
| jq -r '.id')
|
||||
|
||||
## Setting Objective
|
||||
gh project item-edit --id $PROJECT_ITEM_ID --project-id ${{ secrets.NOTIFICATION_PROJECT_ID }} --field-id ${{ secrets.NOTIFICATION_PROJECT_OBJECTIVE_ID }} --text "Security scans"
|
||||
## Setting Priority
|
||||
gh project item-edit --id $PROJECT_ITEM_ID --project-id ${{ secrets.NOTIFICATION_PROJECT_ID }} --field-id ${{ secrets.NOTIFICATION_PROJECT_PRIORITY_ID }} --single-select-option-id ${{ secrets.NOTIFICATION_PROJECT_PRIORITY_OPTION_ID }}
|
||||
## Setting Size
|
||||
gh project item-edit --id $PROJECT_ITEM_ID --project-id ${{ secrets.NOTIFICATION_PROJECT_ID }} --field-id ${{ secrets.NOTIFICATION_PROJECT_SIZE_ID }} --single-select-option-id ${{ secrets.NOTIFICATION_PROJECT_SIZE_OPTION_ID }}
|
||||
## Setting Subteam
|
||||
gh project item-edit --id $PROJECT_ITEM_ID --project-id ${{ secrets.NOTIFICATION_PROJECT_ID }} --field-id ${{ secrets.NOTIFICATION_PROJECT_SUBTEAM_ID }} --single-select-option-id ${{ secrets.NOTIFICATION_PROJECT_SUBTEAM_OPTION_ID }}
|
||||
@@ -1,4 +1,4 @@
|
||||
name: (4.x) Repository bumper
|
||||
name: Repository bumper 4.x
|
||||
run-name: Bump ${{ github.ref_name }} (${{ inputs.id }})
|
||||
|
||||
on:
|
||||
@@ -31,7 +31,7 @@ on:
|
||||
jobs:
|
||||
bump:
|
||||
name: Repository bumper 4.x
|
||||
runs-on: codebuild-github-actions-codebuild-runner-devops-amd-${{ github.run_id }}-${{ github.run_attempt }}
|
||||
runs-on: ubuntu-24.04
|
||||
permissions:
|
||||
contents: write
|
||||
pull-requests: write
|
||||
@@ -110,21 +110,13 @@ jobs:
|
||||
bash ${{ env.BUMP_SCRIPT_PATH }} ${{ steps.vars.outputs.script_params }}
|
||||
|
||||
- name: Commit and push changes
|
||||
id: bump_commit
|
||||
run: |
|
||||
git add .
|
||||
if git diff --staged --quiet; then
|
||||
echo "Nothing to bump: the repository is already at the requested version/stage. Skipping commit."
|
||||
echo "has_changes=false" >> $GITHUB_OUTPUT
|
||||
else
|
||||
git commit -m "feat: bump ${{ github.ref_name }}"
|
||||
git push origin ${{ steps.vars.outputs.branch_name }}
|
||||
echo "has_changes=true" >> $GITHUB_OUTPUT
|
||||
fi
|
||||
git commit -m "feat: bump ${{ github.ref_name }}"
|
||||
git push origin ${{ steps.vars.outputs.branch_name }}
|
||||
|
||||
- name: Create pull request
|
||||
id: create_pr
|
||||
if: steps.bump_commit.outputs.has_changes == 'true'
|
||||
run: |
|
||||
gh auth setup-git
|
||||
PR_URL=$(gh pr create \
|
||||
@@ -137,19 +129,14 @@ jobs:
|
||||
echo "pull_request_url=${PR_URL}" >> $GITHUB_OUTPUT
|
||||
|
||||
- name: Merge pull request
|
||||
if: steps.bump_commit.outputs.has_changes == 'true'
|
||||
run: |
|
||||
# Any checks for the PR are bypassed since the branch is expected to be functional (i.e. the bump process does not introduce any bugs)
|
||||
gh pr merge "${{ steps.create_pr.outputs.pull_request_url }}" --merge --admin
|
||||
|
||||
- name: Show logs
|
||||
run: |
|
||||
if [[ "${{ steps.bump_commit.outputs.has_changes }}" == "true" ]]; then
|
||||
echo "Bump complete."
|
||||
echo "Branch: ${{ steps.vars.outputs.branch_name }}"
|
||||
echo "PR: ${{ steps.create_pr.outputs.pull_request_url }}"
|
||||
else
|
||||
echo "Bump skipped: the repository is already at the requested version/stage."
|
||||
fi
|
||||
echo "Bump complete."
|
||||
echo "Branch: ${{ steps.vars.outputs.branch_name }}"
|
||||
echo "PR: ${{ steps.create_pr.outputs.pull_request_url }}"
|
||||
echo "Bumper scripts logs:"
|
||||
cat ${BUMP_LOG_PATH}/repository_bumper*log
|
||||
@@ -1,352 +0,0 @@
|
||||
name: (4.x) Docker PR check
|
||||
|
||||
on:
|
||||
pull_request:
|
||||
types: [opened, synchronize, reopened, ready_for_review]
|
||||
branches:
|
||||
- 4.*
|
||||
paths:
|
||||
- 'build-docker-images/**'
|
||||
- 'multi-node/**'
|
||||
- 'single-node/**'
|
||||
- 'wazuh-agent/**'
|
||||
- '.github/**'
|
||||
|
||||
env:
|
||||
ARTIFACTS_LOCAL_DIR: /home/runner/work/wazuh-docker/wazuh-docker/docker-images
|
||||
ARTIFACT_NAMES: |
|
||||
wazuh-manager.tar
|
||||
wazuh-indexer.tar
|
||||
wazuh-dashboard.tar
|
||||
wazuh-agent.tar
|
||||
|
||||
jobs:
|
||||
build-docker-images:
|
||||
runs-on: codebuild-github-actions-codebuild-runner-devops-amd-${{ github.run_id }}-${{ github.run_attempt }}
|
||||
steps:
|
||||
|
||||
- name: Check out code
|
||||
uses: actions/checkout@v6
|
||||
|
||||
- name: Log in to Docker Hub
|
||||
uses: docker/login-action@v4
|
||||
with:
|
||||
username: ${{ secrets.DOCKERHUB_USERNAME }}
|
||||
password: ${{ secrets.DOCKERHUB_PASSWORD }}
|
||||
|
||||
- name: Build Wazuh images
|
||||
run: ./build-images.sh
|
||||
working-directory: ./build-docker-images
|
||||
|
||||
- name: Create enviroment variables
|
||||
run: cat .env > $GITHUB_ENV
|
||||
|
||||
- name: Create backup Docker images
|
||||
run: |
|
||||
mkdir -p /home/runner/work/wazuh-docker/wazuh-docker/docker-images/
|
||||
docker save wazuh/wazuh-manager:${{env.WAZUH_IMAGE_VERSION}} -o /home/runner/work/wazuh-docker/wazuh-docker/docker-images/wazuh-manager.tar
|
||||
docker save wazuh/wazuh-indexer:${{env.WAZUH_IMAGE_VERSION}} -o /home/runner/work/wazuh-docker/wazuh-docker/docker-images/wazuh-indexer.tar
|
||||
docker save wazuh/wazuh-dashboard:${{env.WAZUH_IMAGE_VERSION}} -o /home/runner/work/wazuh-docker/wazuh-docker/docker-images/wazuh-dashboard.tar
|
||||
docker save wazuh/wazuh-agent:${{env.WAZUH_IMAGE_VERSION}} -o /home/runner/work/wazuh-docker/wazuh-docker/docker-images/wazuh-agent.tar
|
||||
|
||||
- name: Temporarily save Wazuh Docker images
|
||||
env:
|
||||
S3_ARTIFACTS_PATH: ${{ secrets.CI_DEV_INTERNAL_S3_BUCKET }}/wazuh-docker/4_pr_check/${{ github.run_id }}
|
||||
run: |
|
||||
echo "Uploading Docker image artifacts to S3..."
|
||||
while IFS= read -r artifact; do
|
||||
[ -z "$artifact" ] && continue
|
||||
echo " Uploading: $artifact"
|
||||
aws s3 cp "${ARTIFACTS_LOCAL_DIR}/${artifact}" "${S3_ARTIFACTS_PATH}/${artifact}"
|
||||
done <<< "$ARTIFACT_NAMES"
|
||||
echo "All artifacts uploaded successfully."
|
||||
|
||||
check-single-node:
|
||||
runs-on: codebuild-github-actions-codebuild-runner-devops-amd-${{ github.run_id }}-${{ github.run_attempt }}
|
||||
needs: build-docker-images
|
||||
steps:
|
||||
|
||||
- name: Check out code
|
||||
uses: actions/checkout@v6
|
||||
|
||||
- name: Create enviroment variables
|
||||
run: cat .env > $GITHUB_ENV
|
||||
|
||||
- name: Log in to Docker Hub
|
||||
uses: docker/login-action@v4
|
||||
with:
|
||||
username: ${{ secrets.DOCKERHUB_USERNAME }}
|
||||
password: ${{ secrets.DOCKERHUB_PASSWORD }}
|
||||
|
||||
- name: Retrieve saved Wazuh Docker images and load them into Docker
|
||||
env:
|
||||
S3_ARTIFACTS_PATH: s3://${{ secrets.CI_DEV_INTERNAL_S3_BUCKET }}/wazuh-docker/4_pr_check/${{ github.run_id }}
|
||||
ARTIFACTS_LOCAL_DIR: /home/runner/work/wazuh-docker/wazuh-docker/docker-images
|
||||
run: |
|
||||
mkdir -p "${ARTIFACTS_LOCAL_DIR}"
|
||||
echo "Downloading and loading Docker image artifacts from S3..."
|
||||
while IFS= read -r artifact; do
|
||||
[ -z "$artifact" ] && continue
|
||||
echo " Downloading: $artifact"
|
||||
aws s3 cp "${S3_ARTIFACTS_PATH}/${artifact}" "${ARTIFACTS_LOCAL_DIR}/${artifact}"
|
||||
echo " Loading into Docker: $artifact"
|
||||
docker load -i "${ARTIFACTS_LOCAL_DIR}/${artifact}"
|
||||
done <<< "$ARTIFACT_NAMES"
|
||||
echo "All artifacts downloaded and loaded successfully."
|
||||
|
||||
- name: Create single node certficates
|
||||
run: docker compose -f single-node/generate-indexer-certs.yml run --rm generator
|
||||
|
||||
- name: Start single node stack
|
||||
run: docker compose -f single-node/docker-compose.yml up -d
|
||||
|
||||
- name: Check Wazuh indexer start
|
||||
run: |
|
||||
sleep 60
|
||||
status_green="`curl -XGET "https://0.0.0.0:9200/_cluster/health" -u admin:SecretPassword -k -s | grep green | wc -l`"
|
||||
if [[ $status_green -eq 1 ]]; then
|
||||
curl -XGET "https://0.0.0.0:9200/_cluster/health" -u admin:SecretPassword -k -s
|
||||
else
|
||||
curl -XGET "https://0.0.0.0:9200/_cluster/health" -u admin:SecretPassword -k -s
|
||||
exit 1
|
||||
fi
|
||||
status_index="`curl -XGET "https://0.0.0.0:9200/_cat/indices" -u admin:SecretPassword -k -s | wc -l`"
|
||||
status_index_green="`curl -XGET "https://0.0.0.0:9200/_cat/indices" -u admin:SecretPassword -k -s | grep "green" | wc -l`"
|
||||
if [[ $status_index_green -eq $status_index ]]; then
|
||||
curl -XGET "https://0.0.0.0:9200/_cat/indices" -u admin:SecretPassword -k -s
|
||||
else
|
||||
curl -XGET "https://0.0.0.0:9200/_cat/indices" -u admin:SecretPassword -k -s
|
||||
exit 1
|
||||
fi
|
||||
|
||||
|
||||
- name: Check Wazuh indexer nodes
|
||||
run: |
|
||||
nodes="`curl -XGET "https://0.0.0.0:9200/_cat/nodes" -u admin:SecretPassword -k -s | grep -E "indexer" | wc -l`"
|
||||
if [[ $nodes -eq 1 ]]; then
|
||||
echo "Wazuh indexer nodes: ${nodes}"
|
||||
else
|
||||
echo "Wazuh indexer nodes: ${nodes}"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
- name: Check Wazuh templates
|
||||
run: |
|
||||
qty_templates="`curl -XGET "https://0.0.0.0:9200/_cat/templates" -u admin:SecretPassword -k -s | grep -P "wazuh|wazuh-agent|wazuh-statistics" | wc -l`"
|
||||
templates="`curl -XGET "https://0.0.0.0:9200/_cat/templates" -u admin:SecretPassword -k -s | grep -P "wazuh|wazuh-agent|wazuh-statistics"`"
|
||||
if [[ $qty_templates -gt 3 ]]; then
|
||||
echo "wazuh templates:"
|
||||
echo "${templates}"
|
||||
else
|
||||
echo "wazuh templates:"
|
||||
echo "${templates}"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
- name: Check Wazuh manager start
|
||||
run: |
|
||||
services="`curl -k -s -X GET "https://0.0.0.0:55000/manager/status?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items | grep running | wc -l`"
|
||||
if [[ $services -gt 9 ]]; then
|
||||
echo "Wazuh Manager Services: ${services}"
|
||||
echo "OK"
|
||||
else
|
||||
echo "Wazuh indexer nodes: ${nodes}"
|
||||
curl -k -X GET "https://0.0.0.0:55000/manager/status?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items
|
||||
exit 1
|
||||
fi
|
||||
env:
|
||||
TOKEN: $(curl -s -u wazuh-wui:MyS3cr37P450r.*- -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true")
|
||||
|
||||
- name: Check filebeat output
|
||||
run: ./.github/single-node-filebeat-check.sh
|
||||
|
||||
- name: Check Wazuh dashboard service URL
|
||||
run: |
|
||||
status=$(curl -XGET --silent https://0.0.0.0:443/app/status -k -u admin:SecretPassword -I -s | grep -E "^HTTP" | awk '{print $2}')
|
||||
if [[ $status -eq 200 ]]; then
|
||||
echo "Wazuh dashboard status: ${status}"
|
||||
else
|
||||
echo "Wazuh dashboard status: ${status}"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
- name: Modify Docker endpoint into Wazuh agent docker-compose.yml file
|
||||
run: sed -i "s/<WAZUH_MANAGER_IP>/$(ip addr show docker0 | grep 'inet ' | awk '{print $2}' | cut -d'/' -f1)/g" wazuh-agent/docker-compose.yml
|
||||
|
||||
- name: Start Wazuh agent
|
||||
run: docker compose -f wazuh-agent/docker-compose.yml up -d
|
||||
|
||||
- name: Check Wazuh agent enrollment
|
||||
run: |
|
||||
sleep 20
|
||||
curl -k -s -X GET "https://localhost:55000/agents?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}"
|
||||
env:
|
||||
TOKEN: $(curl -s -u wazuh-wui:MyS3cr37P450r.*- -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true")
|
||||
|
||||
- name: Check documents into wazuh-alerts index
|
||||
run: |
|
||||
sleep 120
|
||||
docs="`curl -XGET "https://0.0.0.0:9200/wazuh-alerts*/_count" -u admin:SecretPassword -k -s | jq -r ".count"`"
|
||||
if [[ $docs -gt 0 ]]; then
|
||||
echo "wazuh-alerts index documents: ${docs}"
|
||||
else
|
||||
echo "wazuh-alerts index documents: ${docs}"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
- name: Check errors in ossec.log for Wazuh manager
|
||||
run: ./.github/single-node-log-check.sh
|
||||
|
||||
check-multi-node:
|
||||
runs-on: codebuild-github-actions-codebuild-runner-devops-amd-${{ github.run_id }}-${{ github.run_attempt }}
|
||||
needs: build-docker-images
|
||||
steps:
|
||||
|
||||
- name: Check out code
|
||||
uses: actions/checkout@v6
|
||||
|
||||
- name: Create enviroment variables
|
||||
run: cat .env > $GITHUB_ENV
|
||||
|
||||
- name: Log in to Docker Hub
|
||||
uses: docker/login-action@v4
|
||||
with:
|
||||
username: ${{ secrets.DOCKERHUB_USERNAME }}
|
||||
password: ${{ secrets.DOCKERHUB_PASSWORD }}
|
||||
|
||||
- name: Retrieve saved Wazuh Docker images and load them into Docker
|
||||
env:
|
||||
S3_ARTIFACTS_PATH: s3://${{ secrets.CI_DEV_INTERNAL_S3_BUCKET }}/wazuh-docker/4_pr_check/${{ github.run_id }}
|
||||
ARTIFACTS_LOCAL_DIR: /home/runner/work/wazuh-docker/wazuh-docker/docker-images
|
||||
run: |
|
||||
mkdir -p "${ARTIFACTS_LOCAL_DIR}"
|
||||
echo "Downloading and loading Docker image artifacts from S3..."
|
||||
while IFS= read -r artifact; do
|
||||
[ -z "$artifact" ] && continue
|
||||
echo " Downloading: $artifact"
|
||||
aws s3 cp "${S3_ARTIFACTS_PATH}/${artifact}" "${ARTIFACTS_LOCAL_DIR}/${artifact}"
|
||||
echo " Loading into Docker: $artifact"
|
||||
docker load -i "${ARTIFACTS_LOCAL_DIR}/${artifact}"
|
||||
done <<< "$ARTIFACT_NAMES"
|
||||
echo "All artifacts downloaded and loaded successfully."
|
||||
|
||||
- name: Create multi node certficates
|
||||
run: docker compose -f multi-node/generate-indexer-certs.yml run --rm generator
|
||||
|
||||
- name: Start multi node stack
|
||||
run: docker compose -f multi-node/docker-compose.yml up -d
|
||||
|
||||
- name: Check Wazuh indexer start
|
||||
run: |
|
||||
until [[ `curl -XGET "https://0.0.0.0:9200/_cluster/health" -u admin:SecretPassword -k -s | grep green | wc -l` -eq 1 ]]
|
||||
do
|
||||
echo 'Waiting for Wazuh indexer start'
|
||||
free -m
|
||||
df -h
|
||||
sleep 120
|
||||
done
|
||||
status_green="`curl -XGET "https://0.0.0.0:9200/_cluster/health" -u admin:SecretPassword -k -s | grep green | wc -l`"
|
||||
if [[ $status_green -eq 1 ]]; then
|
||||
curl -XGET "https://0.0.0.0:9200/_cluster/health" -u admin:SecretPassword -k -s
|
||||
else
|
||||
curl -XGET "https://0.0.0.0:9200/_cluster/health" -u admin:SecretPassword -k -s
|
||||
exit 1
|
||||
fi
|
||||
status_index="`curl -XGET "https://0.0.0.0:9200/_cat/indices" -u admin:SecretPassword -k -s | wc -l`"
|
||||
status_index_green="`curl -XGET "https://0.0.0.0:9200/_cat/indices" -u admin:SecretPassword -k -s | grep -E "green" | wc -l`"
|
||||
if [[ $status_index_green -eq $status_index ]]; then
|
||||
curl -XGET "https://0.0.0.0:9200/_cat/indices" -u admin:SecretPassword -k -s
|
||||
else
|
||||
curl -XGET "https://0.0.0.0:9200/_cat/indices" -u admin:SecretPassword -k -s
|
||||
exit 1
|
||||
fi
|
||||
|
||||
- name: Check Wazuh indexer nodes
|
||||
run: |
|
||||
nodes="`curl -XGET "https://0.0.0.0:9200/_cat/nodes" -u admin:SecretPassword -k -s | grep -E "indexer" | wc -l`"
|
||||
if [[ $nodes -eq 3 ]]; then
|
||||
echo "Wazuh indexer nodes: ${nodes}"
|
||||
else
|
||||
echo "Wazuh indexer nodes: ${nodes}"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
- name: Check Wazuh templates
|
||||
run: |
|
||||
qty_templates="`curl -XGET "https://0.0.0.0:9200/_cat/templates" -u admin:SecretPassword -k -s | grep "wazuh" | wc -l`"
|
||||
templates="`curl -XGET "https://0.0.0.0:9200/_cat/templates" -u admin:SecretPassword -k -s | grep "wazuh"`"
|
||||
if [[ $qty_templates -gt 3 ]]; then
|
||||
echo "wazuh templates:"
|
||||
echo "${templates}"
|
||||
else
|
||||
echo "wazuh templates:"
|
||||
echo "${templates}"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
- name: Check Wazuh manager start
|
||||
run: |
|
||||
services="`curl -k -s -X GET "https://0.0.0.0:55000/manager/status?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items | grep running | wc -l`"
|
||||
if [[ $services -gt 10 ]]; then
|
||||
echo "Wazuh Manager Services: ${services}"
|
||||
echo "OK"
|
||||
else
|
||||
echo "Wazuh indexer nodes: ${nodes}"
|
||||
curl -k -s -X GET "https://0.0.0.0:55000/manager/status?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items
|
||||
exit 1
|
||||
fi
|
||||
nodes=$(curl -k -s -X GET "https://0.0.0.0:55000/cluster/nodes" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r ".data.affected_items[].name" | wc -l)
|
||||
if [[ $nodes -eq 2 ]]; then
|
||||
echo "Wazuh manager nodes: ${nodes}"
|
||||
else
|
||||
echo "Wazuh manager nodes: ${nodes}"
|
||||
exit 1
|
||||
fi
|
||||
env:
|
||||
TOKEN: $(curl -s -u wazuh-wui:MyS3cr37P450r.*- -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true")
|
||||
|
||||
- name: Check filebeat output
|
||||
run: ./.github/multi-node-filebeat-check.sh
|
||||
|
||||
- name: Check Wazuh dashboard service URL
|
||||
run: |
|
||||
status=$(curl -XGET --silent https://0.0.0.0:443/app/status -k -u admin:SecretPassword -I | grep -E "^HTTP" | awk '{print $2}')
|
||||
if [[ $status -eq 200 ]]; then
|
||||
echo "Wazuh dashboard status: ${status}"
|
||||
else
|
||||
echo "Wazuh dashboard status: ${status}"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
- name: Modify Docker endpoint into Wazuh agent docker-compose.yml file
|
||||
run: sed -i "s/<WAZUH_MANAGER_IP>/$(ip addr show docker0 | grep 'inet ' | awk '{print $2}' | cut -d'/' -f1)/g" wazuh-agent/docker-compose.yml
|
||||
|
||||
- name: Start Wazuh agent
|
||||
run: docker compose -f wazuh-agent/docker-compose.yml up -d
|
||||
|
||||
- name: Check Wazuh agent enrollment
|
||||
run: |
|
||||
sleep 20
|
||||
curl -k -s -X GET "https://localhost:55000/agents?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}"
|
||||
env:
|
||||
TOKEN: $(curl -s -u wazuh-wui:MyS3cr37P450r.*- -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true")
|
||||
|
||||
- name: Check documents into wazuh-alerts index
|
||||
run: |
|
||||
until [[ $(``curl -XGET "https://0.0.0.0:9200/wazuh-alerts*/_count" -u admin:SecretPassword -k -s | jq -r ".count"``) -gt 0 ]]
|
||||
do
|
||||
echo 'Waiting for Wazuh indexer events'
|
||||
free -m
|
||||
df -h
|
||||
sleep 10
|
||||
done
|
||||
docs="`curl -XGET "https://0.0.0.0:9200/wazuh-alerts*/_count" -u admin:SecretPassword -k -s | jq -r ".count"`"
|
||||
if [[ $docs -gt 0 ]]; then
|
||||
echo "wazuh-alerts index documents: ${docs}"
|
||||
else
|
||||
echo "wazuh-alerts index documents: ${docs}"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
- name: Check errors in ossec.log for Wazuh manager
|
||||
run: ./.github/multi-node-log-check.sh
|
||||
@@ -1,4 +1,4 @@
|
||||
name: (5.x) Repository bumper
|
||||
name: Repository bumper 5.x
|
||||
run-name: Bump ${{ github.ref_name }} (${{ inputs.id }})
|
||||
|
||||
on:
|
||||
@@ -37,15 +37,10 @@ on:
|
||||
default: false
|
||||
required: false
|
||||
type: boolean
|
||||
bump-issue-link:
|
||||
description: 'Issue link used in the original bump (required for revert if different from issue-link)'
|
||||
required: false
|
||||
type: string
|
||||
|
||||
jobs:
|
||||
bump:
|
||||
name: Repository bumper 5.x
|
||||
runs-on: codebuild-github-actions-codebuild-runner-devops-amd-${{ github.run_id }}-${{ github.run_attempt }}
|
||||
runs-on: ubuntu-24.04
|
||||
permissions:
|
||||
contents: write
|
||||
pull-requests: write
|
||||
@@ -101,24 +96,18 @@ jobs:
|
||||
version=${{ env.VERSION }}
|
||||
stage=${{ env.STAGE }}
|
||||
tag=${{ env.TAG }}
|
||||
|
||||
set_as_main=${{ inputs.set_as_main }}
|
||||
|
||||
if [[ -n "$version" && -n "$stage" && "$tag" != "true" ]]; then
|
||||
script_params="--version ${version} --stage ${stage}"
|
||||
elif [[ -n "$version" && -n "$stage" && "$tag" == "true" ]]; then
|
||||
script_params="--version ${version} --stage ${stage} --tag"
|
||||
elif [[ -z "$version" && -n "$stage" && "$tag" == "true" ]]; then
|
||||
script_params="--stage ${stage} --tag"
|
||||
elif [[ -z "$version" && -z "$stage" && "$tag" == "true" ]]; then
|
||||
script_params="--tag"
|
||||
if [[ "$set_as_main" == "true" ]]; then
|
||||
script_params="--set-as-main"
|
||||
fi
|
||||
|
||||
if [[ "$set_as_main" == "true" ]]; then
|
||||
if [[ -z "$version" || -z "$stage" ]]; then
|
||||
echo "Error: set_as_main requires both version and stage inputs."
|
||||
exit 1
|
||||
fi
|
||||
script_params="${script_params} --set-as-main"
|
||||
# Both version and stage provided
|
||||
if [[ -n "$version" && -n "$stage" && "$tag" != "true" ]]; then
|
||||
script_params+=" --version ${version} --stage ${stage}"
|
||||
elif [[ -n "$version" && -n "$stage" && "$tag" == "true" ]]; then
|
||||
script_params+=" --version ${version} --stage ${stage} --tag ${tag}"
|
||||
fi
|
||||
|
||||
issue_number=$(echo "${{ inputs.issue-link }}" | awk -F'/' '{print $NF}')
|
||||
@@ -144,17 +133,10 @@ jobs:
|
||||
bash ${{ env.BUMP_SCRIPT_PATH }} ${{ steps.vars.outputs.script_params }}
|
||||
|
||||
- name: Commit changes (Bump)
|
||||
id: bump_commit
|
||||
if: inputs.revert != true
|
||||
run: |
|
||||
git add .
|
||||
if git diff --staged --quiet; then
|
||||
echo "Nothing to bump: the repository is already at the requested version/stage. Skipping commit."
|
||||
echo "has_changes=false" >> $GITHUB_OUTPUT
|
||||
else
|
||||
git commit -m "feat: bump ${{ github.ref_name }}"
|
||||
echo "has_changes=true" >> $GITHUB_OUTPUT
|
||||
fi
|
||||
git commit -m "feat: bump ${{ github.ref_name }}"
|
||||
|
||||
- name: Fetch full history (Revert)
|
||||
if: inputs.revert == true
|
||||
@@ -164,18 +146,9 @@ jobs:
|
||||
id: revert_step
|
||||
if: inputs.revert == true
|
||||
run: |
|
||||
# 1. Get the current issue number (for the new revert branch/PR)
|
||||
ISSUE_NUMBER=$(echo "${{ inputs.issue-link }}" | awk -F'/' '{print $NF}')
|
||||
|
||||
# 2. Get the issue number from the original bump (if provided; otherwise, defaults to the current one)
|
||||
if [ -n "${{ inputs.bump-issue-link }}" ]; then
|
||||
BUMP_ISSUE_NUMBER=$(echo "${{ inputs.bump-issue-link }}" | awk -F'/' '{print $NF}')
|
||||
else
|
||||
BUMP_ISSUE_NUMBER=$ISSUE_NUMBER
|
||||
fi
|
||||
|
||||
# 3. Search for the original bump branch using the obtained BUMP ISSUE number
|
||||
BUMP_BRANCH="enhancement/wqa${BUMP_ISSUE_NUMBER}-bump-${{ github.ref_name }}"
|
||||
BUMP_BRANCH="enhancement/wqa${ISSUE_NUMBER}-bump-${{ github.ref_name }}"
|
||||
|
||||
PR_NUMBER=$(gh pr list --head "$BUMP_BRANCH" --base "${{ github.ref_name }}" --state merged --json number --jq '.[0].number')
|
||||
|
||||
@@ -194,7 +167,7 @@ jobs:
|
||||
# Remove the files to prevent them from being included in the revert commit
|
||||
git checkout HEAD -- VERSION.json 2>/dev/null || true
|
||||
git checkout HEAD -- CHANGELOG.md 2>/dev/null || true
|
||||
# [!] ADD ANY OTHER REPOSITORY-SPECIFIC VERSION FILES HERE [!]
|
||||
# Add any other repository-specific version files here
|
||||
|
||||
if git diff --staged --quiet; then
|
||||
echo "No references to revert. Skipping commit."
|
||||
@@ -205,13 +178,13 @@ jobs:
|
||||
fi
|
||||
|
||||
- name: Push changes
|
||||
if: (inputs.revert != true && steps.bump_commit.outputs.has_changes == 'true') || (inputs.revert == true && steps.revert_step.outputs.has_changes == 'true')
|
||||
if: inputs.revert != true || (inputs.revert == true && steps.revert_step.outputs.has_changes == 'true')
|
||||
run: |
|
||||
git push origin ${{ steps.vars.outputs.branch_name }}
|
||||
|
||||
- name: Create pull request
|
||||
id: create_pr
|
||||
if: (inputs.revert != true && steps.bump_commit.outputs.has_changes == 'true') || (inputs.revert == true && steps.revert_step.outputs.has_changes == 'true')
|
||||
if: inputs.revert != true || (inputs.revert == true && steps.revert_step.outputs.has_changes == 'true')
|
||||
run: |
|
||||
gh auth setup-git
|
||||
PR_URL=$(gh pr create \
|
||||
@@ -224,7 +197,7 @@ jobs:
|
||||
echo "pull_request_url=${PR_URL}" >> $GITHUB_OUTPUT
|
||||
|
||||
- name: Merge pull request
|
||||
if: (inputs.revert != true && steps.bump_commit.outputs.has_changes == 'true') || (inputs.revert == true && steps.revert_step.outputs.has_changes == 'true')
|
||||
if: inputs.revert != true || (inputs.revert == true && steps.revert_step.outputs.has_changes == 'true')
|
||||
run: |
|
||||
# Any checks for the PR are bypassed since the branch is expected to be functional
|
||||
gh pr merge "${{ steps.create_pr.outputs.pull_request_url }}" --merge --admin
|
||||
@@ -232,13 +205,9 @@ jobs:
|
||||
- name: Show logs
|
||||
if: inputs.revert != true
|
||||
run: |
|
||||
if [[ "${{ steps.bump_commit.outputs.has_changes }}" == "true" ]]; then
|
||||
echo "Bump complete."
|
||||
echo "Branch: ${{ steps.vars.outputs.branch_name }}"
|
||||
echo "PR: ${{ steps.create_pr.outputs.pull_request_url }}"
|
||||
else
|
||||
echo "Bump skipped: the repository is already at the requested version/stage."
|
||||
fi
|
||||
echo "Bump complete."
|
||||
echo "Branch: ${{ steps.vars.outputs.branch_name }}"
|
||||
echo "PR: ${{ steps.create_pr.outputs.pull_request_url }}"
|
||||
echo "Bumper scripts logs:"
|
||||
cat ${BUMP_LOG_PATH}/repository_bumper*log
|
||||
|
||||
@@ -249,4 +218,4 @@ jobs:
|
||||
echo "Branch: ${{ steps.vars.outputs.branch_name }}"
|
||||
echo "PR: ${{ steps.create_pr.outputs.pull_request_url }}"
|
||||
echo "Revert bumper scripts logs:"
|
||||
cat ${BUMP_LOG_PATH}/repository_bumper*log || true
|
||||
cat ${BUMP_LOG_PATH}/repository_bumper*log || true
|
||||
@@ -1,64 +0,0 @@
|
||||
name: 5.x Changelog check
|
||||
|
||||
on:
|
||||
pull_request:
|
||||
types: [opened, synchronize, reopened, ready_for_review, labeled, unlabeled]
|
||||
|
||||
jobs:
|
||||
changelog_check:
|
||||
runs-on: codebuild-github-actions-codebuild-runner-devops-amd-${{ github.run_id }}-${{ github.run_attempt }}
|
||||
if: ${{ github.event_name == 'pull_request' && !github.event.pull_request.draft && !contains(github.event.pull_request.labels.*.name, 'no-changelog') }}
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
|
||||
steps:
|
||||
- name: Checkout repository
|
||||
uses: actions/checkout@v6
|
||||
with:
|
||||
fetch-depth: 0
|
||||
|
||||
- name: Validate CHANGELOG.md changes
|
||||
env:
|
||||
BASE_REF: ${{ github.base_ref }}
|
||||
run: |
|
||||
UPDATED="✅" FORMAT="—" INVALID=""
|
||||
|
||||
ADDED=$(git diff -U0 "origin/${BASE_REF}...HEAD" -- CHANGELOG.md | grep -E '^\+[^+]' | sed 's/^+//' || true)
|
||||
if [ -z "$ADDED" ]; then
|
||||
UPDATED="❌"
|
||||
echo "::error::CHANGELOG.md was not updated with new entries. Add one or add the 'no-changelog' label to skip this check."
|
||||
else
|
||||
FORMAT="✅"
|
||||
|
||||
TABLE_ENTRY_REGEX='^\| \[#[0-9]+\]\(https://github\.com/[^)]+/(issues|pull)/[0-9]+\) \| .+ \|$'
|
||||
TABLE_HEADER_REGEX='^\| Issue \| Comment \|$|^\| - \| - \|$'
|
||||
PRIOR_VERSION_REGEX='^- \[v?[0-9]+\.[0-9]+\.[0-9]+\]\(https://github\.com/[^)]+/blob/[^)]+/CHANGELOG\.md\)$|^- \[\]\(\)$'
|
||||
INVALID=$(echo "$ADDED" | grep -E '^(\||-)' | grep -vx -- '- None' | grep -vE "$TABLE_HEADER_REGEX" | grep -vE "$TABLE_ENTRY_REGEX" | grep -vE "$PRIOR_VERSION_REGEX" || true)
|
||||
if [ -n "$INVALID" ]; then
|
||||
FORMAT="❌"
|
||||
echo "::error::Invalid CHANGELOG.md entries. Expected format: '- Description ([#123](https://github.com/<org>/<repo>/issues/123))' or, for the Prior versions section, '- [vX.X.X](https://github.com/<org>/<repo>/blob/vX.X.X/CHANGELOG.md)'. Offending lines:"
|
||||
echo "$INVALID"
|
||||
fi
|
||||
fi
|
||||
|
||||
{
|
||||
echo "## Changelog check"
|
||||
echo ""
|
||||
echo "| Check | Result |"
|
||||
echo "|---|---|"
|
||||
echo "| CHANGELOG.md has new entries | $UPDATED |"
|
||||
echo "| Entry format | $FORMAT |"
|
||||
if [ -n "$INVALID" ]; then
|
||||
echo ""
|
||||
echo "Offending lines:"
|
||||
echo '```'
|
||||
echo "$INVALID"
|
||||
echo '```'
|
||||
fi
|
||||
} >> "$GITHUB_STEP_SUMMARY"
|
||||
|
||||
if [ "$UPDATED" != "✅" ] || [ "$FORMAT" != "✅" ]; then
|
||||
exit 1
|
||||
fi
|
||||
echo "CHANGELOG.md update is valid."
|
||||
@@ -1,890 +0,0 @@
|
||||
run-name: >-
|
||||
${{ github.event_name == 'workflow_dispatch'
|
||||
&& format('Docker Integration Test - Manual {0} on {1}', inputs.deployment_type, inputs.pr_head_ref)
|
||||
|| format('Docker Integration Test - #{0} {1}', github.event.issue.number, github.event.issue.title) }}
|
||||
name: (5.x) PR Check - Docker Integration Tests
|
||||
|
||||
on:
|
||||
issue_comment:
|
||||
types: [created]
|
||||
workflow_dispatch:
|
||||
inputs:
|
||||
pr_head_ref:
|
||||
description: 'Branch of wazuh-docker to test'
|
||||
required: true
|
||||
type: string
|
||||
automation_reference:
|
||||
description: 'Branch of wazuh-automation to use'
|
||||
required: false
|
||||
default: '5.0.0'
|
||||
type: string
|
||||
deployment_type:
|
||||
description: 'Deployment type to test'
|
||||
required: true
|
||||
type: choice
|
||||
options:
|
||||
- single-node
|
||||
- multi-node
|
||||
- both
|
||||
version:
|
||||
description: 'Image version to test (e.g. 5.0.0).'
|
||||
required: false
|
||||
type: string
|
||||
stage:
|
||||
description: 'Image stage suffix (e.g. beta1, beta2-latest, beta2-<commit>). Required when version is set.'
|
||||
required: false
|
||||
type: string
|
||||
registry:
|
||||
description: 'Docker registry. ECR for dev versions, DockerHub for prod versions.'
|
||||
required: false
|
||||
type: choice
|
||||
options:
|
||||
- ECR
|
||||
- DockerHub
|
||||
|
||||
permissions:
|
||||
id-token: write
|
||||
contents: read
|
||||
pull-requests: write
|
||||
issues: write
|
||||
checks: write
|
||||
|
||||
env:
|
||||
AUTOMATION_REFERENCE: ${{ inputs.automation_reference || 'main' }}
|
||||
ALLOCATOR_PATH: /tmp/allocator_instance
|
||||
REGION: us-east-1
|
||||
LOGS_ARTIFACT_ZIP_FILE: "docker_logs_artifacts_${{ github.run_id }}.zip"
|
||||
|
||||
jobs:
|
||||
# -------------------------------------------------------------------------
|
||||
# Job 1: Parse PR info and determine which deployment(s) to test
|
||||
#
|
||||
# Available commands:
|
||||
# /test-docker-single — test single-node deployment
|
||||
# /test-docker-multi — test multi-node deployment
|
||||
# /test-docker — test both single-node and multi-node
|
||||
# -------------------------------------------------------------------------
|
||||
get_pr_info:
|
||||
if: |
|
||||
github.event_name == 'issue_comment' &&
|
||||
github.event.issue.pull_request &&
|
||||
github.event.issue.state == 'open' &&
|
||||
!github.event.issue.draft &&
|
||||
(contains(github.event.comment.body, '/test-docker-single') ||
|
||||
contains(github.event.comment.body, '/test-docker-multi') ||
|
||||
contains(github.event.comment.body, '/test-docker'))
|
||||
runs-on: codebuild-github-actions-codebuild-runner-devops-amd-${{ github.run_id }}-${{ github.run_attempt }}
|
||||
outputs:
|
||||
pr_number: ${{ steps.pr_data.outputs.pr_number }}
|
||||
pr_head_ref: ${{ steps.pr_data.outputs.pr_head_ref }}
|
||||
pr_head_sha: ${{ steps.pr_data.outputs.pr_head_sha }}
|
||||
check_run_id: ${{ steps.create_check.outputs.result }}
|
||||
deployment_matrix: ${{ steps.parse_command.outputs.deployment_matrix }}
|
||||
check_name: ${{ steps.parse_command.outputs.check_name }}
|
||||
|
||||
steps:
|
||||
- name: React to comment
|
||||
uses: actions/github-script@v7
|
||||
with:
|
||||
script: |
|
||||
await github.rest.reactions.createForIssueComment({
|
||||
owner: context.repo.owner,
|
||||
repo: context.repo.repo,
|
||||
comment_id: context.payload.comment.id,
|
||||
content: 'rocket'
|
||||
});
|
||||
|
||||
- name: Extract PR data
|
||||
id: pr_data
|
||||
env:
|
||||
GH_TOKEN: ${{ github.token }}
|
||||
run: |
|
||||
PR_NUMBER="${{ github.event.issue.number }}"
|
||||
PR_DATA=$(gh api repos/${{ github.repository }}/pulls/${PR_NUMBER})
|
||||
PR_HEAD_REF=$(echo "$PR_DATA" | jq -r '.head.ref')
|
||||
PR_HEAD_SHA=$(echo "$PR_DATA" | jq -r '.head.sha')
|
||||
echo "pr_number=${PR_NUMBER}" >> $GITHUB_OUTPUT
|
||||
echo "pr_head_ref=${PR_HEAD_REF}" >> $GITHUB_OUTPUT
|
||||
echo "pr_head_sha=${PR_HEAD_SHA}" >> $GITHUB_OUTPUT
|
||||
|
||||
- name: Parse command and set deployment metadata
|
||||
id: parse_command
|
||||
env:
|
||||
COMMENT_BODY: ${{ github.event.comment.body }}
|
||||
run: |
|
||||
if echo "$COMMENT_BODY" | grep -q '/test-docker-single'; then
|
||||
echo 'deployment_matrix=["single-node"]' >> $GITHUB_OUTPUT
|
||||
echo 'check_name=Docker Integration Check (Single-Node)' >> $GITHUB_OUTPUT
|
||||
elif echo "$COMMENT_BODY" | grep -q '/test-docker-multi'; then
|
||||
echo 'deployment_matrix=["multi-node"]' >> $GITHUB_OUTPUT
|
||||
echo 'check_name=Docker Integration Check (Multi-Node)' >> $GITHUB_OUTPUT
|
||||
elif echo "$COMMENT_BODY" | grep -q '/test-docker'; then
|
||||
echo 'deployment_matrix=["single-node","multi-node"]' >> $GITHUB_OUTPUT
|
||||
echo 'check_name=Docker Integration Check' >> $GITHUB_OUTPUT
|
||||
fi
|
||||
|
||||
- name: Create check run
|
||||
id: create_check
|
||||
uses: actions/github-script@v7
|
||||
env:
|
||||
HEAD_SHA: ${{ steps.pr_data.outputs.pr_head_sha }}
|
||||
CHECK_NAME: ${{ steps.parse_command.outputs.check_name }}
|
||||
COMMENT_BODY: ${{ github.event.comment.body }}
|
||||
with:
|
||||
script: |
|
||||
const { data: check } = await github.rest.checks.create({
|
||||
owner: context.repo.owner,
|
||||
repo: context.repo.repo,
|
||||
name: process.env.CHECK_NAME,
|
||||
head_sha: process.env.HEAD_SHA,
|
||||
status: 'in_progress',
|
||||
started_at: new Date().toISOString(),
|
||||
details_url: `https://github.com/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId}`,
|
||||
output: {
|
||||
title: `🔨 Running ${process.env.CHECK_NAME}...`,
|
||||
summary: `Triggered by comment: \`${process.env.COMMENT_BODY}\``,
|
||||
text: 'Allocating instance and running Docker integration tests'
|
||||
}
|
||||
});
|
||||
console.log('Check run created:', check.id);
|
||||
return check.id;
|
||||
|
||||
# -------------------------------------------------------------------------
|
||||
# Job 2: Prepare context (pr_head_ref + deployment matrix) for both triggers.
|
||||
# -------------------------------------------------------------------------
|
||||
prepare:
|
||||
needs: [get_pr_info]
|
||||
if: |
|
||||
always() &&
|
||||
(needs.get_pr_info.result == 'success' || github.event_name == 'workflow_dispatch')
|
||||
runs-on: codebuild-github-actions-codebuild-runner-devops-amd-${{ github.run_id }}-${{ github.run_attempt }}
|
||||
outputs:
|
||||
pr_head_ref: ${{ steps.ctx.outputs.pr_head_ref }}
|
||||
deployment_matrix: ${{ steps.ctx.outputs.deployment_matrix }}
|
||||
wazuh_version: ${{ steps.version.outputs.wazuh_version }}
|
||||
wazuh_stage: ${{ steps.version.outputs.wazuh_stage }}
|
||||
|
||||
steps:
|
||||
- name: Resolve context
|
||||
id: ctx
|
||||
run: |
|
||||
if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
|
||||
echo "pr_head_ref=${{ inputs.pr_head_ref }}" >> $GITHUB_OUTPUT
|
||||
DEPLOY_TYPE="${{ inputs.deployment_type }}"
|
||||
if [ "$DEPLOY_TYPE" = "both" ]; then
|
||||
echo 'deployment_matrix=["single-node","multi-node"]' >> $GITHUB_OUTPUT
|
||||
else
|
||||
echo "deployment_matrix=[\"${DEPLOY_TYPE}\"]" >> $GITHUB_OUTPUT
|
||||
fi
|
||||
else
|
||||
echo 'pr_head_ref=${{ needs.get_pr_info.outputs.pr_head_ref }}' >> $GITHUB_OUTPUT
|
||||
echo 'deployment_matrix=${{ needs.get_pr_info.outputs.deployment_matrix }}' >> $GITHUB_OUTPUT
|
||||
fi
|
||||
|
||||
- name: Checkout wazuh-docker PR branch (VERSION.json only)
|
||||
uses: actions/checkout@v4
|
||||
with:
|
||||
ref: ${{ steps.ctx.outputs.pr_head_ref }}
|
||||
sparse-checkout: |
|
||||
VERSION.json
|
||||
sparse-checkout-cone-mode: false
|
||||
|
||||
- name: Read version info from VERSION.json
|
||||
id: version
|
||||
run: |
|
||||
VERSION=$(python3 -c "import json; d=json.load(open('VERSION.json')); print(d['version'])")
|
||||
STAGE=$(python3 -c "import json; d=json.load(open('VERSION.json')); print(d.get('stage',''))")
|
||||
echo "wazuh_version=${VERSION}" >> $GITHUB_OUTPUT
|
||||
echo "wazuh_stage=${STAGE}" >> $GITHUB_OUTPUT
|
||||
echo "Version: ${VERSION} Stage: ${STAGE:-<release>}"
|
||||
|
||||
- name: Show test plan
|
||||
run: |
|
||||
WAZUH_VERSION="${{ steps.version.outputs.wazuh_version }}"
|
||||
WAZUH_STAGE="${{ steps.version.outputs.wazuh_stage }}"
|
||||
INPUT_VERSION="${{ inputs.version }}"
|
||||
INPUT_STAGE="${{ inputs.stage }}"
|
||||
INPUT_REGISTRY="${{ inputs.registry }}"
|
||||
|
||||
# Determine effective case
|
||||
if [ -z "$INPUT_VERSION" ] && [ -z "$INPUT_STAGE" ]; then
|
||||
DOCKER_VERSION="$WAZUH_VERSION"
|
||||
DOCKER_STAGE_DISPLAY="${WAZUH_STAGE}"
|
||||
if [ "$INPUT_REGISTRY" = "ECR" ] || [ "${{ github.event_name }}" = "issue_comment" ]; then
|
||||
CASE="a.1 — No version/stage → BUILD images from PR → push to ECR"
|
||||
ACTION="BUILD + push to ECR"
|
||||
EFFECTIVE_TAG="${DOCKER_VERSION}${DOCKER_STAGE_DISPLAY:+-${DOCKER_STAGE_DISPLAY}}-latest"
|
||||
EFFECTIVE_REGISTRY="ECR (${{ vars.IMAGE_REGISTRY_DEV }})"
|
||||
else
|
||||
CASE="a.2 — No version/stage → PULL from DockerHub"
|
||||
ACTION="PULL (no build)"
|
||||
EFFECTIVE_TAG="${DOCKER_VERSION}${DOCKER_STAGE_DISPLAY:+-${DOCKER_STAGE_DISPLAY}}"
|
||||
EFFECTIVE_REGISTRY="DockerHub (${{ vars.IMAGE_REGISTRY_PROD }})"
|
||||
fi
|
||||
elif [ -n "$INPUT_VERSION" ] && [ -z "$INPUT_STAGE" ]; then
|
||||
DOCKER_VERSION="$INPUT_VERSION"
|
||||
ACTION="PULL (no build)"
|
||||
if [ "$INPUT_REGISTRY" = "ECR" ]; then
|
||||
CASE="b.1 — Version only, ECR → tag = version-latest"
|
||||
EFFECTIVE_TAG="${DOCKER_VERSION}-latest"
|
||||
EFFECTIVE_REGISTRY="ECR (${{ vars.IMAGE_REGISTRY_DEV }})"
|
||||
else
|
||||
CASE="b.2 — Version only, DockerHub → tag = version"
|
||||
EFFECTIVE_TAG="${DOCKER_VERSION}"
|
||||
EFFECTIVE_REGISTRY="DockerHub (${{ vars.IMAGE_REGISTRY_PROD }})"
|
||||
fi
|
||||
else
|
||||
CASE="c — Version + stage provided as-is (no -latest appended)"
|
||||
ACTION="PULL (no build)"
|
||||
DOCKER_VERSION="${INPUT_VERSION:-${WAZUH_VERSION}}"
|
||||
EFFECTIVE_TAG="${DOCKER_VERSION}-${INPUT_STAGE}"
|
||||
if [ "$INPUT_REGISTRY" = "ECR" ]; then
|
||||
EFFECTIVE_REGISTRY="ECR (${{ vars.IMAGE_REGISTRY_DEV }})"
|
||||
else
|
||||
EFFECTIVE_REGISTRY="DockerHub (${{ vars.IMAGE_REGISTRY_PROD }})"
|
||||
fi
|
||||
fi
|
||||
|
||||
# Log to stdout
|
||||
echo "============================================="
|
||||
echo " DOCKER INTEGRATION TEST PLAN"
|
||||
echo "============================================="
|
||||
echo "Branch: ${{ steps.ctx.outputs.pr_head_ref }}"
|
||||
echo "Trigger: ${{ github.event_name }}"
|
||||
echo "Deployments: ${{ steps.ctx.outputs.deployment_matrix }}"
|
||||
echo "Case: ${CASE}"
|
||||
echo "Action: ${ACTION}"
|
||||
echo "Registry: ${EFFECTIVE_REGISTRY}"
|
||||
echo "Image tag: ${EFFECTIVE_TAG}"
|
||||
echo "Example: wazuh/wazuh-manager:${EFFECTIVE_TAG}"
|
||||
echo "============================================="
|
||||
|
||||
# Write to step summary
|
||||
{
|
||||
echo "## Docker Integration Test Plan"
|
||||
echo ""
|
||||
echo "| | |"
|
||||
echo "|---|---|"
|
||||
echo "| **Branch** | \`${{ steps.ctx.outputs.pr_head_ref }}\` |"
|
||||
echo "| **Trigger** | \`${{ github.event_name }}\` |"
|
||||
echo "| **Deployments** | \`${{ steps.ctx.outputs.deployment_matrix }}\` |"
|
||||
echo "| **Case** | ${CASE} |"
|
||||
echo "| **Action** | ${ACTION} |"
|
||||
echo ""
|
||||
echo "### Image configuration"
|
||||
echo ""
|
||||
echo "| | |"
|
||||
echo "|---|---|"
|
||||
echo "| **Registry** | ${EFFECTIVE_REGISTRY} |"
|
||||
echo "| **Tag** | \`${EFFECTIVE_TAG}\` |"
|
||||
echo "| **Example image** | \`wazuh/wazuh-manager:${EFFECTIVE_TAG}\` |"
|
||||
echo ""
|
||||
echo "### Parameters"
|
||||
echo ""
|
||||
echo "| | |"
|
||||
echo "|---|---|"
|
||||
echo "| **VERSION.json version** | \`${WAZUH_VERSION}\` |"
|
||||
echo "| **VERSION.json stage** | \`${WAZUH_STAGE:-<release>}\` |"
|
||||
echo "| **Input version** | \`${INPUT_VERSION:-<not set>}\` |"
|
||||
echo "| **Input stage** | \`${INPUT_STAGE:-<not set>}\` |"
|
||||
echo "| **Input registry** | \`${INPUT_REGISTRY:-<not set>}\` |"
|
||||
} >> "$GITHUB_STEP_SUMMARY"
|
||||
|
||||
# -------------------------------------------------------------------------
|
||||
# Job 3: Build Docker images (only for ECR, when no explicit version/stage provided).
|
||||
# Calls 5_build_and_push_images.yml and pushes to the dev registry.
|
||||
# -------------------------------------------------------------------------
|
||||
build_images:
|
||||
name: Build Docker images
|
||||
needs: [prepare]
|
||||
if: |
|
||||
always() &&
|
||||
needs.prepare.result == 'success' &&
|
||||
inputs.version == '' &&
|
||||
inputs.stage == '' &&
|
||||
(inputs.registry == 'ECR' || github.event_name == 'issue_comment')
|
||||
uses: ./.github/workflows/5_build_and_push_images.yml
|
||||
with:
|
||||
image_tag: "${{ needs.prepare.outputs.wazuh_version }}-${{ needs.prepare.outputs.wazuh_stage }}"
|
||||
docker_reference: ${{ needs.prepare.outputs.pr_head_ref }}
|
||||
wazuh_automation_reference: ${{ inputs.automation_reference || 'main' }}
|
||||
products: "wazuh-manager,wazuh-dashboard,wazuh-indexer,wazuh-agent"
|
||||
dev: true
|
||||
id: "docker-integration-${{ github.run_id }}"
|
||||
secrets: inherit
|
||||
|
||||
# -------------------------------------------------------------------------
|
||||
# Job 4: For each deployment type — provision VM, deploy Docker stack, test,
|
||||
# collect results, and clean up.
|
||||
# -------------------------------------------------------------------------
|
||||
docker_test:
|
||||
needs: [get_pr_info, prepare, build_images]
|
||||
if: |
|
||||
always() &&
|
||||
needs.prepare.result == 'success' &&
|
||||
(needs.build_images.result == 'success' || needs.build_images.result == 'skipped')
|
||||
runs-on: codebuild-github-actions-codebuild-runner-devops-amd-${{ github.run_id }}-${{ github.run_attempt }}
|
||||
strategy:
|
||||
fail-fast: false
|
||||
matrix:
|
||||
deployment_type: ${{ fromJSON(needs.prepare.outputs.deployment_matrix) }}
|
||||
|
||||
steps:
|
||||
# -----------------------------------------------------------------------
|
||||
# Setup
|
||||
# -----------------------------------------------------------------------
|
||||
- name: Checkout wazuh-automation
|
||||
uses: actions/checkout@v6
|
||||
with:
|
||||
repository: wazuh/wazuh-automation
|
||||
ref: ${{ env.AUTOMATION_REFERENCE }}
|
||||
token: ${{ secrets.GH_CLONE_TOKEN }}
|
||||
path: wazuh-automation
|
||||
|
||||
- name: Checkout wazuh-docker PR branch
|
||||
uses: actions/checkout@v6
|
||||
with:
|
||||
ref: ${{ needs.prepare.outputs.pr_head_ref }}
|
||||
path: wazuh-docker
|
||||
|
||||
- name: Resolve image configuration
|
||||
run: |
|
||||
WAZUH_VERSION="${{ needs.prepare.outputs.wazuh_version }}"
|
||||
WAZUH_STAGE="${{ needs.prepare.outputs.wazuh_stage }}"
|
||||
INPUT_VERSION="${{ inputs.version }}"
|
||||
INPUT_STAGE="${{ inputs.stage }}"
|
||||
|
||||
# Map registry choice to actual URL (defined once)
|
||||
if [ "${{ inputs.registry }}" = "ECR" ]; then
|
||||
SELECTED_REGISTRY="${{ vars.IMAGE_REGISTRY_DEV }}"
|
||||
else
|
||||
SELECTED_REGISTRY="${{ vars.IMAGE_REGISTRY_PROD }}"
|
||||
fi
|
||||
|
||||
if [ -z "$INPUT_VERSION" ] && [ -z "$INPUT_STAGE" ]; then
|
||||
DOCKER_VERSION="$WAZUH_VERSION"
|
||||
DOCKER_STAGE="$WAZUH_STAGE"
|
||||
if [ "${{ inputs.registry }}" = "ECR" ] || [ "${{ github.event_name }}" = "issue_comment" ]; then
|
||||
# Case a.1: ECR / PR comment — images were built by build_images job → tag = version-stage-latest
|
||||
DOCKER_REGISTRY="${{ vars.IMAGE_REGISTRY_DEV }}"
|
||||
DOCKER_TAG="${DOCKER_VERSION}${DOCKER_STAGE:+-${DOCKER_STAGE}}-latest"
|
||||
else
|
||||
DOCKER_REGISTRY="${{ vars.IMAGE_REGISTRY_PROD }}"
|
||||
DOCKER_TAG="${DOCKER_VERSION}${DOCKER_STAGE:+-${DOCKER_STAGE}}"
|
||||
fi
|
||||
elif [ -n "$INPUT_VERSION" ] && [ -z "$INPUT_STAGE" ]; then
|
||||
DOCKER_VERSION="$INPUT_VERSION"
|
||||
DOCKER_STAGE=""
|
||||
DOCKER_REGISTRY="$SELECTED_REGISTRY"
|
||||
if [ "${{ inputs.registry }}" = "ECR" ]; then
|
||||
DOCKER_TAG="${DOCKER_VERSION}-latest"
|
||||
else
|
||||
DOCKER_TAG="${DOCKER_VERSION}"
|
||||
fi
|
||||
else
|
||||
DOCKER_VERSION="${INPUT_VERSION:-${WAZUH_VERSION}}"
|
||||
DOCKER_STAGE="$INPUT_STAGE"
|
||||
DOCKER_REGISTRY="$SELECTED_REGISTRY"
|
||||
DOCKER_TAG="${DOCKER_VERSION}-${DOCKER_STAGE}"
|
||||
fi
|
||||
|
||||
echo "WAZUH_VERSION=${WAZUH_VERSION}" >> $GITHUB_ENV
|
||||
echo "WAZUH_STAGE=${WAZUH_STAGE}" >> $GITHUB_ENV
|
||||
echo "DOCKER_VERSION=${DOCKER_VERSION}" >> $GITHUB_ENV
|
||||
echo "DOCKER_STAGE=${DOCKER_STAGE}" >> $GITHUB_ENV
|
||||
echo "DOCKER_REGISTRY=${DOCKER_REGISTRY}" >> $GITHUB_ENV
|
||||
echo "DOCKER_TAG=${DOCKER_TAG}" >> $GITHUB_ENV
|
||||
|
||||
echo "=== Resolved image configuration ==="
|
||||
echo "Registry: ${DOCKER_REGISTRY}"
|
||||
echo "Tag: ${DOCKER_TAG}"
|
||||
echo "Example: wazuh/wazuh-manager:${DOCKER_TAG}"
|
||||
|
||||
- name: Set up Python 3.12
|
||||
uses: actions/setup-python@v5
|
||||
with:
|
||||
python-version: '3.12'
|
||||
|
||||
- name: Install requirements
|
||||
run: |
|
||||
pip install -r wazuh-automation/deployability/deps/requirements.txt
|
||||
pip install -r wazuh-automation/integration-test-module/requirements.txt
|
||||
pip install -e wazuh-automation/integration-test-module/
|
||||
pip install pyyaml
|
||||
|
||||
- name: Configure AWS credentials
|
||||
uses: aws-actions/configure-aws-credentials@v4
|
||||
with:
|
||||
role-to-assume: ${{ secrets.AWS_IAM_DOCKER_ROLE }}
|
||||
role-session-name: docker-test-${{ github.run_id }}-${{ matrix.deployment_type }}
|
||||
aws-region: ${{ env.REGION }}
|
||||
|
||||
- name: Generate presigned cert tool URL
|
||||
run: |
|
||||
python wazuh-automation/tools/sign_urls/generate_presigned_dev_urls.py \
|
||||
--process build_docker \
|
||||
--wazuh-version "${{ env.DOCKER_VERSION }}" \
|
||||
--aws-s3-bucket-dev "${{ vars.AWS_S3_BUCKET_DEV }}"
|
||||
|
||||
python3 -c "
|
||||
import yaml
|
||||
data = yaml.safe_load(open('/tmp/artifact_urls.yaml'))
|
||||
print(f'wazuh_certs_tool={data[\"wazuh_certs_tool\"]}')
|
||||
" >> "$GITHUB_ENV"
|
||||
|
||||
# -----------------------------------------------------------------------
|
||||
# Provision: allocate VM and extract SSH credentials
|
||||
# -----------------------------------------------------------------------
|
||||
- name: Allocate instance
|
||||
id: allocate
|
||||
run: |
|
||||
mkdir -p ${{ env.ALLOCATOR_PATH }}
|
||||
python3 wazuh-automation/deployability/modules/allocation/main.py \
|
||||
--action create \
|
||||
--provider aws \
|
||||
--size large \
|
||||
--composite-name ubuntu-24-amd64 \
|
||||
--working-dir ${{ env.ALLOCATOR_PATH }} \
|
||||
--track-output ${{ env.ALLOCATOR_PATH }}/track.yml \
|
||||
--inventory-output ${{ env.ALLOCATOR_PATH }}/inventory.yml \
|
||||
--instance-name gha_${{ github.run_id }}_docker_${{ matrix.deployment_type }} \
|
||||
--label-team devops \
|
||||
--label-termination-date 1d
|
||||
|
||||
sed -n '/hosts:/,/^[^ ]/p' ${{ env.ALLOCATOR_PATH }}/inventory.yml \
|
||||
| grep "ansible_" \
|
||||
| sed 's/^[ ]*//g' \
|
||||
> ${{ env.ALLOCATOR_PATH }}/inventory_vars_raw.yml
|
||||
sed 's/: */=/g' ${{ env.ALLOCATOR_PATH }}/inventory_vars_raw.yml \
|
||||
> ${{ env.ALLOCATOR_PATH }}/inventory_vars.yml
|
||||
sed -i 's/-o StrictHostKeyChecking=no/"-o StrictHostKeyChecking=no"/g' \
|
||||
${{ env.ALLOCATOR_PATH }}/inventory_vars.yml
|
||||
|
||||
- name: Set SSH credentials from inventory
|
||||
run: |
|
||||
find ${{ env.ALLOCATOR_PATH }} -name '*-key-*' -exec chmod 600 {} \;
|
||||
source ${{ env.ALLOCATOR_PATH }}/inventory_vars.yml
|
||||
echo "SSH_HOST=$ansible_host" >> $GITHUB_ENV
|
||||
echo "SSH_PORT=$ansible_port" >> $GITHUB_ENV
|
||||
echo "SSH_USER=$ansible_user" >> $GITHUB_ENV
|
||||
echo "SSH_KEY=$ansible_ssh_private_key_file" >> $GITHUB_ENV
|
||||
|
||||
- name: Set SSH/SCP helper env vars
|
||||
run: |
|
||||
echo "SSH_OPTS=-o StrictHostKeyChecking=no -o ServerAliveInterval=60 -o ServerAliveCountMax=20 -p ${{ env.SSH_PORT }} -i ${{ env.SSH_KEY }}" >> $GITHUB_ENV
|
||||
echo "SCP_OPTS=-o StrictHostKeyChecking=no -P ${{ env.SSH_PORT }} -i ${{ env.SSH_KEY }}" >> $GITHUB_ENV
|
||||
echo "REMOTE=${{ env.SSH_USER }}@${{ env.SSH_HOST }}" >> $GITHUB_ENV
|
||||
|
||||
# -----------------------------------------------------------------------
|
||||
# Install Docker CE on the remote VM
|
||||
# -----------------------------------------------------------------------
|
||||
- name: Install Docker CE
|
||||
run: |
|
||||
ssh ${{ env.SSH_OPTS }} "${{ env.REMOTE }}" "
|
||||
curl -fsSL https://get.docker.com | sudo sh
|
||||
sudo systemctl enable --now docker
|
||||
"
|
||||
|
||||
- name: Login VM to ECR registry
|
||||
if: inputs.registry == 'ECR' || github.event_name == 'issue_comment'
|
||||
run: |
|
||||
ECR_REGISTRY="${{ env.DOCKER_REGISTRY }}"
|
||||
ECR_REGION=$(echo "$ECR_REGISTRY" | cut -d. -f4)
|
||||
ECR_PASS=$(aws ecr get-login-password --region "$ECR_REGION")
|
||||
ssh ${{ env.SSH_OPTS }} "${{ env.REMOTE }}" \
|
||||
"echo '${ECR_PASS}' | sudo docker login --username AWS --password-stdin ${ECR_REGISTRY}"
|
||||
|
||||
# -----------------------------------------------------------------------
|
||||
# Deploy: patch image tags, copy wazuh-docker and start the stack
|
||||
# -----------------------------------------------------------------------
|
||||
- name: Patch image tags
|
||||
run: |
|
||||
DEPLOYMENT="${{ matrix.deployment_type }}"
|
||||
COMPOSE="wazuh-docker/${DEPLOYMENT}/docker-compose.yml"
|
||||
TAG="${{ env.DOCKER_TAG }}"
|
||||
REGISTRY="${{ env.DOCKER_REGISTRY }}"
|
||||
|
||||
if [ "$REGISTRY" = "${{ vars.IMAGE_REGISTRY_PROD }}" ] || [ -z "$REGISTRY" ]; then
|
||||
echo "Patching ${COMPOSE}: wazuh/wazuh-*:${TAG} (DockerHub, no registry prefix)"
|
||||
sed -i -E "s|(image: wazuh/wazuh-[^:]+:)[^ ]+|\1${TAG}|g" "$COMPOSE"
|
||||
else
|
||||
echo "Patching ${COMPOSE}: ${REGISTRY}/wazuh/wazuh-*:${TAG}"
|
||||
sed -i -E "s|image: (wazuh/wazuh-[^:]+):[^ ]+|image: ${REGISTRY}/\1:${TAG}|g" "$COMPOSE"
|
||||
fi
|
||||
echo "=== Patched image lines ==="
|
||||
grep 'image:' "$COMPOSE"
|
||||
|
||||
- name: Prepare cert tool and config
|
||||
run: |
|
||||
DEPLOYMENT="${{ matrix.deployment_type }}"
|
||||
|
||||
echo "Cert tool: ${{ env.wazuh_certs_tool }} Docker image: ${{ env.DOCKER_TAG }}"
|
||||
|
||||
curl --output "wazuh-docker/${DEPLOYMENT}/wazuh-certs-tool.sh" "${{ env.wazuh_certs_tool }}"
|
||||
chmod +x "wazuh-docker/${DEPLOYMENT}/wazuh-certs-tool.sh"
|
||||
echo "Downloaded OK"
|
||||
|
||||
# Write config.yml directly into the deployment directory
|
||||
if [ "$DEPLOYMENT" = "single-node" ]; then
|
||||
printf '%s\n' \
|
||||
'nodes:' \
|
||||
' indexer:' \
|
||||
' - name: wazuh.indexer' \
|
||||
' dns: wazuh.indexer' \
|
||||
' manager:' \
|
||||
' - name: wazuh.manager' \
|
||||
' dns: wazuh.manager' \
|
||||
' dashboard:' \
|
||||
' - name: wazuh.dashboard' \
|
||||
' dns: wazuh.dashboard' \
|
||||
> "wazuh-docker/${DEPLOYMENT}/config.yml"
|
||||
else
|
||||
printf '%s\n' \
|
||||
'nodes:' \
|
||||
' indexer:' \
|
||||
' - name: wazuh1.indexer' \
|
||||
' dns: wazuh1.indexer' \
|
||||
' - name: wazuh2.indexer' \
|
||||
' dns: wazuh2.indexer' \
|
||||
' - name: wazuh3.indexer' \
|
||||
' dns: wazuh3.indexer' \
|
||||
' manager:' \
|
||||
' - name: wazuh.master' \
|
||||
' dns: wazuh.master' \
|
||||
' node_type: master' \
|
||||
' - name: wazuh.worker' \
|
||||
' dns: wazuh.worker' \
|
||||
' node_type: worker' \
|
||||
' dashboard:' \
|
||||
' - name: wazuh.dashboard' \
|
||||
' dns: wazuh.dashboard' \
|
||||
> "wazuh-docker/${DEPLOYMENT}/config.yml"
|
||||
fi
|
||||
echo "=== config.yml ==="
|
||||
cat "wazuh-docker/${DEPLOYMENT}/config.yml"
|
||||
echo "=== Files ready to copy ==="
|
||||
ls -la "wazuh-docker/${DEPLOYMENT}/"
|
||||
|
||||
- name: Copy wazuh-docker to VM
|
||||
run: |
|
||||
scp ${{ env.SCP_OPTS }} -r wazuh-docker "${{ env.REMOTE }}:/tmp/wazuh-docker"
|
||||
|
||||
- name: Show deployment config
|
||||
run: |
|
||||
DEPLOYMENT="${{ matrix.deployment_type }}"
|
||||
ssh ${{ env.SSH_OPTS }} "${{ env.REMOTE }}" "
|
||||
echo '=== Files in deployment directory ==='
|
||||
ls -la /tmp/wazuh-docker/${DEPLOYMENT}/
|
||||
echo ''
|
||||
echo '=== Images referenced in docker-compose.yml ==='
|
||||
grep 'image:' /tmp/wazuh-docker/${DEPLOYMENT}/docker-compose.yml || echo '(none found)'
|
||||
echo ''
|
||||
echo '=== Docker version ==='
|
||||
sudo docker version --format 'Client: {{.Client.Version}} Server: {{.Server.Version}}'
|
||||
"
|
||||
|
||||
- name: Configure VM for Wazuh Indexer
|
||||
run: |
|
||||
ssh ${{ env.SSH_OPTS }} "${{ env.REMOTE }}" "
|
||||
sudo sysctl -w vm.max_map_count=262144
|
||||
echo 'vm.max_map_count = '\$(cat /proc/sys/vm/max_map_count)
|
||||
"
|
||||
|
||||
- name: Generate SSL certificates
|
||||
run: |
|
||||
DEPLOYMENT="${{ matrix.deployment_type }}"
|
||||
ssh ${{ env.SSH_OPTS }} "${{ env.REMOTE }}" "
|
||||
set -e
|
||||
cd /tmp/wazuh-docker/${DEPLOYMENT}
|
||||
echo '=== Running certificate generation ==='
|
||||
sudo bash /tmp/wazuh-docker/tools/utils/deployment/certificates-conf.sh --cert --copy
|
||||
echo ''
|
||||
echo '=== Generated certificate files ==='
|
||||
find ./config -name '*.pem' | sort
|
||||
echo ''
|
||||
echo '=== Certificate subjects ==='
|
||||
for pem in \$(find ./config -name '*.pem' ! -name '*-key.pem' | sort); do
|
||||
echo -n \"\$pem: \"
|
||||
sudo openssl x509 -in \"\$pem\" -noout -subject -issuer 2>/dev/null || echo '(not a cert / key file)'
|
||||
done
|
||||
"
|
||||
|
||||
- name: Start Docker Compose
|
||||
run: |
|
||||
DEPLOYMENT="${{ matrix.deployment_type }}"
|
||||
ssh ${{ env.SSH_OPTS }} "${{ env.REMOTE }}" "
|
||||
set -eo pipefail
|
||||
cd /tmp/wazuh-docker/${DEPLOYMENT}
|
||||
sudo docker compose up -d 2>&1 | tee /tmp/docker-compose-up.log
|
||||
echo ''
|
||||
echo '=== Initial container status ==='
|
||||
sudo docker compose ps
|
||||
"
|
||||
|
||||
- name: Show indexer logs on failure
|
||||
if: failure()
|
||||
run: |
|
||||
DEPLOYMENT="${{ matrix.deployment_type }}"
|
||||
ssh ${{ env.SSH_OPTS }} "${{ env.REMOTE }}" "
|
||||
cd /tmp/wazuh-docker/${DEPLOYMENT}
|
||||
echo '=== docker compose ps ==='
|
||||
sudo docker compose ps
|
||||
echo ''
|
||||
echo '=== wazuh.indexer logs ==='
|
||||
sudo docker compose logs wazuh.indexer 2>&1
|
||||
" || true
|
||||
|
||||
- name: Wait for containers healthy
|
||||
timeout-minutes: 15
|
||||
run: |
|
||||
DEPLOYMENT="${{ matrix.deployment_type }}"
|
||||
ssh ${{ env.SSH_OPTS }} "${{ env.REMOTE }}" "
|
||||
cd /tmp/wazuh-docker/${DEPLOYMENT}
|
||||
|
||||
echo '=== Verifying containers started ==='
|
||||
TOTAL=\$(sudo docker compose ps 2>/dev/null | tail -n +2 | wc -l | tr -d ' ')
|
||||
if [ \"\$TOTAL\" -eq 0 ]; then
|
||||
echo 'ERROR: No containers are running — docker compose up may have failed'
|
||||
sudo docker compose ps
|
||||
sudo docker compose logs --no-color 2>&1 | tail -50
|
||||
exit 1
|
||||
fi
|
||||
echo \"Found \$TOTAL container(s), waiting for healthy status...\"
|
||||
echo ''
|
||||
|
||||
for i in \$(seq 1 90); do
|
||||
NOT_HEALTHY=\$(sudo docker compose ps 2>/dev/null \
|
||||
| tail -n +2 \
|
||||
| grep -v 'nginx' \
|
||||
| grep -vcE '(healthy|\(healthy\))')
|
||||
if [ \"\$NOT_HEALTHY\" -eq 0 ]; then
|
||||
echo \"All containers healthy after \${i} x 10s attempts\"
|
||||
sudo docker compose ps
|
||||
exit 0
|
||||
fi
|
||||
echo \" attempt \$i/90: \$NOT_HEALTHY container(s) not yet healthy\"
|
||||
if [ \"\$(( i % 6 ))\" -eq 0 ]; then
|
||||
echo ' --- current status ---'
|
||||
sudo docker compose ps
|
||||
fi
|
||||
sleep 10
|
||||
done
|
||||
echo 'ERROR: containers not healthy after 15 minutes'
|
||||
sudo docker compose ps
|
||||
sudo docker compose logs --no-color 2>&1 | tail -100
|
||||
exit 1
|
||||
"
|
||||
|
||||
- name: Cluster warm-up wait
|
||||
run: |
|
||||
if [ "${{ matrix.deployment_type }}" = "multi-node" ]; then
|
||||
WAIT=90
|
||||
else
|
||||
WAIT=60
|
||||
fi
|
||||
echo "Waiting ${WAIT}s for services to reach steady state..."
|
||||
sleep $WAIT
|
||||
DEPLOYMENT="${{ matrix.deployment_type }}"
|
||||
ssh ${{ env.SSH_OPTS }} "${{ env.REMOTE }}" "
|
||||
cd /tmp/wazuh-docker/${DEPLOYMENT}
|
||||
echo '=== Container status after warm-up ==='
|
||||
sudo docker compose ps
|
||||
"
|
||||
|
||||
# -----------------------------------------------------------------------
|
||||
# Run integration tests
|
||||
# -----------------------------------------------------------------------
|
||||
- name: Run tests
|
||||
id: run_tests
|
||||
continue-on-error: true
|
||||
run: |
|
||||
DEPLOYMENT="${{ matrix.deployment_type }}"
|
||||
test_runner \
|
||||
--test-type "docker-${DEPLOYMENT}" \
|
||||
--deployment-type "docker-${DEPLOYMENT}" \
|
||||
--ssh-host "${{ env.SSH_HOST }}" \
|
||||
--ssh-port "${{ env.SSH_PORT }}" \
|
||||
--ssh-key-path "${{ env.SSH_KEY }}" \
|
||||
--ssh-username "${{ env.SSH_USER }}" \
|
||||
--version "${{ env.DOCKER_VERSION }}" \
|
||||
--log-level INFO \
|
||||
--output github \
|
||||
--output-file "test-results-docker-${DEPLOYMENT}.github"
|
||||
|
||||
# -----------------------------------------------------------------------
|
||||
# Collect logs on failure
|
||||
# -----------------------------------------------------------------------
|
||||
- name: Show test outcome
|
||||
if: always()
|
||||
run: |
|
||||
echo "Run tests outcome: ${{ steps.run_tests.outcome }}"
|
||||
DEPLOYMENT="${{ matrix.deployment_type }}"
|
||||
if [ -f "test-results-docker-${DEPLOYMENT}.github" ]; then
|
||||
echo "=== Test results file ==="
|
||||
cat "test-results-docker-${DEPLOYMENT}.github"
|
||||
else
|
||||
echo "WARNING: no test results file found (test_runner may have failed before writing output)"
|
||||
fi
|
||||
|
||||
- name: Collect Docker logs on failure
|
||||
if: failure() || steps.run_tests.outcome == 'failure'
|
||||
run: |
|
||||
DEPLOYMENT="${{ matrix.deployment_type }}"
|
||||
ssh ${{ env.SSH_OPTS }} "${{ env.REMOTE }}" "
|
||||
cd /tmp/wazuh-docker/${DEPLOYMENT}
|
||||
sudo docker compose logs --no-color 2>&1
|
||||
" > docker-logs-${DEPLOYMENT}.txt || true
|
||||
|
||||
- name: Upload Docker logs
|
||||
if: failure() || steps.run_tests.outcome == 'failure'
|
||||
run: |
|
||||
echo "Uploading Docker logs artifact..."
|
||||
zip "${{ env.LOGS_ARTIFACT_ZIP_FILE }}" docker-logs-*.txt
|
||||
aws s3 cp "${{ env.LOGS_ARTIFACT_ZIP_FILE }}" "s3://${{ secrets.CI_DEV_INTERNAL_S3_BUCKET }}/wazuh-docker/5_check_integration_tools/${{ github.run_id }}/${{ env.LOGS_ARTIFACT_ZIP_FILE }}"
|
||||
|
||||
# -----------------------------------------------------------------------
|
||||
# Reporting
|
||||
# -----------------------------------------------------------------------
|
||||
- name: Create step summary
|
||||
if: always()
|
||||
run: |
|
||||
DEPLOYMENT="${{ matrix.deployment_type }}"
|
||||
echo "## Docker Integration Test Results — ${DEPLOYMENT}" >> $GITHUB_STEP_SUMMARY
|
||||
echo "" >> $GITHUB_STEP_SUMMARY
|
||||
if [ -f "test-results-docker-${DEPLOYMENT}.github" ]; then
|
||||
cat "test-results-docker-${DEPLOYMENT}.github" >> $GITHUB_STEP_SUMMARY
|
||||
else
|
||||
echo "No test results file found." >> $GITHUB_STEP_SUMMARY
|
||||
fi
|
||||
|
||||
- name: Post PR comment with results
|
||||
if: always() && github.event_name == 'issue_comment'
|
||||
uses: actions/github-script@v7
|
||||
env:
|
||||
DEPLOYMENT: ${{ matrix.deployment_type }}
|
||||
RUN_OUTCOME: ${{ steps.run_tests.outcome }}
|
||||
with:
|
||||
github-token: ${{ secrets.GITHUB_TOKEN }}
|
||||
script: |
|
||||
const fs = require('fs');
|
||||
const deployment = process.env.DEPLOYMENT;
|
||||
const outcome = process.env.RUN_OUTCOME;
|
||||
const marker = `<!-- docker-integration-check-${deployment} -->`;
|
||||
|
||||
let body = `${marker}\n## Docker Integration Tests — \`${deployment}\`\n\n`;
|
||||
body += outcome === 'success'
|
||||
? '✅ **All tests passed!**\n\n'
|
||||
: '❌ **Some tests failed**\n\n';
|
||||
|
||||
const resultsFile = `test-results-docker-${deployment}.github`;
|
||||
try {
|
||||
if (fs.existsSync(resultsFile)) {
|
||||
body += '### Results\n\n' + fs.readFileSync(resultsFile, 'utf8') + '\n\n';
|
||||
}
|
||||
} catch (e) {
|
||||
console.log('Could not read results file:', e.message);
|
||||
}
|
||||
body += `- **Workflow:** [View Details](${context.payload.repository.html_url}/actions/runs/${context.runId})\n`;
|
||||
|
||||
const { data: comments } = await github.rest.issues.listComments({
|
||||
owner: context.repo.owner,
|
||||
repo: context.repo.repo,
|
||||
issue_number: context.issue.number,
|
||||
});
|
||||
|
||||
const existing = comments.find(c =>
|
||||
c.user.type === 'Bot' && c.body.includes(marker)
|
||||
);
|
||||
|
||||
if (existing) {
|
||||
await github.rest.issues.updateComment({
|
||||
owner: context.repo.owner,
|
||||
repo: context.repo.repo,
|
||||
comment_id: existing.id,
|
||||
body: body,
|
||||
});
|
||||
} else {
|
||||
await github.rest.issues.createComment({
|
||||
owner: context.repo.owner,
|
||||
repo: context.repo.repo,
|
||||
issue_number: context.issue.number,
|
||||
body: body,
|
||||
});
|
||||
}
|
||||
|
||||
- name: Upload test results
|
||||
if: always()
|
||||
env:
|
||||
S3_ARTIFACTS_PATH: s3://${{ secrets.CI_DEV_INTERNAL_S3_BUCKET }}/wazuh-docker/5_check_integration_tools/${{ github.run_id }}
|
||||
LOCAL_RESULTS_PATH: test-results-docker-${{ matrix.deployment_type }}.github
|
||||
run: |
|
||||
if [ -f "${LOCAL_RESULTS_PATH}" ]; then
|
||||
echo "Uploading test results to S3..."
|
||||
aws s3 cp "${LOCAL_RESULTS_PATH}" "${S3_ARTIFACTS_PATH}/test-results-docker-${{ matrix.deployment_type }}/"
|
||||
else
|
||||
echo "::warning::No test results file found - skipping upload (an earlier step likely failed before test_runner produced output)."
|
||||
fi
|
||||
|
||||
# -----------------------------------------------------------------------
|
||||
# Cleanup: always stop stack and deallocate VM
|
||||
# -----------------------------------------------------------------------
|
||||
- name: Stop Docker Compose
|
||||
if: always()
|
||||
run: |
|
||||
DEPLOYMENT="${{ matrix.deployment_type }}"
|
||||
ssh ${{ env.SSH_OPTS }} "${{ env.REMOTE }}" "
|
||||
cd /tmp/wazuh-docker/${DEPLOYMENT} && sudo docker compose down -v || true
|
||||
" || true
|
||||
|
||||
- name: Configure AWS credentials for cleanup
|
||||
if: always()
|
||||
uses: aws-actions/configure-aws-credentials@v4
|
||||
with:
|
||||
role-to-assume: ${{ secrets.AWS_IAM_DOCKER_ROLE }}
|
||||
role-session-name: docker-cleanup-${{ github.run_id }}-${{ matrix.deployment_type }}
|
||||
aws-region: ${{ env.REGION }}
|
||||
|
||||
- name: Deallocate instance
|
||||
if: always()
|
||||
run: |
|
||||
python3 wazuh-automation/deployability/modules/allocation/main.py \
|
||||
--action delete \
|
||||
--track-output ${{ env.ALLOCATOR_PATH }}/track.yml
|
||||
|
||||
# -------------------------------------------------------------------------
|
||||
# Job 4: Update the GitHub check run (issue_comment trigger only)
|
||||
# -------------------------------------------------------------------------
|
||||
update_check:
|
||||
needs: [get_pr_info, prepare, build_images, docker_test]
|
||||
if: always() && github.event_name == 'issue_comment' && needs.get_pr_info.result == 'success'
|
||||
runs-on: codebuild-github-actions-codebuild-runner-devops-amd-${{ github.run_id }}-${{ github.run_attempt }}
|
||||
steps:
|
||||
- name: Update check run
|
||||
uses: actions/github-script@v7
|
||||
env:
|
||||
DOCKER_RESULT: ${{ needs.docker_test.result }}
|
||||
CHECK_NAME: ${{ needs.get_pr_info.outputs.check_name }}
|
||||
CHECK_RUN_ID: ${{ needs.get_pr_info.outputs.check_run_id }}
|
||||
with:
|
||||
script: |
|
||||
const result = process.env.DOCKER_RESULT;
|
||||
const conclusionMap = {
|
||||
success: { conclusion: 'success', icon: '✅', summary: 'All Docker integration tests passed.' },
|
||||
failure: { conclusion: 'failure', icon: '❌', summary: 'One or more Docker integration tests failed.' },
|
||||
cancelled: { conclusion: 'cancelled', icon: '⏹️', summary: 'Workflow was cancelled.' },
|
||||
};
|
||||
const { conclusion, icon, summary } = conclusionMap[result] ?? conclusionMap.failure;
|
||||
const label = conclusion.charAt(0).toUpperCase() + conclusion.slice(1);
|
||||
await github.rest.checks.update({
|
||||
owner: context.repo.owner,
|
||||
repo: context.repo.repo,
|
||||
check_run_id: parseInt(process.env.CHECK_RUN_ID),
|
||||
status: 'completed',
|
||||
conclusion,
|
||||
completed_at: new Date().toISOString(),
|
||||
output: {
|
||||
title: `${icon} ${process.env.CHECK_NAME} — ${label}`,
|
||||
summary,
|
||||
text: `[View workflow run](https://github.com/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId})`
|
||||
}
|
||||
});
|
||||
@@ -0,0 +1,643 @@
|
||||
name: Wazuh Docker pipeline
|
||||
permissions:
|
||||
contents: read
|
||||
id-token: write
|
||||
on:
|
||||
pull_request:
|
||||
workflow_dispatch:
|
||||
inputs:
|
||||
docker_reference:
|
||||
description: 'Branch or tag to build from'
|
||||
required: true
|
||||
type: string
|
||||
|
||||
jobs:
|
||||
|
||||
prepare-variables:
|
||||
runs-on: ubuntu-latest
|
||||
outputs:
|
||||
WAZUH_VERSION: ${{ steps.dotenv.outputs.WAZUH_VERSION }}
|
||||
WAZUH_IMAGE_VERSION: ${{ steps.dotenv.outputs.WAZUH_IMAGE_VERSION }}
|
||||
WAZUH_REGISTRY: ${{ vars.IMAGE_REGISTRY_DEV }}
|
||||
IMAGE_TAG: ${{ steps.dotenv.outputs.IMAGE_TAG }}
|
||||
WAZUH_MINOR_VERSION: ${{ steps.dotenv.outputs.WAZUH_MINOR_VERSION }}
|
||||
steps:
|
||||
|
||||
- name: Checkout repository
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: Export .env variables
|
||||
id: dotenv
|
||||
shell: bash
|
||||
run: |
|
||||
if [ ! -f .env ]; then echo "::error::.env missing"; exit 1; fi
|
||||
grep -v '^#' .env | grep -v '^\s*$' >> "$GITHUB_OUTPUT"
|
||||
FULL_VERSION=$(grep "^WAZUH_VERSION=" .env | cut -d'=' -f2)
|
||||
MINOR_VERSION=$(echo "$FULL_VERSION" | cut -d'.' -f1,2)
|
||||
echo "WAZUH_MINOR_VERSION=$MINOR_VERSION" >> "$GITHUB_OUTPUT"
|
||||
|
||||
|
||||
build-images:
|
||||
needs: prepare-variables
|
||||
uses: ./.github/workflows/Procedure_push_docker_images.yml
|
||||
secrets: inherit
|
||||
with:
|
||||
image_tag: ${{ needs.prepare-variables.outputs.WAZUH_IMAGE_VERSION }}
|
||||
docker_reference: ${{ github.head_ref || inputs.docker_reference }}
|
||||
wazuh_automation_reference: 'main'
|
||||
commit_list: '["latest", "latest", "latest", "latest"]'
|
||||
assistant_revision: 'latest'
|
||||
id: ${{ github.run_id }}
|
||||
dev: true
|
||||
|
||||
Execute-Goss-tests:
|
||||
needs: [prepare-variables, build-images]
|
||||
runs-on: ubuntu-22.04
|
||||
env:
|
||||
WAZUH_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.WAZUH_IMAGE_VERSION }}
|
||||
WAZUH_REGISTRY: ${{ needs.prepare-variables.outputs.WAZUH_REGISTRY }}
|
||||
steps:
|
||||
|
||||
- name: Check out code
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: Install Goss
|
||||
uses: e1himself/goss-installation-action@v1.0.3
|
||||
with:
|
||||
version: 'v0.4.4'
|
||||
|
||||
- name: Configure aws credentials
|
||||
uses: aws-actions/configure-aws-credentials@v4
|
||||
with:
|
||||
role-to-assume: ${{ secrets.AWS_IAM_DOCKER_ROLE }}
|
||||
aws-region: "${{ secrets.AWS_REGION }}"
|
||||
|
||||
- name: Log in to Amazon ECR
|
||||
uses: aws-actions/amazon-ecr-login@v2
|
||||
|
||||
- name: Execute Goss tests (wazuh-manager)
|
||||
run: dgoss run ${{ env.WAZUH_REGISTRY }}/wazuh/wazuh-manager:${{ env.WAZUH_IMAGE_VERSION }}
|
||||
env:
|
||||
GOSS_SLEEP: 30
|
||||
GOSS_FILE: .github/.goss.yaml
|
||||
|
||||
check-single-node:
|
||||
name: Check single node on ${{ matrix.os }}
|
||||
runs-on: ${{ matrix.os }}
|
||||
strategy:
|
||||
matrix:
|
||||
os: [ubuntu-22.04, ubuntu-22.04-arm]
|
||||
fail-fast: false
|
||||
needs: [prepare-variables, Execute-Goss-tests, build-images]
|
||||
env:
|
||||
WAZUH_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.WAZUH_IMAGE_VERSION }}
|
||||
WAZUH_MINOR_VERSION: ${{ needs.prepare-variables.outputs.WAZUH_MINOR_VERSION }}
|
||||
WAZUH_REGISTRY: ${{ needs.prepare-variables.outputs.WAZUH_REGISTRY }}
|
||||
INDEXER_USERNAME: admin
|
||||
INDEXER_PASSWORD: admin
|
||||
MANAGER_NODES: "manager"
|
||||
API_USERNAME: wazuh-wui
|
||||
API_PASSWORD: wazuh-wui
|
||||
steps:
|
||||
|
||||
- name: Check out code
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: free disk space
|
||||
uses: ./.github/free-disk-space
|
||||
|
||||
- name: Configure aws credentials
|
||||
uses: aws-actions/configure-aws-credentials@v4
|
||||
with:
|
||||
role-to-assume: ${{ secrets.AWS_IAM_DOCKER_ROLE }}
|
||||
aws-region: "${{ secrets.AWS_REGION }}"
|
||||
|
||||
- name: Log in to Amazon ECR
|
||||
uses: aws-actions/amazon-ecr-login@v2
|
||||
|
||||
- name: Download artifact_urls.yaml
|
||||
uses: actions/download-artifact@v4
|
||||
with:
|
||||
name: presigned-artifact-urls-${{ github.run_id }}
|
||||
path: ./single-node/
|
||||
|
||||
- name: Add environment variables into GITHUB_ENV
|
||||
run: |
|
||||
# Export variables to the environment
|
||||
awk -F':' '!/^#/ && NF>1 {name=$1; val=substr($0,length(name)+3); gsub(/[-.]/,"_",name); print name "=" val}' ${{ vars.ARTIFACT_URL_FILE_NAME }} >> "$GITHUB_ENV"
|
||||
working-directory: ./single-node/
|
||||
|
||||
- name: Create single node certficates
|
||||
run: |
|
||||
curl --output ./wazuh-certs-tool.sh "${{ env.wazuh_certs_tool }}"
|
||||
cat > config.yml <<EOF
|
||||
nodes:
|
||||
# Wazuh indexer server nodes
|
||||
indexer:
|
||||
- name: wazuh.indexer
|
||||
dns: "wazuh.indexer"
|
||||
|
||||
# Wazuh manager nodes
|
||||
# Use node_type only with more than one Wazuh manager
|
||||
manager:
|
||||
- name: wazuh.manager
|
||||
dns: "wazuh.manager"
|
||||
|
||||
# Wazuh dashboard node
|
||||
dashboard:
|
||||
- name: wazuh.dashboard
|
||||
dns: "wazuh.dashboard"
|
||||
EOF
|
||||
cat config.yml
|
||||
sudo bash ../tools/utils/deployment/certificates-conf.sh --cert --copy --priv
|
||||
sudo sysctl -w vm.max_map_count=262144
|
||||
working-directory: ./single-node
|
||||
|
||||
- name: Edit single node docker-compose file
|
||||
shell: bash
|
||||
env:
|
||||
WAZUH_REGISTRY: ${{ env.WAZUH_REGISTRY }}
|
||||
run: |
|
||||
TARGET_FILE="single-node/docker-compose.yml"
|
||||
if [ -f "$TARGET_FILE" ]; then
|
||||
echo "Updating registry in $TARGET_FILE to: ${{ env.WAZUH_REGISTRY }}"
|
||||
sed -i "s|wazuh/wazuh-|${{ env.WAZUH_REGISTRY }}/wazuh/wazuh-|g" "$TARGET_FILE"
|
||||
else
|
||||
echo "File $TARGET_FILE not found"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
- name: Start single node stack
|
||||
id: start_single_node_stack
|
||||
run: docker compose up -d
|
||||
working-directory: ./single-node
|
||||
|
||||
- name: Check Wazuh indexer start
|
||||
if: ${{ always() && steps.start_single_node_stack.outcome == 'success' }}
|
||||
run: |
|
||||
for i in {1..20}; do
|
||||
echo "Checking Wazuh indexer health (Attempt $i/20)"
|
||||
RESPONSE=$(curl -XGET "https://127.0.0.1:9200/_cluster/health?pretty" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s --retry 2 || true)
|
||||
INDEXER_CONTAINERS=$(docker ps --format '{{.Names}}' | grep "indexer")
|
||||
if echo "$RESPONSE" | grep -qE "green|yellow"; then
|
||||
echo "Cluster Online"
|
||||
echo "$RESPONSE"
|
||||
exit 0
|
||||
fi
|
||||
echo "Waiting for cluster to be online"
|
||||
for CONTAINER_NAME in $INDEXER_CONTAINERS; do
|
||||
echo ""
|
||||
echo "========================================================="
|
||||
echo "Container logs for $CONTAINER_NAME"
|
||||
echo "========================================================="
|
||||
docker logs --tail 30 "$CONTAINER_NAME"
|
||||
echo "---------------------------------------------------------"
|
||||
done
|
||||
[ $i -lt 20 ] && sleep 60
|
||||
done
|
||||
status_index="`curl -XGET "https://127.0.0.1:9200/_cat/indices" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | wc -l`"
|
||||
status_index_green="`curl -XGET "https://127.0.0.1:9200/_cat/indices" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | grep -E "green|yellow" | wc -l`"
|
||||
if [[ $status_index_green -eq $status_index ]]; then
|
||||
curl -XGET "https://127.0.0.1:9200/_cat/indices" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s
|
||||
else
|
||||
curl -XGET "https://127.0.0.1:9200/_cat/indices" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s
|
||||
exit 1
|
||||
fi
|
||||
|
||||
|
||||
- name: Check Wazuh indexer nodes
|
||||
if: ${{ always() && steps.start_single_node_stack.outcome == 'success' }}
|
||||
run: |
|
||||
nodes="`curl -XGET "https://127.0.0.1:9200/_cat/nodes" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | grep -E "indexer" | wc -l`"
|
||||
echo "Wazuh indexer nodes: ${nodes}"
|
||||
|
||||
- name: Check Wazuh templates
|
||||
if: ${{ always() && steps.start_single_node_stack.outcome == 'success' }}
|
||||
run: |
|
||||
qty_templates="`curl -XGET "https://127.0.0.1:9200/_cat/templates" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | grep -P "wazuh|wazuh-agent|wazuh-statistics" | wc -l`"
|
||||
templates="`curl -XGET "https://127.0.0.1:9200/_cat/templates" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | grep -P "wazuh|wazuh-agent|wazuh-statistics"`"
|
||||
if [[ $qty_templates -gt 3 ]]; then
|
||||
echo "wazuh templates:"
|
||||
echo "${templates}"
|
||||
else
|
||||
echo "wazuh templates:"
|
||||
echo "${templates}"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
- name: Check Wazuh manager start
|
||||
if: ${{ always() && steps.start_single_node_stack.outcome == 'success' }}
|
||||
run: |
|
||||
for NODE in "${{ env.MANAGER_NODES }}"; do
|
||||
ok=false
|
||||
for i in {1..20}; do
|
||||
TOKEN=$(curl -s -u ${{ env.API_USERNAME }}:${{ env.API_PASSWORD }} -k -X POST "https://127.0.0.1:55000/security/user/authenticate?raw=true")
|
||||
services="`curl -k -s -X GET "https://127.0.0.1:55000/cluster/$NODE/status?pretty=true" -H "Authorization: Bearer ${TOKEN}" | jq -r .data.affected_items | grep running | wc -l`"
|
||||
if [[ $services -gt 7 ]]; then
|
||||
echo "Wazuh Manager $NODE Services: ${services}"
|
||||
echo "OK"
|
||||
ok=true
|
||||
break
|
||||
else
|
||||
curl -k -X GET "https://127.0.0.1:55000/cluster/$NODE/status?pretty=true" -H "Authorization: Bearer ${TOKEN}" | jq -r .data.affected_items
|
||||
echo "Wazuh Manager $NODE Services: ${services}. Retrying in 30s"
|
||||
[ $i -lt 20 ] && sleep 30
|
||||
fi
|
||||
done
|
||||
if [[ "$ok" != "true" ]]; then
|
||||
echo "Error: Wazuh Manager $NODE did not reach expected running services threshold"
|
||||
exit 1
|
||||
fi
|
||||
done
|
||||
|
||||
- name: Check Wazuh dashboard service URL
|
||||
if: ${{ always() && steps.start_single_node_stack.outcome == 'success' }}
|
||||
run: |
|
||||
for i in {1..20}; do
|
||||
echo "Checking Wazuh dashboard (Attempt $i/20)"
|
||||
STATUS=$(curl -k -s -o /dev/null -w "%{http_code}" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} "https://127.0.0.1:443/app/status" || true)
|
||||
echo "Current status: $STATUS"
|
||||
if [[ "$STATUS" == "200" ]]; then
|
||||
echo "Wazuh dashboard is UP"
|
||||
exit 0
|
||||
elif [[ "$STATUS" == "429" || "$STATUS" == "503" ]]; then
|
||||
echo "Dashboard is busy or initializing (Status $STATUS). Retrying in 30s"
|
||||
else
|
||||
echo "Unexpected status $STATUS. Retrying in 30s"
|
||||
fi
|
||||
sleep 30
|
||||
done
|
||||
echo "Error: Dashboard did not reach 200 status in time."
|
||||
exit 1
|
||||
|
||||
- name: Modify Docker endpoint into Wazuh agent docker-compose.yml file
|
||||
if: ${{ always() && steps.start_single_node_stack.outcome == 'success' }}
|
||||
run: sed -i "s/<WAZUH_MANAGER_IP>/$(ip addr show docker0 | grep 'inet ' | awk '{print $2}' | cut -d'/' -f1)/g" wazuh-agent/docker-compose.yml
|
||||
|
||||
- name: Edit Wazuh agent docker-compose file
|
||||
if: ${{ always() && steps.start_single_node_stack.outcome == 'success' }}
|
||||
shell: bash
|
||||
env:
|
||||
WAZUH_REGISTRY: ${{ env.WAZUH_REGISTRY }}
|
||||
run: |
|
||||
TARGET_FILE="wazuh-agent/docker-compose.yml"
|
||||
if [ -f "$TARGET_FILE" ]; then
|
||||
echo "Updating registry in $TARGET_FILE to: ${{ env.WAZUH_REGISTRY }}"
|
||||
sed -i "s|wazuh/wazuh-|${{ env.WAZUH_REGISTRY }}/wazuh/wazuh-|g" "$TARGET_FILE"
|
||||
else
|
||||
echo "File $TARGET_FILE not found"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
- name: Start Wazuh agent
|
||||
if: ${{ always() && steps.start_single_node_stack.outcome == 'success' }}
|
||||
run: docker compose up -d
|
||||
working-directory: ./wazuh-agent
|
||||
|
||||
- name: Check Wazuh agent enrollment
|
||||
if: ${{ always() && steps.start_single_node_stack.outcome == 'success' }}
|
||||
run: |
|
||||
enrolled=false
|
||||
for i in {1..5}; do
|
||||
TOKEN=$(curl -s -u ${{ env.API_USERNAME }}:${{ env.API_PASSWORD }} -k -X POST "https://127.0.0.1:55000/security/user/authenticate?raw=true")
|
||||
agents="`curl -k -s -X GET "https://127.0.0.1:55000/agents?pretty=true" -H "Authorization: Bearer ${TOKEN}" | jq -r .data.affected_items | grep active | wc -l`"
|
||||
if [[ $agents -gt 0 ]]; then
|
||||
echo "Wazuh agents: ${agents}"
|
||||
echo "OK"
|
||||
enrolled=true
|
||||
break
|
||||
else
|
||||
curl -k -s -X GET "https://127.0.0.1:55000/agents?pretty=true" -H "Authorization: Bearer ${TOKEN}"
|
||||
echo "Wazuh agents: ${agents}. Retrying in 10s"
|
||||
[ $i -lt 5 ] && sleep 10
|
||||
fi
|
||||
done
|
||||
if [[ "$enrolled" != "true" ]]; then
|
||||
echo "Error: Wazuh agent enrollment did not reach expected active agents threshold"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
- name: Check errors in wazuh-manager.log for Wazuh manager
|
||||
if: ${{ always() && steps.start_single_node_stack.outcome == 'success' }}
|
||||
run: ./.github/single-node-log-check.sh
|
||||
|
||||
- name: Check documents into wazuh-states index
|
||||
if: ${{ always() && steps.start_single_node_stack.outcome == 'success' }}
|
||||
run: |
|
||||
for i in {1..20}; do
|
||||
echo "Checking documents in wazuh-states (Attempt $i/20)..."
|
||||
RESPONSE=$(curl -XGET "https://127.0.0.1:9200/wazuh-states*/_count" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s || echo "{}")
|
||||
DOCS=$(echo "$RESPONSE" | jq -r '.count // 0')
|
||||
if [[ "$DOCS" -gt 0 ]]; then
|
||||
echo "wazuh-states index has documents: ${DOCS}"
|
||||
exit 0
|
||||
fi
|
||||
echo "The index is empty or does not exist yet (Count: $DOCS). Waiting 60s"
|
||||
[ $i -lt 20 ] && sleep 60
|
||||
done
|
||||
echo "Error: No documents found in wazuh-states after 20 attempts."
|
||||
echo "Last response: $RESPONSE"
|
||||
exit 1
|
||||
|
||||
- name: Docker logs
|
||||
if: always()
|
||||
continue-on-error: true
|
||||
run: |
|
||||
INDEXER_CONTAINERS=$(docker ps --format '{{.Names}}')
|
||||
for CONTAINER_NAME in $INDEXER_CONTAINERS; do
|
||||
echo ""
|
||||
echo "========================================================="
|
||||
echo "Container logs for $CONTAINER_NAME"
|
||||
echo "========================================================="
|
||||
docker logs "$CONTAINER_NAME"
|
||||
echo "---------------------------------------------------------"
|
||||
done
|
||||
working-directory: ./single-node
|
||||
|
||||
check-multi-node:
|
||||
name: Check multi node on ${{ matrix.os }}
|
||||
runs-on: ${{ matrix.os }}
|
||||
strategy:
|
||||
matrix:
|
||||
os: [ubuntu-22.04, ubuntu-22.04-arm]
|
||||
fail-fast: false
|
||||
needs: [prepare-variables, Execute-Goss-tests, build-images]
|
||||
env:
|
||||
WAZUH_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.WAZUH_IMAGE_VERSION }}
|
||||
WAZUH_MINOR_VERSION: ${{ needs.prepare-variables.outputs.WAZUH_MINOR_VERSION }}
|
||||
WAZUH_REGISTRY: ${{ needs.prepare-variables.outputs.WAZUH_REGISTRY }}
|
||||
INDEXER_USERNAME: admin
|
||||
INDEXER_PASSWORD: admin
|
||||
MANAGER_NODES: "master,worker01"
|
||||
API_USERNAME: wazuh-wui
|
||||
API_PASSWORD: wazuh-wui
|
||||
steps:
|
||||
|
||||
- name: Check out code
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: free disk space
|
||||
uses: ./.github/free-disk-space
|
||||
|
||||
- name: Configure aws credentials
|
||||
uses: aws-actions/configure-aws-credentials@v4
|
||||
with:
|
||||
role-to-assume: ${{ secrets.AWS_IAM_DOCKER_ROLE }}
|
||||
aws-region: "${{ secrets.AWS_REGION }}"
|
||||
|
||||
- name: Log in to Amazon ECR
|
||||
uses: aws-actions/amazon-ecr-login@v2
|
||||
|
||||
- name: Download artifact_urls.yaml
|
||||
uses: actions/download-artifact@v4
|
||||
with:
|
||||
name: presigned-artifact-urls-${{ github.run_id }}
|
||||
path: ./multi-node/
|
||||
|
||||
- name: Add environment variables into GITHUB_ENV
|
||||
run: |
|
||||
# Export variables to the environment
|
||||
awk -F':' '!/^#/ && NF>1 {name=$1; val=substr($0,length(name)+3); gsub(/[-.]/,"_",name); print name "=" val}' ${{ vars.ARTIFACT_URL_FILE_NAME }} >> "$GITHUB_ENV"
|
||||
working-directory: ./multi-node/
|
||||
|
||||
- name: Create multi node certficates
|
||||
run: |
|
||||
curl --output ./wazuh-certs-tool.sh "${{ env.wazuh_certs_tool }}"
|
||||
cat > config.yml <<EOF
|
||||
nodes:
|
||||
# Wazuh indexer server nodes
|
||||
indexer:
|
||||
- name: wazuh1.indexer
|
||||
dns: "wazuh1.indexer"
|
||||
- name: wazuh2.indexer
|
||||
dns: "wazuh2.indexer"
|
||||
- name: wazuh3.indexer
|
||||
dns: "wazuh3.indexer"
|
||||
|
||||
# Wazuh manager nodes
|
||||
# Use node_type only with more than one Wazuh manager
|
||||
manager:
|
||||
- name: wazuh.master
|
||||
dns: "wazuh.master"
|
||||
node_type: master
|
||||
- name: wazuh.worker
|
||||
dns: "wazuh.worker"
|
||||
node_type: worker
|
||||
|
||||
# Wazuh dashboard node
|
||||
dashboard:
|
||||
- name: wazuh.dashboard
|
||||
dns: "wazuh.dashboard"
|
||||
EOF
|
||||
cat config.yml
|
||||
sudo bash ../tools/utils/deployment/certificates-conf.sh --cert --copy --priv
|
||||
sudo sysctl -w vm.max_map_count=262144
|
||||
working-directory: ./multi-node
|
||||
|
||||
- name: Edit multi node docker-compose file
|
||||
shell: bash
|
||||
run: |
|
||||
TARGET_FILE="multi-node/docker-compose.yml"
|
||||
if [ -f "$TARGET_FILE" ]; then
|
||||
echo "Updating registry in $TARGET_FILE to: ${{ env.WAZUH_REGISTRY }}"
|
||||
sed -i "s|wazuh/wazuh-|${{ env.WAZUH_REGISTRY }}/wazuh/wazuh-|g" "$TARGET_FILE"
|
||||
else
|
||||
echo "File $TARGET_FILE not found"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
- name: Start multi node stack
|
||||
id: start_multi_node_stack
|
||||
run: docker compose up -d
|
||||
working-directory: ./multi-node
|
||||
|
||||
- name: Check Wazuh indexer start
|
||||
if: ${{ always() && steps.start_multi_node_stack.outcome == 'success' }}
|
||||
run: |
|
||||
for i in {1..20}; do
|
||||
echo "Checking Wazuh indexer health (Attempt $i/20)"
|
||||
RESPONSE=$(curl -XGET "https://127.0.0.1:9200/_cluster/health?pretty" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s --retry 2 || true)
|
||||
INDEXER_CONTAINERS=$(docker ps --format '{{.Names}}' | grep "indexer")
|
||||
if echo "$RESPONSE" | grep -qE "green|yellow"; then
|
||||
echo "Cluster Online"
|
||||
echo "$RESPONSE"
|
||||
exit 0
|
||||
fi
|
||||
echo "Waiting for cluster to be online"
|
||||
for CONTAINER_NAME in $INDEXER_CONTAINERS; do
|
||||
echo ""
|
||||
echo "========================================================="
|
||||
echo "Container logs for $CONTAINER_NAME"
|
||||
echo "========================================================="
|
||||
docker logs --tail 30 "$CONTAINER_NAME"
|
||||
echo "---------------------------------------------------------"
|
||||
done
|
||||
[ $i -lt 20 ] && sleep 60
|
||||
done
|
||||
status_index="`curl -XGET "https://127.0.0.1:9200/_cat/indices" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | wc -l`"
|
||||
status_index_green="`curl -XGET "https://127.0.0.1:9200/_cat/indices" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | grep -E "green" | wc -l`"
|
||||
if [[ $status_index_green -eq $status_index ]]; then
|
||||
curl -XGET "https://127.0.0.1:9200/_cat/indices" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s
|
||||
else
|
||||
curl -XGET "https://127.0.0.1:9200/_cat/indices" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s
|
||||
exit 1
|
||||
fi
|
||||
|
||||
- name: Check Wazuh indexer nodes
|
||||
if: ${{ always() && steps.start_multi_node_stack.outcome == 'success' }}
|
||||
run: |
|
||||
nodes="`curl -XGET "https://127.0.0.1:9200/_cat/nodes" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | grep -E "indexer" | wc -l`"
|
||||
if [[ $nodes -eq 3 ]]; then
|
||||
echo "Wazuh indexer nodes: ${nodes}"
|
||||
else
|
||||
echo "Wazuh indexer nodes: ${nodes}"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
- name: Check Wazuh templates
|
||||
if: ${{ always() && steps.start_multi_node_stack.outcome == 'success' }}
|
||||
run: |
|
||||
qty_templates="`curl -XGET "https://127.0.0.1:9200/_cat/templates" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | grep "wazuh" | wc -l`"
|
||||
templates="`curl -XGET "https://127.0.0.1:9200/_cat/templates" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | grep "wazuh"`"
|
||||
if [[ $qty_templates -gt 3 ]]; then
|
||||
echo "wazuh templates:"
|
||||
echo "${templates}"
|
||||
else
|
||||
echo "wazuh templates:"
|
||||
echo "${templates}"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
- name: Check Wazuh manager start
|
||||
if: ${{ always() && steps.start_multi_node_stack.outcome == 'success' }}
|
||||
run: |
|
||||
IFS=',' read -r -a NODES <<< "${{ env.MANAGER_NODES }}"
|
||||
for NODE in "${NODES[@]}"; do
|
||||
if [[ "$NODE" == "master" ]]; then
|
||||
THRESHOLD=8
|
||||
else
|
||||
THRESHOLD=7
|
||||
fi
|
||||
ok=false
|
||||
for i in {1..20}; do
|
||||
TOKEN=$(curl -s -u ${{ env.API_USERNAME }}:${{ env.API_PASSWORD }} -k -X POST "https://127.0.0.1:55000/security/user/authenticate?raw=true")
|
||||
services="`curl -k -s -X GET "https://127.0.0.1:55000/cluster/$NODE/status?pretty=true" -H "Authorization: Bearer ${TOKEN}" | jq -r .data.affected_items | grep running | wc -l`"
|
||||
if [[ $services -ge $THRESHOLD ]]; then
|
||||
echo "Wazuh Manager $NODE Services: ${services}"
|
||||
echo "OK"
|
||||
ok=true
|
||||
break
|
||||
else
|
||||
curl -k -X GET "https://127.0.0.1:55000/cluster/$NODE/status?pretty=true" -H "Authorization: Bearer ${TOKEN}" | jq -r .data.affected_items
|
||||
echo "Wazuh Manager $NODE Services: ${services}. Retrying in 30s"
|
||||
[ $i -lt 20 ] && sleep 30
|
||||
fi
|
||||
done
|
||||
if [[ "$ok" != "true" ]]; then
|
||||
echo "Error: Wazuh Manager $NODE did not reach expected running services threshold"
|
||||
exit 1
|
||||
fi
|
||||
done
|
||||
|
||||
- name: Check Wazuh dashboard service URL
|
||||
if: ${{ always() && steps.start_multi_node_stack.outcome == 'success' }}
|
||||
run: |
|
||||
for i in {1..20}; do
|
||||
echo "Checking Wazuh dashboard (Attempt $i/20)"
|
||||
STATUS=$(curl -k -s -o /dev/null -w "%{http_code}" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} "https://127.0.0.1:443/app/status" || true)
|
||||
echo "Current status: $STATUS"
|
||||
if [[ "$STATUS" == "200" ]]; then
|
||||
echo "Wazuh dashboard is UP"
|
||||
exit 0
|
||||
elif [[ "$STATUS" == "429" || "$STATUS" == "503" ]]; then
|
||||
echo "Dashboard is busy or initializing (Status $STATUS). Retrying in 30s"
|
||||
else
|
||||
echo "Unexpected status $STATUS. Retrying in 30s"
|
||||
fi
|
||||
sleep 30
|
||||
done
|
||||
echo "Error: Dashboard did not reach 200 status in time."
|
||||
exit 1
|
||||
|
||||
- name: Modify Docker endpoint into Wazuh agent docker-compose.yml file
|
||||
if: ${{ always() && steps.start_multi_node_stack.outcome == 'success' }}
|
||||
run: sed -i "s/<WAZUH_MANAGER_IP>/$(ip addr show docker0 | grep 'inet ' | awk '{print $2}' | cut -d'/' -f1)/g" wazuh-agent/docker-compose.yml
|
||||
|
||||
- name: Edit Wazuh agent docker-compose file
|
||||
if: ${{ always() && steps.start_multi_node_stack.outcome == 'success' }}
|
||||
shell: bash
|
||||
env:
|
||||
WAZUH_REGISTRY: ${{ env.WAZUH_REGISTRY }}
|
||||
run: |
|
||||
TARGET_FILE="wazuh-agent/docker-compose.yml"
|
||||
if [ -f "$TARGET_FILE" ]; then
|
||||
echo "Updating registry in $TARGET_FILE to: ${{ env.WAZUH_REGISTRY }}"
|
||||
sed -i "s|wazuh/wazuh-|${{ env.WAZUH_REGISTRY }}/wazuh/wazuh-|g" "$TARGET_FILE"
|
||||
else
|
||||
echo "File $TARGET_FILE not found"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
- name: Start Wazuh agent
|
||||
if: ${{ always() && steps.start_multi_node_stack.outcome == 'success' }}
|
||||
run: docker compose -f wazuh-agent/docker-compose.yml up -d
|
||||
|
||||
- name: Check Wazuh agent enrollment
|
||||
if: ${{ always() && steps.start_multi_node_stack.outcome == 'success' }}
|
||||
run: |
|
||||
enrolled=false
|
||||
for i in {1..5}; do
|
||||
TOKEN=$(curl -s -u ${{ env.API_USERNAME }}:${{ env.API_PASSWORD }} -k -X POST "https://127.0.0.1:55000/security/user/authenticate?raw=true")
|
||||
agents="`curl -k -s -X GET "https://127.0.0.1:55000/agents?pretty=true" -H "Authorization: Bearer ${TOKEN}" | jq -r .data.affected_items | grep active | wc -l`"
|
||||
if [[ $agents -gt 0 ]]; then
|
||||
echo "Wazuh agents: ${agents}"
|
||||
echo "OK"
|
||||
enrolled=true
|
||||
break
|
||||
else
|
||||
curl -k -s -X GET "https://127.0.0.1:55000/agents?pretty=true" -H "Authorization: Bearer ${TOKEN}"
|
||||
echo "Wazuh agents: ${agents}. Retrying in 10s"
|
||||
[ $i -lt 5 ] && sleep 10
|
||||
fi
|
||||
done
|
||||
if [[ "$enrolled" != "true" ]]; then
|
||||
echo "Error: Wazuh agent enrollment did not reach expected active agents threshold"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
- name: Check errors in wazuh-manager.log for Wazuh manager
|
||||
if: ${{ always() && steps.start_multi_node_stack.outcome == 'success' }}
|
||||
run: ./.github/multi-node-log-check.sh
|
||||
|
||||
- name: Check documents into wazuh-states index
|
||||
if: ${{ always() && steps.start_multi_node_stack.outcome == 'success' }}
|
||||
run: |
|
||||
for i in {1..20}; do
|
||||
echo "Checking documents in wazuh-states (Attempt $i/20)..."
|
||||
RESPONSE=$(curl -XGET "https://127.0.0.1:9200/wazuh-states*/_count" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s || echo "{}")
|
||||
DOCS=$(echo "$RESPONSE" | jq -r '.count // 0')
|
||||
if [[ "$DOCS" -gt 0 ]]; then
|
||||
echo "wazuh-states index has documents: ${DOCS}"
|
||||
exit 0
|
||||
fi
|
||||
echo "The index is empty or does not exist yet (Count: $DOCS). Waiting 60s"
|
||||
[ $i -lt 20 ] && sleep 60
|
||||
done
|
||||
echo "Error: No documents found in wazuh-states after 20 attempts."
|
||||
echo "Last response: $RESPONSE"
|
||||
exit 1
|
||||
|
||||
- name: Docker logs
|
||||
if: always()
|
||||
continue-on-error: true
|
||||
run: |
|
||||
INDEXER_CONTAINERS=$(docker ps --format '{{.Names}}')
|
||||
for CONTAINER_NAME in $INDEXER_CONTAINERS; do
|
||||
echo ""
|
||||
echo "========================================================="
|
||||
echo "Container logs for $CONTAINER_NAME"
|
||||
echo "========================================================="
|
||||
docker logs "$CONTAINER_NAME"
|
||||
echo "---------------------------------------------------------"
|
||||
done
|
||||
working-directory: ./multi-node
|
||||
+65
-75
@@ -1,5 +1,5 @@
|
||||
run-name: Build and push images 5.x - ${{ inputs.dev && 'dev' || 'release' }} - ${{ inputs.id }}
|
||||
name: (5.x) Build and push images
|
||||
run-name: Launch Push Docker Images - ${{ inputs.id }}
|
||||
name: Push Docker Images
|
||||
|
||||
on:
|
||||
workflow_dispatch:
|
||||
@@ -14,7 +14,7 @@ on:
|
||||
wazuh_automation_reference:
|
||||
description: 'Branch or tag of the wazuh-automation repository'
|
||||
required: false
|
||||
default: '5.0.0'
|
||||
default: 'main'
|
||||
products:
|
||||
description: 'Comma-separated list of the image names to build and push'
|
||||
default: 'wazuh-manager,wazuh-dashboard,wazuh-indexer,wazuh-agent'
|
||||
@@ -52,7 +52,7 @@ on:
|
||||
wazuh_automation_reference:
|
||||
description: 'Branch or tag of the wazuh-automation repository'
|
||||
required: false
|
||||
default: '5.0.0'
|
||||
default: 'main'
|
||||
type: string
|
||||
products:
|
||||
description: 'Comma-separated list of the image names to build and push'
|
||||
@@ -81,12 +81,11 @@ on:
|
||||
permissions:
|
||||
id-token: write
|
||||
contents: read
|
||||
env:
|
||||
LOCAL_ARTIFACT_URLS_FILEPATH: /tmp/${{ vars.ARTIFACT_URL_FILE_NAME }}
|
||||
|
||||
jobs:
|
||||
setup:
|
||||
runs-on: codebuild-github-actions-codebuild-runner-devops-amd-${{ github.run_id }}-${{ github.run_attempt }}
|
||||
runs-on:
|
||||
group: wz-linux-amd64
|
||||
|
||||
outputs:
|
||||
WAZUH_COMPONENTS: ${{ steps.compute-outputs.outputs.WAZUH_COMPONENTS }}
|
||||
@@ -97,7 +96,7 @@ jobs:
|
||||
- name: Print inputs
|
||||
run: |
|
||||
echo "---------------------------------------------"
|
||||
echo "Running 5_build_and_push_images workflow"
|
||||
echo "Running Procedure_push_docker_images workflow"
|
||||
echo "---------------------------------------------"
|
||||
echo "* BRANCH: ${{ github.ref }}"
|
||||
echo "* COMMIT: ${{ github.sha }}"
|
||||
@@ -116,13 +115,9 @@ jobs:
|
||||
|
||||
- name: Set up variables
|
||||
id: compute-outputs
|
||||
env:
|
||||
PRODUCTS_INPUT: ${{ inputs.products }}
|
||||
DEV_INPUT: ${{ inputs.dev }}
|
||||
COMMIT_LIST_INPUT: ${{ inputs.commit_list }}
|
||||
run: |
|
||||
# Use the default list if products is empty
|
||||
PRODUCTS="$PRODUCTS_INPUT"
|
||||
PRODUCTS="${{ inputs.products }}"
|
||||
if [[ -z "$PRODUCTS" || "$PRODUCTS" == "null" ]]; then
|
||||
PRODUCTS="wazuh-manager,wazuh-dashboard,wazuh-indexer,wazuh-agent"
|
||||
fi
|
||||
@@ -140,9 +135,9 @@ jobs:
|
||||
|
||||
# Set COMMIT_LIST
|
||||
WC_COMMIT_LIST=""
|
||||
if [[ "$DEV_INPUT" == "true" ]]; then
|
||||
if [[ "$COMMIT_LIST_INPUT" != "null" && "$COMMIT_LIST_INPUT" != "" ]]; then
|
||||
WC_COMMIT_LIST="$COMMIT_LIST_INPUT"
|
||||
if [[ "${{ inputs.dev }}" == "true" ]]; then
|
||||
if [[ "${{ inputs.commit_list }}" != "null" && "${{ inputs.commit_list }}" != "" ]]; then
|
||||
WC_COMMIT_LIST='${{ inputs.commit_list }}'
|
||||
else
|
||||
# Set commit list to "latest" for all components using WAZUH_COMPONENTS
|
||||
COMPONENTS=($(echo "$WC_JSON_ARRAY" | jq -r '.[]'))
|
||||
@@ -161,13 +156,15 @@ jobs:
|
||||
|
||||
package-urls:
|
||||
name: generate package urls
|
||||
runs-on: codebuild-github-actions-codebuild-runner-devops-amd-${{ github.run_id }}-${{ github.run_attempt }}
|
||||
runs-on:
|
||||
group: wz-linux-amd64
|
||||
needs: setup
|
||||
|
||||
env:
|
||||
WORKFLOW_VENV: "${{ github.workspace }}/workflow_venv"
|
||||
GENERATE_PRESIGNED_URLS_SCRIPT_PATH: ${{ github.workspace }}/wazuh-automation/tools/sign_urls/generate_presigned_dev_urls.py
|
||||
PRESIGNED_URLS_SCRIPT_PROCESS: "build_docker"
|
||||
LOCAL_ARTIFACT_URLS_FILEPATH: /tmp/${{ vars.ARTIFACT_URL_FILE_NAME }}
|
||||
COMMIT_LIST: ${{ inputs.commit_list }}
|
||||
ASSISTANT_REVISION: ${{ inputs.assistant_revision }}
|
||||
|
||||
@@ -177,7 +174,6 @@ jobs:
|
||||
uses: actions/checkout@v4
|
||||
with:
|
||||
ref: ${{ inputs.docker_reference }}
|
||||
persist-credentials: false
|
||||
|
||||
- name: Checkout wazuh/wazuh-automation repository
|
||||
if: ${{ inputs.dev == true }}
|
||||
@@ -187,7 +183,6 @@ jobs:
|
||||
ref: ${{ inputs.wazuh_automation_reference }}
|
||||
token: ${{ secrets.GH_CLONE_TOKEN }}
|
||||
path: wazuh-automation
|
||||
persist-credentials: false
|
||||
|
||||
- name: Configure AWS credentials
|
||||
if: ${{ inputs.dev == true }}
|
||||
@@ -220,15 +215,11 @@ jobs:
|
||||
if: ${{ inputs.dev == true }}
|
||||
run: |
|
||||
WAZUH_VERSION=$(jq -r '.version' VERSION.json)
|
||||
if ! [[ "$WAZUH_VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
|
||||
echo "Invalid version format: $WAZUH_VERSION"
|
||||
exit 1
|
||||
fi
|
||||
WAZUH_MAJOR=$(echo "$WAZUH_VERSION" | cut -d '.' -f 1)
|
||||
WAZUH_MINOR=$(echo "$WAZUH_VERSION" | cut -d '.' -f 1-2)
|
||||
echo "WAZUH_VERSION=$WAZUH_VERSION" >> $GITHUB_ENV
|
||||
echo "WAZUH_MAJOR=$WAZUH_MAJOR" >> $GITHUB_ENV
|
||||
echo "WAZUH_MINOR=$WAZUH_MINOR" >> $GITHUB_ENV
|
||||
echo WAZUH_VERSION=$WAZUH_VERSION >> $GITHUB_ENV
|
||||
echo WAZUH_MAJOR=$WAZUH_MAJOR >> $GITHUB_ENV
|
||||
echo WAZUH_MINOR=$WAZUH_MINOR >> $GITHUB_ENV
|
||||
|
||||
- name: Get artifacts URLs file
|
||||
if: ${{ inputs.dev == true }}
|
||||
@@ -238,16 +229,10 @@ jobs:
|
||||
|
||||
- name: Generate presigned URLs for artifacts for dev packages
|
||||
if: ${{ inputs.dev == true }}
|
||||
env:
|
||||
WAZUH_COMPONENTS: ${{ needs.setup.outputs.WAZUH_COMPONENTS }}
|
||||
COMMIT_LIST: ${{ needs.setup.outputs.COMMIT_LIST }}
|
||||
run: |
|
||||
source "$WORKFLOW_VENV/bin/activate"
|
||||
SCRIPT_PARAMS="--process $PRESIGNED_URLS_SCRIPT_PROCESS \
|
||||
--wazuh-version $WAZUH_VERSION \
|
||||
--aws-s3-bucket-dev $LOCAL_AWS_S3_BUCKET_DEV \
|
||||
--assistant-revision $ASSISTANT_REVISION "
|
||||
|
||||
source ${{ env.WORKFLOW_VENV }}/bin/activate
|
||||
WAZUH_COMPONENTS='${{ needs.setup.outputs.WAZUH_COMPONENTS }}'
|
||||
COMMIT_LIST='${{ needs.setup.outputs.COMMIT_LIST }}'
|
||||
|
||||
# Parse components and their revisions
|
||||
COMPONENTS=($(echo "$WAZUH_COMPONENTS" | jq -r '.[]'))
|
||||
@@ -266,31 +251,40 @@ jobs:
|
||||
for i in "${!COMPONENTS[@]}"; do
|
||||
case "${COMPONENTS[$i]}" in
|
||||
wazuh-manager)
|
||||
SCRIPT_PARAMS+="--manager-revision ${REVISIONS[$i]} "
|
||||
MANAGER_REVISION="${REVISIONS[$i]}"
|
||||
;;
|
||||
wazuh-dashboard)
|
||||
SCRIPT_PARAMS+="--dashboard-revision ${REVISIONS[$i]} "
|
||||
DASHBOARD_REVISION="${REVISIONS[$i]}"
|
||||
;;
|
||||
wazuh-indexer)
|
||||
SCRIPT_PARAMS+="--indexer-revision ${REVISIONS[$i]} "
|
||||
INDEXER_REVISION="${REVISIONS[$i]}"
|
||||
;;
|
||||
wazuh-agent)
|
||||
SCRIPT_PARAMS+="--agent-revision ${REVISIONS[$i]} "
|
||||
AGENT_REVISION="${REVISIONS[$i]}"
|
||||
;;
|
||||
esac
|
||||
done
|
||||
|
||||
python "$GENERATE_PRESIGNED_URLS_SCRIPT_PATH" \
|
||||
$SCRIPT_PARAMS
|
||||
python ${{ env.GENERATE_PRESIGNED_URLS_SCRIPT_PATH }} \
|
||||
--process ${{ env.PRESIGNED_URLS_SCRIPT_PROCESS }} \
|
||||
--wazuh-version ${{ env.WAZUH_VERSION }} \
|
||||
--aws-s3-bucket-dev ${{ env.LOCAL_AWS_S3_BUCKET_DEV }} \
|
||||
--indexer-revision $INDEXER_REVISION \
|
||||
--manager-revision $MANAGER_REVISION \
|
||||
--dashboard-revision $DASHBOARD_REVISION \
|
||||
--agent-revision $AGENT_REVISION \
|
||||
--assistant-revision $ASSISTANT_REVISION
|
||||
|
||||
- name: Save presigned URLs file to artifact
|
||||
if: ${{ inputs.dev == true }}
|
||||
run: |
|
||||
echo "Uploading presigned URLs artifact..."
|
||||
aws s3 cp "${{ env.LOCAL_ARTIFACT_URLS_FILEPATH }}" "s3://${{ secrets.CI_DEV_INTERNAL_S3_BUCKET }}/wazuh-docker/5_build_and_push_images/${{ github.run_id }}/${{ vars.ARTIFACT_URL_FILE_NAME }}"
|
||||
uses: actions/upload-artifact@v4
|
||||
with:
|
||||
name: presigned-artifact-urls-${{ github.run_id }}
|
||||
path: ${{ env.LOCAL_ARTIFACT_URLS_FILEPATH }}
|
||||
|
||||
build-and-push:
|
||||
runs-on: codebuild-github-actions-codebuild-runner-devops-amd-${{ github.run_id }}-${{ github.run_attempt }}
|
||||
runs-on:
|
||||
group: wz-linux-amd64
|
||||
|
||||
needs:
|
||||
- setup
|
||||
@@ -310,13 +304,6 @@ jobs:
|
||||
uses: actions/checkout@v6
|
||||
with:
|
||||
ref: ${{ inputs.docker_reference }}
|
||||
persist-credentials: false
|
||||
|
||||
- name: Log in to Docker Hub
|
||||
uses: docker/login-action@v4
|
||||
with:
|
||||
username: ${{ secrets.DOCKERHUB_USERNAME }}
|
||||
password: ${{ secrets.DOCKERHUB_PASSWORD }}
|
||||
|
||||
- name: Set up QEMU
|
||||
uses: docker/setup-qemu-action@v4
|
||||
@@ -335,20 +322,27 @@ jobs:
|
||||
if: ${{ inputs.dev == true }}
|
||||
uses: aws-actions/amazon-ecr-login@v2
|
||||
|
||||
- name: Log in to Docker Hub
|
||||
if: ${{ inputs.dev == false }}
|
||||
uses: docker/login-action@v4
|
||||
with:
|
||||
username: ${{ secrets.DOCKERHUB_USERNAME }}
|
||||
password: ${{ secrets.DOCKERHUB_PASSWORD }}
|
||||
|
||||
- name: Download artifact_urls.yaml (dev)
|
||||
if: ${{ inputs.dev == true }}
|
||||
run: |
|
||||
echo "Downloading presigned URLs artifact..."
|
||||
aws s3 cp "s3://${{ secrets.CI_DEV_INTERNAL_S3_BUCKET }}/wazuh-docker/5_build_and_push_images/${{ github.run_id }}/${{ vars.ARTIFACT_URL_FILE_NAME }}" "${{ env.LOCAL_ARTIFACT_URLS_FILEPATH }}"
|
||||
mv "${{ env.LOCAL_ARTIFACT_URLS_FILEPATH }}" ./build-docker-images/${{ vars.ARTIFACT_URL_FILE_NAME }}
|
||||
uses: actions/download-artifact@v4
|
||||
with:
|
||||
name: presigned-artifact-urls-${{ github.run_id }}
|
||||
path: ./build-docker-images
|
||||
|
||||
- name: Compute component reference (dev)
|
||||
if: ${{ inputs.dev == true }}
|
||||
env:
|
||||
COMPONENT: ${{ matrix.wazuh_component }}
|
||||
WAZUH_COMPONENTS: ${{ needs.setup.outputs.WAZUH_COMPONENTS }}
|
||||
COMMIT_LIST: ${{ needs.setup.outputs.COMMIT_LIST }}
|
||||
run: |
|
||||
COMPONENT='${{ matrix.wazuh_component }}'
|
||||
WAZUH_COMPONENTS='${{ needs.setup.outputs.WAZUH_COMPONENTS }}'
|
||||
COMMIT_LIST='${{ needs.setup.outputs.COMMIT_LIST }}'
|
||||
|
||||
idx=$(jq -r --arg c "$COMPONENT" 'index($c)' <<<"$WAZUH_COMPONENTS")
|
||||
ref=$(jq -r --argjson i "$idx" '.[ $i ]' <<<"$COMMIT_LIST")
|
||||
|
||||
@@ -356,9 +350,6 @@ jobs:
|
||||
echo "Using component ref for $COMPONENT: $ref"
|
||||
|
||||
- name: Build Wazuh images
|
||||
env:
|
||||
DEV: ${{ inputs.dev }}
|
||||
WAZUH_COMPONENT: ${{ matrix.wazuh_component }}
|
||||
run: |
|
||||
if [[ "$IMAGE_TAG" == *"-"* ]]; then
|
||||
IFS='-' read -r -a tokens <<< "$IMAGE_TAG"
|
||||
@@ -368,7 +359,7 @@ jobs:
|
||||
fi
|
||||
DEV_STAGE=${tokens[1]}
|
||||
WAZUH_VER=${tokens[0]}
|
||||
if [ "$DEV" = true ]; then
|
||||
if [ "${{ inputs.dev }}" = true ]; then
|
||||
./build-images.sh \
|
||||
-v $WAZUH_VER \
|
||||
-d $DEV_STAGE \
|
||||
@@ -376,30 +367,30 @@ jobs:
|
||||
-m \
|
||||
--dev \
|
||||
-refs "$COMPONENT_REFS_JSON" \
|
||||
-c $WAZUH_COMPONENT
|
||||
-c ${{ matrix.wazuh_component }}
|
||||
else
|
||||
./build-images.sh \
|
||||
-v $WAZUH_VER \
|
||||
-d $DEV_STAGE \
|
||||
-rg $IMAGE_REGISTRY \
|
||||
-m \
|
||||
-c $WAZUH_COMPONENT
|
||||
-c ${{ matrix.wazuh_component }}
|
||||
fi
|
||||
else
|
||||
if [ "$DEV" = true ]; then
|
||||
if [ "${{ inputs.dev }}" = true ]; then
|
||||
./build-images.sh \
|
||||
-v $IMAGE_TAG \
|
||||
-rg $IMAGE_REGISTRY \
|
||||
-m \
|
||||
--dev \
|
||||
-refs "$COMPONENT_REFS_JSON" \
|
||||
-c $WAZUH_COMPONENT
|
||||
-c ${{ matrix.wazuh_component }}
|
||||
else
|
||||
./build-images.sh \
|
||||
-v $IMAGE_TAG \
|
||||
-rg $IMAGE_REGISTRY \
|
||||
-m \
|
||||
-c $WAZUH_COMPONENT
|
||||
-c ${{ matrix.wazuh_component }}
|
||||
fi
|
||||
fi
|
||||
# Save .env file (generated by build-images.sh) contents to $GITHUB_ENV
|
||||
@@ -417,7 +408,7 @@ jobs:
|
||||
|
||||
|
||||
notify:
|
||||
runs-on: codebuild-github-actions-codebuild-runner-devops-amd-${{ github.run_id }}-${{ github.run_attempt }}
|
||||
runs-on: ubuntu-22.04
|
||||
needs: [setup, build-and-push]
|
||||
# Only run if NOT dev AND all products were selected
|
||||
if: ${{ inputs.dev == false && needs.setup.outputs.ALL_PRODUCTS_SELECTED == 'true' }}
|
||||
@@ -425,10 +416,9 @@ jobs:
|
||||
steps:
|
||||
- name: Image exists validation
|
||||
id: validation
|
||||
env:
|
||||
IMAGE_TAG: ${{ inputs.image_tag }}
|
||||
IMAGE_REGISTRY: ${{ vars.IMAGE_REGISTRY_PROD }}
|
||||
run: |
|
||||
IMAGE_TAG=${{ inputs.image_tag }}
|
||||
IMAGE_REGISTRY="${{ vars.IMAGE_REGISTRY_PROD }}"
|
||||
PURPOSE=""
|
||||
|
||||
if [[ "$IMAGE_TAG" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
|
||||
@@ -453,9 +443,9 @@ jobs:
|
||||
if: ${{ steps.validation.outputs.purpose != '' }}
|
||||
env:
|
||||
GH_TOKEN: ${{ secrets.NOTIFICATION_GH_ARTIFACT_TOKEN }}
|
||||
IMAGE_TAG: ${{ inputs.image_tag }}
|
||||
PURPOSE: ${{ steps.validation.outputs.purpose }}
|
||||
run: |
|
||||
IMAGE_TAG=${{ inputs.image_tag }}
|
||||
PURPOSE="${{ steps.validation.outputs.purpose }}"
|
||||
|
||||
GH_TITLE=""
|
||||
GH_MESSAGE=""
|
||||
+1
-1
@@ -12,7 +12,7 @@ multi-node/wazuh-certificates/*
|
||||
multi-node/wazuh-certificates-tool.log
|
||||
multi-node/wazuh-certs-tool*.sh
|
||||
multi-node/config*.yml
|
||||
multi-node/config/*/certs
|
||||
multi-node/config/wazuh*
|
||||
|
||||
# Documentation
|
||||
docs/book/
|
||||
|
||||
+995
-81
File diff suppressed because it is too large
Load Diff
+8
-19
@@ -1,6 +1,6 @@
|
||||
# Wazuh Open Source Project Security Policy
|
||||
|
||||
Version: 2026-07-06
|
||||
Version: 2023-06-12
|
||||
|
||||
## Introduction
|
||||
This document outlines the Security Policy for Wazuh's open source projects. It emphasizes our commitment to maintain a secure environment for our users and contributors, and reflects our belief in the power of collaboration to identify and resolve security vulnerabilities.
|
||||
@@ -13,27 +13,16 @@ If you believe you've discovered a potential security vulnerability in one of ou
|
||||
|
||||
Please submit your findings as security advisories under the "Security" tab in the relevant GitHub repository. Alternatively, you may send the details of your findings to [security@wazuh.com](mailto:security@wazuh.com).
|
||||
|
||||
## Reporting Vulnerabilities in Non-GA Versions
|
||||
|
||||
Wazuh publishes pre-release versions (Alphas, Betas, and Release Candidates) of its open source projects ahead of General Availability (GA) to gather community feedback. If you discover a potential security vulnerability in one of these non-GA versions, please report it following the process described above.
|
||||
|
||||
Upon receiving such a report, we will determine whether the vulnerability:
|
||||
|
||||
- **Affects only non-GA version(s)**: We will manage the report privately by opening a GitHub Security Advisory (GHSA). Since the affected code has not been part of a GA release, the vulnerability is not eligible for a CVE ID, consistent with the [CNA Operational Rules](https://www.cve.org/ResourcesSupport/AllResources/CNARules). Once resolved, the GHSA will be converted into a public issue instead of a security advisory.
|
||||
- **Also affects a previously released GA version**: We will continue managing the report as a GHSA and evaluate requesting a CVE ID for the GA-affected versions, in accordance with the eligibility criteria in the CNA Operational Rules.
|
||||
|
||||
## Vulnerability Disclosure Policy
|
||||
Upon receiving a report of a potential vulnerability, our team will initiate an investigation. If the reported issue is confirmed as a vulnerability, we will take the following steps:
|
||||
|
||||
1. **Acknowledgment**: We will acknowledge the receipt of your vulnerability report and begin our investigation.
|
||||
2. **Validation**: We will validate the issue and work on reproducing it in our environment.
|
||||
3. **Remediation**: We will develop a fix, have it reviewed, and merge it once thoroughly tested.
|
||||
4. **Release**: We will publish a security release for the affected project that includes the fix.
|
||||
5. **Rollout**: We will confirm that the fix has been applied to environments managed by Wazuh before proceeding with disclosure.
|
||||
6. **Disclosure**: Once the fix has been released and confirmed in managed environments, we will publicly disclose the vulnerability by publishing a CVE (Common Vulnerabilities and Exposures), where applicable, and acknowledging the discovering party.
|
||||
7. **Exceptions**: In order to preserve the security of the Wazuh community at large, we might extend the disclosure period to allow users to patch their deployments.
|
||||
1. Acknowledgment: We will acknowledge the receipt of your vulnerability report and begin our investigation.
|
||||
2. Validation: We will validate the issue and work on reproducing it in our environment.
|
||||
3. Remediation: We will work on a fix and thoroughly test it
|
||||
4. Release & Disclosure: After 90 days from the discovery of the vulnerability, or as soon as a fix is ready and thoroughly tested (whichever comes first), we will release a security update for the affected project. We will also publicly disclose the vulnerability by publishing a CVE (Common Vulnerabilities and Exposures) and acknowledging the discovering party.
|
||||
5. Exceptions: In order to preserve the security of the Wazuh community at large, we might extend the disclosure period to allow users to patch their deployments.
|
||||
|
||||
Steps 1 through 6 will be completed within 90 days from the report of the vulnerability. This period allows for end-users to update their systems and minimizes the risk of widespread exploitation of the vulnerability.
|
||||
This 90-day period allows for end-users to update their systems and minimizes the risk of widespread exploitation of the vulnerability.
|
||||
|
||||
## Automatic Scanning
|
||||
We leverage GitHub Actions to perform automated scans of our supply chain. These scans assist us in identifying vulnerabilities and outdated dependencies in a proactive and timely manner.
|
||||
@@ -53,4 +42,4 @@ We ask that all users and contributors respect this policy and the security of o
|
||||
## Changes to this Security Policy
|
||||
This policy may be revised from time to time. Each version of the policy will be identified at the top of the page by its effective date.
|
||||
|
||||
If you have any questions about this Security Policy, please contact us at [security@wazuh.com](mailto:security@wazuh.com)
|
||||
If you have any questions about this Security Policy, please contact us at [security@wazuh.com](mailto:security@wazuh.com)
|
||||
|
||||
+3
-3
@@ -1,4 +1,4 @@
|
||||
{
|
||||
"version": "5.0.0",
|
||||
"stage": "rc1"
|
||||
}
|
||||
"version": "5.1.0",
|
||||
"stage": "alpha0"
|
||||
}
|
||||
@@ -47,8 +47,6 @@ build() {
|
||||
WAZUH_STAGE=$(jq -r '.stage' ../VERSION.json)
|
||||
# ARTIFACT_URLS_FILE: The name of the artifact URLs file.
|
||||
ARTIFACT_URLS_FILE="artifact_urls.yaml"
|
||||
# ARTIFACT_URLS_DIR: The name of the artifact URLs directory.
|
||||
ARTIFACT_URLS_DIR="artifact-urls"
|
||||
|
||||
# Check if the artifact file already exists to prevent redundant downloads
|
||||
if [[ -f "$ARTIFACT_URLS_FILE" ]]; then
|
||||
@@ -94,7 +92,7 @@ build() {
|
||||
|
||||
# Final download using dynamic variables based on the release type.
|
||||
# Pattern: server / stage / major_version.x / filename
|
||||
FULL_URL="https://${PACKAGE_URL}/${RELEASE_STAGE}/${WAZUH_MAJOR_VERSION}.x/${ARTIFACT_URLS_DIR}/${ARTIFACT_URLS_DOWNLOAD}"
|
||||
FULL_URL="https://${PACKAGE_URL}/${RELEASE_STAGE}/${WAZUH_MAJOR_VERSION}.x/${ARTIFACT_URLS_DOWNLOAD}"
|
||||
echo "Attempting to download: $FULL_URL"
|
||||
curl -fsSL -o "$ARTIFACT_URLS_FILE" "$FULL_URL" || {
|
||||
echo "Error: Failed to download artifact URLs from $FULL_URL" >&2
|
||||
@@ -166,23 +164,52 @@ build() {
|
||||
fi
|
||||
|
||||
|
||||
# Write the global .env file used by deployment compose files.
|
||||
# IMAGE_TAG here reflects a non-dev, non-per-component tag for reference.
|
||||
local base_tag="${WAZUH_IMAGE_VERSION}${WAZUH_DEV_STAGE:+-${WAZUH_DEV_STAGE,,}}"
|
||||
# Function to get component-specific commit reference
|
||||
get_component_commit() {
|
||||
local component=$1
|
||||
case "${component}" in
|
||||
wazuh-indexer)
|
||||
echo "${INDEXER_COMMIT}"
|
||||
;;
|
||||
wazuh-manager)
|
||||
echo "${MANAGER_COMMIT}"
|
||||
;;
|
||||
wazuh-dashboard)
|
||||
echo "${DASHBOARD_COMMIT}"
|
||||
;;
|
||||
wazuh-agent)
|
||||
echo "${AGENT_COMMIT}"
|
||||
;;
|
||||
*)
|
||||
echo ""
|
||||
;;
|
||||
esac
|
||||
}
|
||||
|
||||
# Global env file (without IMAGE_TAG - will be component-specific)
|
||||
echo WAZUH_VERSION=$WAZUH_IMAGE_VERSION > ../.env
|
||||
echo WAZUH_IMAGE_VERSION=$WAZUH_IMAGE_VERSION >> ../.env
|
||||
echo WAZUH_REGISTRY=$WAZUH_REGISTRY >> ../.env
|
||||
echo IMAGE_TAG=${base_tag} >> ../.env
|
||||
|
||||
set -a
|
||||
source ../.env
|
||||
source ./artifacts_env.txt
|
||||
set +a
|
||||
|
||||
# Validate component if a specific one was requested.
|
||||
if [ -n "${WAZUH_COMPONENT}" ]; then
|
||||
# Define all available components
|
||||
local all_components=("wazuh-indexer" "wazuh-manager" "wazuh-dashboard" "wazuh-agent")
|
||||
local components_to_build=()
|
||||
|
||||
# Determine which components to build
|
||||
if [ -z "${WAZUH_COMPONENT}" ]; then
|
||||
echo "No component specified. Building all components..."
|
||||
components_to_build=("${all_components[@]}")
|
||||
else
|
||||
# Validate component
|
||||
case "${WAZUH_COMPONENT}" in
|
||||
wazuh-indexer|wazuh-manager|wazuh-dashboard|wazuh-agent) ;;
|
||||
wazuh-indexer|wazuh-manager|wazuh-dashboard|wazuh-agent)
|
||||
components_to_build=("${WAZUH_COMPONENT}")
|
||||
;;
|
||||
*)
|
||||
echo "Error: Unknown component '${WAZUH_COMPONENT}'" >&2
|
||||
clean 1
|
||||
@@ -190,51 +217,77 @@ build() {
|
||||
esac
|
||||
fi
|
||||
|
||||
# Generate per-component image tags.
|
||||
# The commit suffix is only appended when --dev is passed. This ensures:
|
||||
# dev=false, tag=5.0.0 → 5.0.0
|
||||
# dev=false, tag=5.0.0-beta1 → 5.0.0-beta1
|
||||
# dev=true, tag=5.0.0 → 5.0.0-latest
|
||||
# dev=true, tag=5.0.0-beta1 → 5.0.0-beta1-latest
|
||||
make_tag() {
|
||||
local commit=$1
|
||||
if [ -n "${IS_DEV_BUILD}" ]; then
|
||||
echo "${WAZUH_IMAGE_VERSION}${WAZUH_DEV_STAGE:+-${WAZUH_DEV_STAGE,,}}-${commit}"
|
||||
else
|
||||
echo "${base_tag}"
|
||||
fi
|
||||
}
|
||||
|
||||
export WAZUH_VERSION="$WAZUH_IMAGE_VERSION"
|
||||
export MULTIARCH="${MULTIARCH}"
|
||||
export INDEXER_TAG=$(make_tag "${INDEXER_COMMIT:-latest}")
|
||||
export MANAGER_TAG=$(make_tag "${MANAGER_COMMIT:-latest}")
|
||||
export DASHBOARD_TAG=$(make_tag "${DASHBOARD_COMMIT:-latest}")
|
||||
export AGENT_TAG=$(make_tag "${AGENT_COMMIT:-latest}")
|
||||
|
||||
echo "Image tags:"
|
||||
echo " wazuh-indexer: ${WAZUH_REGISTRY}/wazuh/wazuh-indexer:${INDEXER_TAG}"
|
||||
echo " wazuh-manager: ${WAZUH_REGISTRY}/wazuh/wazuh-manager:${MANAGER_TAG}"
|
||||
echo " wazuh-dashboard: ${WAZUH_REGISTRY}/wazuh/wazuh-dashboard:${DASHBOARD_TAG}"
|
||||
echo " wazuh-agent: ${WAZUH_REGISTRY}/wazuh/wazuh-agent:${AGENT_TAG}"
|
||||
|
||||
# Bake options: --push for multi-arch (can't load multi-platform locally),
|
||||
# --load for single-arch (stores image in local Docker daemon).
|
||||
local bake_opts="--no-cache"
|
||||
# Determine build command and base options
|
||||
if [ "${MULTIARCH}" ]; then
|
||||
bake_opts="${bake_opts} --push"
|
||||
build_cmd="docker buildx build --platform linux/amd64,linux/arm64 --push --no-cache"
|
||||
else
|
||||
bake_opts="${bake_opts} --load"
|
||||
build_cmd="docker build --no-cache"
|
||||
fi
|
||||
|
||||
# Build a specific component or the full default group (all 4 in parallel).
|
||||
if [ -z "${WAZUH_COMPONENT}" ]; then
|
||||
echo "Building all components in parallel..."
|
||||
docker buildx bake ${bake_opts} -f docker-bake.hcl || clean 1
|
||||
else
|
||||
echo "Building ${WAZUH_COMPONENT}..."
|
||||
docker buildx bake ${bake_opts} -f docker-bake.hcl "${WAZUH_COMPONENT}" || clean 1
|
||||
fi
|
||||
# Build each component
|
||||
for component in "${components_to_build[@]}"; do
|
||||
echo "Building ${component} image..."
|
||||
|
||||
# Get component-specific commit reference
|
||||
COMPONENT_COMMIT=$(get_component_commit "${component}")
|
||||
|
||||
# Generate component-specific IMAGE_TAG.
|
||||
# The commit suffix is only appended when --dev was passed, which maps
|
||||
# directly to inputs.dev=true in the workflow. This ensures:
|
||||
# dev=false, tag=5.0.0 → 5.0.0
|
||||
# dev=false, tag=5.0.0-beta1 → 5.0.0-beta1
|
||||
# dev=true, tag=5.0.0 → 5.0.0-latest
|
||||
# dev=true, tag=5.0.0-beta1 → 5.0.0-beta1-latest
|
||||
if [ -n "${IS_DEV_BUILD}" ]; then
|
||||
IMAGE_TAG="${WAZUH_IMAGE_VERSION}${WAZUH_DEV_STAGE:+-${WAZUH_DEV_STAGE,,}}-${COMPONENT_COMMIT}"
|
||||
else
|
||||
IMAGE_TAG="${WAZUH_IMAGE_VERSION}${WAZUH_DEV_STAGE:+-${WAZUH_DEV_STAGE,,}}"
|
||||
fi
|
||||
echo "Using IMAGE_TAG: ${IMAGE_TAG} for ${component}"
|
||||
export IMAGE_TAG="$IMAGE_TAG"
|
||||
|
||||
# Build common args (used by all components)
|
||||
build_args=(
|
||||
-t "${WAZUH_REGISTRY}/wazuh/${component}:${IMAGE_TAG}"
|
||||
--build-arg WAZUH_VERSION="${WAZUH_IMAGE_VERSION}"
|
||||
)
|
||||
|
||||
# Add component-specific args
|
||||
case "${component}" in
|
||||
wazuh-indexer)
|
||||
build_args+=(
|
||||
--build-arg wazuh_indexer_x86_64_rpm="${wazuh_indexer_x86_64_rpm}"
|
||||
--build-arg wazuh_indexer_aarch64_rpm="${wazuh_indexer_aarch64_rpm}"
|
||||
--build-arg wazuh_certs_tool="${wazuh_certs_tool}"
|
||||
--build-arg wazuh_config_yml="${wazuh_config_yml}"
|
||||
)
|
||||
;;
|
||||
wazuh-manager)
|
||||
build_args+=(
|
||||
--build-arg wazuh_manager_x86_64_rpm="${wazuh_manager_x86_64_rpm}"
|
||||
--build-arg wazuh_manager_aarch64_rpm="${wazuh_manager_aarch64_rpm}"
|
||||
)
|
||||
;;
|
||||
wazuh-dashboard)
|
||||
build_args+=(
|
||||
--build-arg wazuh_dashboard_x86_64_rpm="${wazuh_dashboard_x86_64_rpm}"
|
||||
--build-arg wazuh_dashboard_aarch64_rpm="${wazuh_dashboard_aarch64_rpm}"
|
||||
--build-arg wazuh_certs_tool="${wazuh_certs_tool}"
|
||||
--build-arg wazuh_config_yml="${wazuh_config_yml}"
|
||||
)
|
||||
;;
|
||||
wazuh-agent)
|
||||
build_args+=(
|
||||
--build-arg wazuh_agent_x86_64_rpm="${wazuh_agent_x86_64_rpm}"
|
||||
--build-arg wazuh_agent_aarch64_rpm="${wazuh_agent_aarch64_rpm}"
|
||||
)
|
||||
;;
|
||||
esac
|
||||
|
||||
# Execute build
|
||||
$build_cmd "${build_args[@]}" ${component}/ || clean 1
|
||||
echo "${component} image built successfully!"
|
||||
done
|
||||
|
||||
echo ""
|
||||
echo "Image build process completed!"
|
||||
|
||||
@@ -0,0 +1,98 @@
|
||||
# Wazuh App Copyright (C) 2017, Wazuh Inc. (License GPLv2)
|
||||
services:
|
||||
wazuh.manager:
|
||||
build:
|
||||
context: wazuh-manager/
|
||||
args:
|
||||
WAZUH_VERSION: ${WAZUH_VERSION}
|
||||
wazuh_manager_x86_64_rpm: ${wazuh_manager_x86_64_rpm}
|
||||
wazuh_manager_aarch64_rpm: ${wazuh_manager_aarch64_rpm}
|
||||
wazuh_certs_tool: ${wazuh_certs_tool}
|
||||
wazuh_config_yml: ${wazuh_config_yml}
|
||||
image: ${WAZUH_REGISTRY}/wazuh/wazuh-manager:${IMAGE_TAG}
|
||||
hostname: wazuh.manager
|
||||
restart: always
|
||||
ports:
|
||||
- "1514:1514"
|
||||
- "1515:1515"
|
||||
- "514:514/udp"
|
||||
- "55000:55000"
|
||||
environment:
|
||||
- INDEXER_URL=https://wazuh.indexer:9200
|
||||
- INDEXER_USERNAME=admin
|
||||
- INDEXER_PASSWORD=admin
|
||||
volumes:
|
||||
- wazuh_api_configuration:/var/wazuh-manager/api/configuration
|
||||
- wazuh_etc:/var/wazuh-manager/etc
|
||||
- wazuh_logs:/var/wazuh-manager/logs
|
||||
- wazuh_queue:/var/wazuh-manager/queue
|
||||
- wazuh_var_multigroups:/var/wazuh-manager/var/multigroups
|
||||
|
||||
wazuh.agent:
|
||||
build:
|
||||
context: wazuh-agent/
|
||||
args:
|
||||
WAZUH_VERSION: ${WAZUH_VERSION}
|
||||
wazuh_agent_x86_64_rpm: ${wazuh_agent_x86_64_rpm}
|
||||
wazuh_agent_aarch64_rpm: ${wazuh_agent_aarch64_rpm}
|
||||
image: ${WAZUH_REGISTRY}/wazuh/wazuh-agent:${IMAGE_TAG}
|
||||
hostname: wazuh.agent
|
||||
restart: always
|
||||
|
||||
wazuh.indexer:
|
||||
build:
|
||||
context: wazuh-indexer/
|
||||
args:
|
||||
WAZUH_VERSION: ${WAZUH_VERSION}
|
||||
wazuh_indexer_x86_64_rpm: ${wazuh_indexer_x86_64_rpm}
|
||||
wazuh_indexer_aarch64_rpm: ${wazuh_indexer_aarch64_rpm}
|
||||
wazuh_certs_tool: ${wazuh_certs_tool}
|
||||
wazuh_config_yml: ${wazuh_config_yml}
|
||||
image: ${WAZUH_REGISTRY}/wazuh/wazuh-indexer:${IMAGE_TAG}
|
||||
hostname: wazuh.indexer
|
||||
restart: always
|
||||
ports:
|
||||
- "9200:9200"
|
||||
environment:
|
||||
- "OPENSEARCH_JAVA_OPTS=-Xms512m -Xmx512m"
|
||||
ulimits:
|
||||
memlock:
|
||||
soft: -1
|
||||
hard: -1
|
||||
nofile:
|
||||
soft: 65536
|
||||
hard: 65536
|
||||
|
||||
wazuh.dashboard:
|
||||
build:
|
||||
context: wazuh-dashboard/
|
||||
args:
|
||||
WAZUH_VERSION: ${WAZUH_VERSION}
|
||||
wazuh_dashboard_x86_64_rpm: ${wazuh_dashboard_x86_64_rpm}
|
||||
wazuh_dashboard_aarch64_rpm: ${wazuh_dashboard_aarch64_rpm}
|
||||
wazuh_certs_tool: ${wazuh_certs_tool}
|
||||
wazuh_config_yml: ${wazuh_config_yml}
|
||||
image: ${WAZUH_REGISTRY}/wazuh/wazuh-dashboard:${IMAGE_TAG}
|
||||
hostname: wazuh.dashboard
|
||||
restart: always
|
||||
ports:
|
||||
- 443:443
|
||||
environment:
|
||||
- INDEXER_USERNAME=admin
|
||||
- INDEXER_PASSWORD=admin
|
||||
- SERVER_SSL_ENABLED=false
|
||||
- WAZUH_API_URL=https://wazuh.manager
|
||||
depends_on:
|
||||
- wazuh.indexer
|
||||
links:
|
||||
- wazuh.indexer:wazuh.indexer
|
||||
- wazuh.manager:wazuh.manager
|
||||
|
||||
volumes:
|
||||
wazuh_api_configuration:
|
||||
wazuh_etc:
|
||||
wazuh_logs:
|
||||
wazuh_queue:
|
||||
wazuh_var_multigroups:
|
||||
wazuh_active_response:
|
||||
|
||||
@@ -1,110 +0,0 @@
|
||||
# Wazuh Docker Copyright (C) 2017, Wazuh Inc. (License GPLv2)
|
||||
#
|
||||
# Docker Buildx Bake file.
|
||||
# Builds all Wazuh component images in parallel.
|
||||
#
|
||||
# Usage:
|
||||
# docker buildx bake # build all (local, single-arch)
|
||||
# docker buildx bake wazuh-manager # build one component
|
||||
# docker buildx bake --push # push to registry after build
|
||||
#
|
||||
# Variables are read automatically from the environment (see build-images.sh).
|
||||
|
||||
# ── Global variables ──────────────────────────────────────────────────────────
|
||||
|
||||
variable "WAZUH_VERSION" { default = "5.0.0" }
|
||||
variable "WAZUH_REGISTRY" { default = "docker.io" }
|
||||
|
||||
# Set IMAGE_TAG externally to override; defaults to WAZUH_VERSION.
|
||||
variable "IMAGE_TAG" { default = WAZUH_VERSION }
|
||||
|
||||
# MULTIARCH: set to a non-empty value to build linux/amd64 + linux/arm64.
|
||||
variable "MULTIARCH" { default = "" }
|
||||
|
||||
# Per-component tags — all default to IMAGE_TAG.
|
||||
# In dev builds the shell script sets each one independently to append the
|
||||
# per-component commit ref (e.g. MANAGER_TAG=5.0.0-beta1-abc1234).
|
||||
variable "INDEXER_TAG" { default = IMAGE_TAG }
|
||||
variable "MANAGER_TAG" { default = IMAGE_TAG }
|
||||
variable "DASHBOARD_TAG" { default = IMAGE_TAG }
|
||||
variable "AGENT_TAG" { default = IMAGE_TAG }
|
||||
|
||||
# ── Artifact URL variables ────────────────────────────────────────────────────
|
||||
# Populated by build-images.sh from artifacts_env.txt (sourced into env).
|
||||
|
||||
variable "wazuh_indexer_x86_64_rpm" { default = "" }
|
||||
variable "wazuh_indexer_aarch64_rpm" { default = "" }
|
||||
variable "wazuh_manager_x86_64_rpm" { default = "" }
|
||||
variable "wazuh_manager_aarch64_rpm" { default = "" }
|
||||
variable "wazuh_dashboard_x86_64_rpm" { default = "" }
|
||||
variable "wazuh_dashboard_aarch64_rpm" { default = "" }
|
||||
variable "wazuh_agent_x86_64_rpm" { default = "" }
|
||||
variable "wazuh_agent_aarch64_rpm" { default = "" }
|
||||
variable "wazuh_certs_tool" { default = "" }
|
||||
variable "wazuh_config_yml" { default = "" }
|
||||
|
||||
# ── Default group: builds all components ─────────────────────────────────────
|
||||
|
||||
group "default" {
|
||||
targets = ["wazuh-indexer", "wazuh-manager", "wazuh-dashboard", "wazuh-agent"]
|
||||
}
|
||||
|
||||
# ── Shared base target ────────────────────────────────────────────────────────
|
||||
# All component targets inherit from here. Not built directly.
|
||||
|
||||
target "_common" {
|
||||
# MULTIARCH=true → build linux/amd64 + linux/arm64 (requires --push, no --load for multi-platform)
|
||||
# MULTIARCH unset → null means "native platform of the build host" (amd64 on x86, arm64 on ARM)
|
||||
platforms = MULTIARCH != "" ? ["linux/amd64", "linux/arm64"] : null
|
||||
args = {
|
||||
WAZUH_VERSION = WAZUH_VERSION
|
||||
}
|
||||
}
|
||||
|
||||
# ── Component targets ─────────────────────────────────────────────────────────
|
||||
|
||||
target "wazuh-indexer" {
|
||||
inherits = ["_common"]
|
||||
context = "wazuh-indexer/"
|
||||
tags = ["${WAZUH_REGISTRY}/wazuh/wazuh-indexer:${INDEXER_TAG}"]
|
||||
args = {
|
||||
wazuh_indexer_x86_64_rpm = wazuh_indexer_x86_64_rpm
|
||||
wazuh_indexer_aarch64_rpm = wazuh_indexer_aarch64_rpm
|
||||
wazuh_certs_tool = wazuh_certs_tool
|
||||
wazuh_config_yml = wazuh_config_yml
|
||||
}
|
||||
}
|
||||
|
||||
target "wazuh-manager" {
|
||||
inherits = ["_common"]
|
||||
context = "wazuh-manager/"
|
||||
tags = ["${WAZUH_REGISTRY}/wazuh/wazuh-manager:${MANAGER_TAG}"]
|
||||
args = {
|
||||
wazuh_manager_x86_64_rpm = wazuh_manager_x86_64_rpm
|
||||
wazuh_manager_aarch64_rpm = wazuh_manager_aarch64_rpm
|
||||
wazuh_certs_tool = wazuh_certs_tool
|
||||
wazuh_config_yml = wazuh_config_yml
|
||||
}
|
||||
}
|
||||
|
||||
target "wazuh-dashboard" {
|
||||
inherits = ["_common"]
|
||||
context = "wazuh-dashboard/"
|
||||
tags = ["${WAZUH_REGISTRY}/wazuh/wazuh-dashboard:${DASHBOARD_TAG}"]
|
||||
args = {
|
||||
wazuh_dashboard_x86_64_rpm = wazuh_dashboard_x86_64_rpm
|
||||
wazuh_dashboard_aarch64_rpm = wazuh_dashboard_aarch64_rpm
|
||||
wazuh_certs_tool = wazuh_certs_tool
|
||||
wazuh_config_yml = wazuh_config_yml
|
||||
}
|
||||
}
|
||||
|
||||
target "wazuh-agent" {
|
||||
inherits = ["_common"]
|
||||
context = "wazuh-agent/"
|
||||
tags = ["${WAZUH_REGISTRY}/wazuh/wazuh-agent:${AGENT_TAG}"]
|
||||
args = {
|
||||
wazuh_agent_x86_64_rpm = wazuh_agent_x86_64_rpm
|
||||
wazuh_agent_aarch64_rpm = wazuh_agent_aarch64_rpm
|
||||
}
|
||||
}
|
||||
@@ -1,82 +1,34 @@
|
||||
# Wazuh Docker Copyright (C) 2017, Wazuh Inc. (License GPLv2)
|
||||
FROM amazonlinux:2023
|
||||
|
||||
################################################################################
|
||||
# Build stage 0 (builder):
|
||||
# Install Wazuh Agent RPM and download tini (static PID-1 init shim).
|
||||
################################################################################
|
||||
FROM amazonlinux:2023 AS builder
|
||||
RUN rm /bin/sh && ln -s /bin/bash /bin/sh
|
||||
|
||||
ARG WAZUH_VERSION
|
||||
ARG TINI_VERSION="v0.19.0"
|
||||
ARG S6_VERSION="v2.2.0.3"
|
||||
ARG WAZUH_MANAGER='CHANGE_MANAGER_IP'
|
||||
ARG WAZUH_REGISTRATION_SERVER='CHANGE_ENROLL_IP'
|
||||
ARG WAZUH_AGENT_NAME='CHANGE_AGENT_NAME'
|
||||
ARG TARGETARCH
|
||||
ARG wazuh_agent_x86_64_rpm
|
||||
ARG wazuh_agent_aarch64_rpm
|
||||
ARG WAZUH_UID=101
|
||||
ARG WAZUH_GID=101
|
||||
|
||||
# Install only runtime dependencies
|
||||
RUN dnf install procps shadow-utils -y && \
|
||||
dnf clean all && \
|
||||
getent group wazuh || groupadd -r -g ${WAZUH_GID} wazuh && \
|
||||
getent passwd wazuh || useradd --system \
|
||||
--no-create-home \
|
||||
--home-dir /var/ossec \
|
||||
--uid ${WAZUH_UID} \
|
||||
--gid ${WAZUH_GID} \
|
||||
--shell /sbin/nologin \
|
||||
wazuh && \
|
||||
RPM_ARCH="x86_64" && \
|
||||
RUN RPM_ARCH="x86_64" && \
|
||||
if [ "${TARGETARCH}" = "arm64" ]; then RPM_ARCH="aarch64"; fi && \
|
||||
URL_VAR="wazuh_agent_${RPM_ARCH}_rpm" && \
|
||||
agent_url="${!URL_VAR}" && \
|
||||
dnf install curl-minimal tar gzip procps shadow-utils -y && \
|
||||
dnf install curl-minimal tar gzip procps -y &&\
|
||||
curl -o /wazuh-agent.rpm "${agent_url}" && \
|
||||
dnf install /wazuh-agent.rpm -y && \
|
||||
rm -rf /wazuh-agent.rpm && \
|
||||
dnf clean all
|
||||
|
||||
# Download tini static binary (no external library dependencies)
|
||||
RUN curl --fail --silent -L \
|
||||
https://github.com/krallin/tini/releases/download/${TINI_VERSION}/tini-static-${TARGETARCH} \
|
||||
-o /usr/local/bin/tini && \
|
||||
chmod +x /usr/local/bin/tini
|
||||
|
||||
################################################################################
|
||||
# Build stage 1 (the actual Wazuh Agent image):
|
||||
# Copy Wazuh Agent and tini from builder. Install only runtime dependencies.
|
||||
################################################################################
|
||||
FROM amazonlinux:2023
|
||||
|
||||
ARG WAZUH_UID=101
|
||||
ARG WAZUH_GID=101
|
||||
|
||||
RUN rm /bin/sh && ln -s /bin/bash /bin/sh
|
||||
|
||||
# Install only runtime dependencies
|
||||
RUN dnf install procps shadow-utils -y && \
|
||||
dnf clean all && \
|
||||
getent group wazuh || groupadd -r -g ${WAZUH_GID} wazuh && \
|
||||
getent passwd wazuh || useradd --system \
|
||||
--no-create-home \
|
||||
--home-dir /var/ossec \
|
||||
--uid ${WAZUH_UID} \
|
||||
--gid ${WAZUH_GID} \
|
||||
--shell /sbin/nologin \
|
||||
wazuh
|
||||
|
||||
# Copy Wazuh Agent installation from builder
|
||||
COPY --from=builder /var/ossec /var/ossec
|
||||
|
||||
# Copy tini static binary
|
||||
COPY --from=builder /usr/local/bin/tini /usr/local/bin/tini
|
||||
|
||||
# Copy entrypoint and init scripts
|
||||
COPY config/entrypoint.sh /entrypoint.sh
|
||||
sed -i '/<authorization_pass_path>/d' /var/ossec/etc/ossec.conf && \
|
||||
S6_ARCH="amd64" && \
|
||||
if [ "${TARGETARCH}" = "arm64" ]; then S6_ARCH="aarch64"; fi && \
|
||||
curl --fail --silent -L https://github.com/just-containers/s6-overlay/releases/download/${S6_VERSION}/s6-overlay-${S6_ARCH}.tar.gz \
|
||||
-o /tmp/s6-overlay-${S6_ARCH}.tar.gz && \
|
||||
tar xzf /tmp/s6-overlay-${S6_ARCH}.tar.gz -C / --exclude="./bin" && \
|
||||
tar xzf /tmp/s6-overlay-${S6_ARCH}.tar.gz -C /usr ./bin && \
|
||||
rm /tmp/s6-overlay-${S6_ARCH}.tar.gz
|
||||
COPY config/etc/ /etc/
|
||||
|
||||
RUN chmod 755 /entrypoint.sh
|
||||
|
||||
ENTRYPOINT ["/usr/local/bin/tini", "--", "/entrypoint.sh"]
|
||||
ENTRYPOINT [ "/init" ]
|
||||
|
||||
@@ -1,22 +0,0 @@
|
||||
#!/bin/bash
|
||||
# Wazuh Docker Copyright (C) 2017, Wazuh Inc. (License GPLv2)
|
||||
|
||||
# Run initialization and configuration
|
||||
bash /etc/cont-init.d/0-wazuh-init
|
||||
|
||||
# Start Wazuh Agent (may log warnings if manager address is not configured)
|
||||
bash /etc/cont-init.d/1-agent
|
||||
|
||||
# Tail the main log to stdout so Docker captures it
|
||||
tail -F /var/ossec/logs/ossec.log &
|
||||
TAIL_PID=$!
|
||||
|
||||
# Graceful shutdown: stop Wazuh and exit cleanly on SIGTERM/SIGINT
|
||||
_stop() {
|
||||
echo "Stopping Wazuh Agent..."
|
||||
/var/ossec/bin/wazuh-control stop 2>/dev/null || true
|
||||
kill "${TAIL_PID}" 2>/dev/null || true
|
||||
}
|
||||
trap _stop SIGTERM SIGINT SIGQUIT
|
||||
|
||||
wait "${TAIL_PID}"
|
||||
@@ -1,4 +1,4 @@
|
||||
#!/bin/bash
|
||||
#!/usr/bin/with-contenv bash
|
||||
# Wazuh App Copyright (C) 2017, Wazuh Inc. (License GPLv2)
|
||||
|
||||
WAZUH_INSTALL_PATH=/var/ossec
|
||||
@@ -62,15 +62,6 @@ set_manager_conn() {
|
||||
sed -i "s#<address>CHANGE_MANAGER_IP</address>#<address>$WAZUH_MANAGER_SERVER</address>#g" ${WAZUH_INSTALL_PATH}/etc/ossec.conf
|
||||
sed -i "s#<manager_address>CHANGE_ENROLL_IP</manager_address>#<manager_address>$WAZUH_REGISTRATION_SERVER</manager_address>#g" ${WAZUH_INSTALL_PATH}/etc/ossec.conf
|
||||
sed -i "s#<agent_name>CHANGE_AGENT_NAME</agent_name>#<agent_name>$WAZUH_AGENT_NAME</agent_name>#g" ${WAZUH_INSTALL_PATH}/etc/ossec.conf
|
||||
if [ -n "$WAZUH_REGISTRATION_PASSWORD" ]; then
|
||||
set +x
|
||||
cat << EOF > /var/ossec/etc/authd.pass
|
||||
$WAZUH_REGISTRATION_PASSWORD
|
||||
EOF
|
||||
set -x
|
||||
else
|
||||
echo "WAZUH_REGISTRATION_PASSWORD is not set; the authd.pass configuration is omitted."
|
||||
fi
|
||||
}
|
||||
|
||||
##############################################################################
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
#!/bin/bash
|
||||
#!/usr/bin/with-contenv bash
|
||||
|
||||
##############################################################################
|
||||
# Migration sequence
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
#!/bin/sh
|
||||
#!/usr/bin/with-contenv sh
|
||||
|
||||
# dumping ossec.log to standard output
|
||||
exec tail -F /var/ossec/logs/ossec.log
|
||||
|
||||
@@ -7,28 +7,9 @@ ARG TARGETARCH
|
||||
ARG wazuh_dashboard_x86_64_rpm
|
||||
ARG wazuh_dashboard_aarch64_rpm
|
||||
ARG wazuh_config_yml
|
||||
ARG WAZUH_UID=101
|
||||
ARG WAZUH_GID=101
|
||||
|
||||
# Set environment variables
|
||||
ENV USER="wazuh-dashboard" \
|
||||
GROUP="wazuh-dashboard" \
|
||||
NAME="wazuh-dashboard" \
|
||||
INSTALL_DIR="/usr/share/wazuh-dashboard"
|
||||
|
||||
# Update and install dependencies
|
||||
RUN yum install shadow-utils -y && \
|
||||
yum clean all && \
|
||||
getent group $GROUP || groupadd -r -g ${WAZUH_GID} $GROUP && \
|
||||
useradd --system \
|
||||
--uid ${WAZUH_UID} \
|
||||
--no-create-home \
|
||||
--home-dir $INSTALL_DIR \
|
||||
--gid $GROUP \
|
||||
--shell /sbin/nologin \
|
||||
--comment "$USER user" \
|
||||
$USER && \
|
||||
RPM_ARCH="x86_64" && \
|
||||
RUN RPM_ARCH="x86_64" && \
|
||||
if [ "${TARGETARCH}" = "arm64" ]; then RPM_ARCH="aarch64"; fi && \
|
||||
URL_VAR="wazuh_dashboard_${RPM_ARCH}_rpm" && \
|
||||
dashboard_url="${!URL_VAR}" && \
|
||||
@@ -43,18 +24,17 @@ RUN mkdir -p $INSTALL_DIR/data/wazuh && chmod -R 775 $INSTALL_DIR/data/wazuh
|
||||
RUN mkdir -p $INSTALL_DIR/data/wazuh/config && chmod -R 775 $INSTALL_DIR/data/wazuh/config
|
||||
RUN mkdir -p $INSTALL_DIR/data/wazuh/logs && chmod -R 775 $INSTALL_DIR/data/wazuh/logs
|
||||
RUN setcap 'cap_net_bind_service=-ep' /usr/share/wazuh-dashboard/node/bin/node
|
||||
RUN setcap 'cap_net_bind_service=-ep' /usr/share/wazuh-dashboard/node/fallback/bin/node
|
||||
|
||||
################################################################################
|
||||
# Build stage 1 (the current Wazuh dashboard image):
|
||||
# Copy wazuh-dashboard from builder
|
||||
#
|
||||
# Copy wazuh-dashboard from stage 0
|
||||
# Add entrypoint
|
||||
# Add wazuh_dashboard_config
|
||||
################################################################################
|
||||
FROM amazonlinux:2023
|
||||
|
||||
ARG WAZUH_UID=101
|
||||
ARG WAZUH_GID=101
|
||||
|
||||
# Set environment variables
|
||||
ENV USER="wazuh-dashboard" \
|
||||
GROUP="wazuh-dashboard" \
|
||||
@@ -81,25 +61,25 @@ COPY config/wazuh_dashboard_config.sh /
|
||||
# Update and install dependencies
|
||||
RUN yum install shadow-utils -y && \
|
||||
yum clean all && \
|
||||
getent group $GROUP || groupadd -r -g ${WAZUH_GID} $GROUP && \
|
||||
getent group $GROUP || groupadd -r -g 1000 $GROUP && \
|
||||
useradd --system \
|
||||
--uid ${WAZUH_UID} \
|
||||
--no-create-home \
|
||||
--home-dir $INSTALL_DIR \
|
||||
--gid $GROUP \
|
||||
--shell /sbin/nologin \
|
||||
--comment "$USER user" \
|
||||
$USER && \
|
||||
--uid 1000 \
|
||||
--no-create-home \
|
||||
--home-dir $INSTALL_DIR \
|
||||
--gid $GROUP \
|
||||
--shell /sbin/nologin \
|
||||
--comment "$USER user" \
|
||||
$USER && \
|
||||
chmod 700 /entrypoint.sh && \
|
||||
chmod 700 /wazuh_dashboard_config.sh && \
|
||||
mkdir -p $INSTALL_DIR && \
|
||||
chown ${WAZUH_UID}:${WAZUH_GID} $INSTALL_DIR && \
|
||||
chown ${WAZUH_UID}:${WAZUH_GID} /*.sh && \
|
||||
chown 1000:1000 $INSTALL_DIR && \
|
||||
chown 1000:1000 /*.sh && \
|
||||
mkdir -p /usr/share/wazuh-dashboard/plugins/wazuh/public/assets/custom
|
||||
|
||||
# Copy Install dir from builder to current image
|
||||
COPY --from=builder $INSTALL_DIR $INSTALL_DIR
|
||||
COPY --from=builder /etc/wazuh-dashboard $INSTALL_DIR/config/
|
||||
COPY --from=builder --chown=1000:1000 $INSTALL_DIR $INSTALL_DIR
|
||||
COPY --from=builder --chown=1000:1000 /etc/wazuh-dashboard $INSTALL_DIR/config/
|
||||
|
||||
# Set workdir and user
|
||||
WORKDIR $INSTALL_DIR
|
||||
|
||||
@@ -7,28 +7,10 @@ ARG wazuh_indexer_x86_64_rpm
|
||||
ARG wazuh_indexer_aarch64_rpm
|
||||
ARG wazuh_certs_tool
|
||||
ARG wazuh_config_yml
|
||||
ARG WAZUH_UID=101
|
||||
ARG WAZUH_GID=101
|
||||
|
||||
ENV USER="wazuh-indexer" \
|
||||
GROUP="wazuh-indexer" \
|
||||
NAME="wazuh-indexer" \
|
||||
INSTALL_DIR="/usr/share/wazuh-indexer"
|
||||
|
||||
COPY config/config.sh .
|
||||
|
||||
RUN yum install curl-minimal shadow-utils findutils hostname -y && \
|
||||
yum clean all && \
|
||||
getent group $GROUP || groupadd -r -g ${WAZUH_GID} $GROUP && \
|
||||
useradd --system \
|
||||
--uid ${WAZUH_UID} \
|
||||
--no-create-home \
|
||||
--home-dir $INSTALL_DIR \
|
||||
--gid ${WAZUH_GID} \
|
||||
--shell /sbin/nologin \
|
||||
--comment "$USER user" \
|
||||
$USER && \
|
||||
RPM_ARCH="x86_64" && \
|
||||
RUN RPM_ARCH="x86_64" && \
|
||||
if [ "${TARGETARCH}" = "arm64" ]; then RPM_ARCH="aarch64"; fi && \
|
||||
URL_VAR="wazuh_indexer_${RPM_ARCH}_rpm" && \
|
||||
indexer_url="${!URL_VAR}" && \
|
||||
@@ -41,19 +23,16 @@ RUN yum install curl-minimal shadow-utils findutils hostname -y && \
|
||||
|
||||
################################################################################
|
||||
# Build stage 1 (the actual Wazuh indexer image):
|
||||
# Copy wazuh-indexer from builder
|
||||
#
|
||||
# Copy wazuh-indexer from stage 0
|
||||
# Add entrypoint
|
||||
################################################################################
|
||||
FROM amazonlinux:2023
|
||||
|
||||
ARG WAZUH_UID=101
|
||||
ARG WAZUH_GID=101
|
||||
|
||||
ENV USER="wazuh-indexer" \
|
||||
GROUP="wazuh-indexer" \
|
||||
NAME="wazuh-indexer" \
|
||||
INSTALL_DIR="/usr/share/wazuh-indexer"
|
||||
ENV ENGINE_DIR="$INSTALL_DIR/engine"
|
||||
INSTALL_DIR="/usr/share/wazuh-indexer"
|
||||
|
||||
|
||||
COPY config/entrypoint.sh /
|
||||
@@ -61,37 +40,30 @@ COPY config/securityadmin.sh /
|
||||
|
||||
RUN yum install curl-minimal shadow-utils findutils hostname -y && \
|
||||
yum clean all && \
|
||||
getent group $GROUP || groupadd -r -g ${WAZUH_GID} $GROUP && \
|
||||
getent group $GROUP || groupadd -r -g 1000 $GROUP && \
|
||||
useradd --system \
|
||||
--uid ${WAZUH_UID} \
|
||||
--uid 1000 \
|
||||
--no-create-home \
|
||||
--home-dir $INSTALL_DIR \
|
||||
--gid ${WAZUH_GID} \
|
||||
--gid $GROUP \
|
||||
--shell /sbin/nologin \
|
||||
--comment "$USER user" \
|
||||
$USER && \
|
||||
chmod 700 /entrypoint.sh && chmod 700 /securityadmin.sh && \
|
||||
mkdir -p $INSTALL_DIR && \
|
||||
chown ${WAZUH_UID}:${WAZUH_GID} $INSTALL_DIR && \
|
||||
chown ${WAZUH_UID}:${WAZUH_GID} /*.sh && \
|
||||
mkdir -p /var/lib/wazuh-indexer && chown ${WAZUH_UID}:${WAZUH_GID} /var/lib/wazuh-indexer && \
|
||||
mkdir -p $INSTALL_DIR/logs && chown ${WAZUH_UID}:${WAZUH_GID} $INSTALL_DIR/logs && \
|
||||
mkdir -p /run/wazuh-indexer && chown ${WAZUH_UID}:${WAZUH_GID} /run/wazuh-indexer && \
|
||||
mkdir -p /var/log/wazuh-indexer && chown ${WAZUH_UID}:${WAZUH_GID} /var/log/wazuh-indexer
|
||||
chown 1000:1000 $INSTALL_DIR && \
|
||||
chown 1000:1000 /*.sh && \
|
||||
mkdir -p /var/lib/wazuh-indexer && chown 1000:1000 /var/lib/wazuh-indexer && \
|
||||
mkdir -p $INSTALL_DIR/logs && chown 1000:1000 $INSTALL_DIR/logs && \
|
||||
mkdir -p /run/wazuh-indexer && chown 1000:1000 /run/wazuh-indexer && \
|
||||
mkdir -p /var/log/wazuh-indexer && chown 1000:1000 /var/log/wazuh-indexer
|
||||
|
||||
COPY --from=builder $INSTALL_DIR $INSTALL_DIR
|
||||
COPY --from=builder --chown=1000:1000 $INSTALL_DIR $INSTALL_DIR
|
||||
|
||||
RUN chmod 700 $INSTALL_DIR && \
|
||||
chmod 700 $INSTALL_DIR/config && \
|
||||
chmod 600 $INSTALL_DIR/config/jvm.options && \
|
||||
chmod 600 $INSTALL_DIR/config/opensearch.yml && \
|
||||
if [ -d "$ENGINE_DIR" ]; then \
|
||||
find "$ENGINE_DIR" -type d -exec chmod 750 {} + && \
|
||||
find "$ENGINE_DIR" -type f -exec chmod 640 {} + && \
|
||||
{ [ -f "$ENGINE_DIR/run_engine.sh" ] && chmod 750 "$ENGINE_DIR/run_engine.sh" || true; } && \
|
||||
{ [ -f "$ENGINE_DIR/bin/wazuh-engine" ] && chmod 750 "$ENGINE_DIR/bin/wazuh-engine" || true; } && \
|
||||
{ [ -d "$ENGINE_DIR/sockets" ] && chmod 777 "$ENGINE_DIR/sockets" || true; }; \
|
||||
fi
|
||||
chmod 600 $INSTALL_DIR/config/opensearch.yml
|
||||
|
||||
USER wazuh-indexer
|
||||
WORKDIR $INSTALL_DIR
|
||||
|
||||
@@ -13,9 +13,7 @@ export CONFIG_DIR=${INSTALLATION_DIR}/config
|
||||
# Modify opensearch.yml config paths
|
||||
if [ -d "/etc/wazuh-indexer" ]; then
|
||||
mkdir -p ${CONFIG_DIR}
|
||||
chown ${USER}:${GROUP} ${CONFIG_DIR}
|
||||
mkdir -p ${CONFIG_DIR}/certs
|
||||
chown ${USER}:${GROUP} ${CONFIG_DIR}/certs
|
||||
mv /etc/wazuh-indexer/* ${CONFIG_DIR}/
|
||||
rmdir /etc/wazuh-indexer
|
||||
fi
|
||||
|
||||
@@ -58,12 +58,6 @@ function runOpensearch {
|
||||
fi
|
||||
done < <(env)
|
||||
|
||||
# Start Wazuh Engine
|
||||
if [ -x "$OPENSEARCH_HOME/engine/run_engine.sh" ]; then
|
||||
nohup "$OPENSEARCH_HOME/engine/run_engine.sh" > /dev/null 2>&1 &
|
||||
echo $! > /run/wazuh-indexer/wazuh-engine.pid
|
||||
fi
|
||||
|
||||
# Start opensearch
|
||||
exec "$@" "${opensearch_opts[@]}"
|
||||
|
||||
|
||||
@@ -1,101 +1,53 @@
|
||||
# Wazuh Docker Copyright (C) 2017, Wazuh Inc. (License GPLv2)
|
||||
FROM amazonlinux:2023
|
||||
|
||||
################################################################################
|
||||
# Build stage 0 (builder):
|
||||
# Install Wazuh Manager RPM, configure directories, prepare permanent data,
|
||||
# and download tini (static PID-1 init shim).
|
||||
################################################################################
|
||||
FROM amazonlinux:2023 AS builder
|
||||
RUN rm /bin/sh && ln -s /bin/bash /bin/sh
|
||||
|
||||
ARG WAZUH_VERSION
|
||||
ARG TINI_VERSION="v0.19.0"
|
||||
ARG S6_VERSION="v2.2.0.3"
|
||||
ARG TARGETARCH
|
||||
ARG wazuh_manager_x86_64_rpm
|
||||
ARG wazuh_manager_aarch64_rpm
|
||||
ARG WAZUH_UID=101
|
||||
ARG WAZUH_GID=101
|
||||
|
||||
# Prepare permanent data config needed by permanent_data.sh at build time
|
||||
COPY config/permanent_data.env config/permanent_data.sh /
|
||||
|
||||
RUN dnf install openssl findutils procps shadow-utils -y && \
|
||||
dnf clean all && \
|
||||
getent group wazuh-manager || groupadd -r -g ${WAZUH_GID} wazuh-manager && \
|
||||
getent passwd wazuh-manager || useradd --system \
|
||||
--no-create-home \
|
||||
--home-dir /var/wazuh-manager \
|
||||
--uid ${WAZUH_UID} \
|
||||
--gid ${WAZUH_GID} \
|
||||
--shell /sbin/nologin \
|
||||
wazuh-manager && \
|
||||
RPM_ARCH="x86_64" && \
|
||||
RUN RPM_ARCH="x86_64" && \
|
||||
if [ "${TARGETARCH}" = "arm64" ]; then RPM_ARCH="aarch64"; fi && \
|
||||
URL_VAR="wazuh_manager_${RPM_ARCH}_rpm" && \
|
||||
manager_url="${!URL_VAR}" && \
|
||||
dnf install curl-minimal xz gnupg tar gzip -y && \
|
||||
dnf install curl-minimal xz gnupg tar gzip openssl findutils procps -y &&\
|
||||
dnf clean all && \
|
||||
curl -o /wazuh-manager.rpm "${manager_url}" && \
|
||||
dnf install /wazuh-manager.rpm -y && \
|
||||
rm -rf /wazuh-manager.rpm && \
|
||||
dnf clean all && \
|
||||
# Set up required directories with correct ownership
|
||||
mkdir -p /var/wazuh-manager/var/multigroups && \
|
||||
S6_ARCH="amd64" && \
|
||||
if [ "${TARGETARCH}" = "arm64" ]; then S6_ARCH="aarch64"; fi && \
|
||||
curl --fail --silent -L https://github.com/just-containers/s6-overlay/releases/download/${S6_VERSION}/s6-overlay-${S6_ARCH}.tar.gz \
|
||||
-o /tmp/s6-overlay-${S6_ARCH}.tar.gz && \
|
||||
tar xzf /tmp/s6-overlay-${S6_ARCH}.tar.gz -C / --exclude="./bin" && \
|
||||
tar xzf /tmp/s6-overlay-${S6_ARCH}.tar.gz -C /usr ./bin && \
|
||||
rm /tmp/s6-overlay-${S6_ARCH}.tar.gz && \
|
||||
rm -f /var/wazuh-manager/etc/sslmanager.key && \
|
||||
rm -f /var/wazuh-manager/etc/sslmanager.cert
|
||||
|
||||
COPY config/etc/ /etc/
|
||||
# Prepare permanent data
|
||||
# Sync calls are due to https://github.com/docker/docker/issues/9547
|
||||
|
||||
COPY config/permanent_data.env config/permanent_data.sh /
|
||||
|
||||
#Make mount directories for keep permissions
|
||||
|
||||
RUN mkdir -p /var/wazuh-manager/var/multigroups && \
|
||||
chown root:wazuh-manager /var/wazuh-manager/var/multigroups && \
|
||||
chmod 770 /var/wazuh-manager/var/multigroups && \
|
||||
mkdir -p /var/wazuh-manager/etc/certs && \
|
||||
chown wazuh-manager:wazuh-manager /var/wazuh-manager/etc/certs && \
|
||||
chmod 500 /var/wazuh-manager/etc/certs && \
|
||||
rm -f /var/wazuh-manager/etc/sslmanager.key && \
|
||||
rm -f /var/wazuh-manager/etc/sslmanager.cert
|
||||
|
||||
# Prepare permanent data snapshot (sync calls: https://github.com/docker/docker/issues/9547)
|
||||
RUN chmod 755 /permanent_data.sh && \
|
||||
chmod 755 /permanent_data.sh && \
|
||||
sync && /permanent_data.sh && \
|
||||
sync && rm /permanent_data.sh
|
||||
|
||||
# Download tini static binary (no external library dependencies)
|
||||
RUN curl --fail --silent -L \
|
||||
https://github.com/krallin/tini/releases/download/${TINI_VERSION}/tini-static-${TARGETARCH} \
|
||||
-o /usr/local/bin/tini && \
|
||||
chmod +x /usr/local/bin/tini
|
||||
|
||||
################################################################################
|
||||
# Build stage 1 (the actual Wazuh Manager image):
|
||||
# Copy Wazuh Manager and tini from builder. Install only runtime dependencies.
|
||||
################################################################################
|
||||
FROM amazonlinux:2023
|
||||
|
||||
ARG WAZUH_UID=101
|
||||
ARG WAZUH_GID=101
|
||||
|
||||
RUN rm /bin/sh && ln -s /bin/bash /bin/sh
|
||||
|
||||
# Install only runtime dependencies (no curl, tar, gzip, xz, or full dnf stack)
|
||||
RUN dnf install openssl findutils procps shadow-utils -y && \
|
||||
dnf clean all && \
|
||||
getent group wazuh-manager || groupadd -r -g ${WAZUH_GID} wazuh-manager && \
|
||||
getent passwd wazuh-manager || useradd --system \
|
||||
--no-create-home \
|
||||
--home-dir /var/wazuh-manager \
|
||||
--uid ${WAZUH_UID} \
|
||||
--gid ${WAZUH_GID} \
|
||||
--shell /sbin/nologin \
|
||||
wazuh-manager
|
||||
|
||||
# Copy Wazuh Manager installation (includes permanent data snapshot)
|
||||
COPY --from=builder /var/wazuh-manager /var/wazuh-manager
|
||||
|
||||
# Copy tini static binary
|
||||
COPY --from=builder /usr/local/bin/tini /usr/local/bin/tini
|
||||
|
||||
# Copy entrypoint, init scripts and runtime config
|
||||
COPY config/entrypoint.sh /entrypoint.sh
|
||||
COPY config/etc/ /etc/
|
||||
COPY config/permanent_data.env /
|
||||
|
||||
RUN chmod 755 /entrypoint.sh
|
||||
|
||||
# Services ports
|
||||
EXPOSE 55000/tcp 1514/tcp 1515/tcp 514/udp 1516/tcp
|
||||
|
||||
ENTRYPOINT ["/usr/local/bin/tini", "--", "/entrypoint.sh"]
|
||||
ENTRYPOINT [ "/init" ]
|
||||
|
||||
@@ -1,22 +0,0 @@
|
||||
#!/bin/bash
|
||||
# Wazuh Docker Copyright (C) 2017, Wazuh Inc. (License GPLv2)
|
||||
|
||||
# Run initialization and configuration
|
||||
bash /etc/cont-init.d/0-wazuh-init
|
||||
|
||||
# Start Wazuh Manager (may log warnings in environments without certs)
|
||||
bash /etc/cont-init.d/1-manager
|
||||
|
||||
# Tail the main log to stdout so Docker captures it
|
||||
tail -F /var/wazuh-manager/logs/wazuh-manager.log &
|
||||
TAIL_PID=$!
|
||||
|
||||
# Graceful shutdown: stop Wazuh and exit cleanly on SIGTERM/SIGINT
|
||||
_stop() {
|
||||
echo "Stopping Wazuh Manager..."
|
||||
/var/wazuh-manager/bin/wazuh-manager-control stop 2>/dev/null || true
|
||||
kill "${TAIL_PID}" 2>/dev/null || true
|
||||
}
|
||||
trap _stop SIGTERM SIGINT SIGQUIT
|
||||
|
||||
wait "${TAIL_PID}"
|
||||
@@ -1,4 +1,4 @@
|
||||
#!/bin/bash
|
||||
#!/usr/bin/with-contenv bash
|
||||
# Wazuh App Copyright (C) 2017, Wazuh Inc. (License GPLv2)
|
||||
|
||||
# Variables
|
||||
@@ -252,9 +252,9 @@ configure_permissions() {
|
||||
##############################################################################
|
||||
|
||||
set_correct_permOwner() {
|
||||
find /var/wazuh-manager/ -group 997 -exec chown :101 {} +
|
||||
find /var/wazuh-manager/ -group 999 -exec chown :101 {} +
|
||||
find /var/wazuh-manager/ -user 999 -exec chown 101 {} +
|
||||
find /var/wazuh-manager/ -group 997 -exec chown :999 {} +;
|
||||
find /var/wazuh-manager/ -group 101 -exec chown :999 {} +;
|
||||
find /var/wazuh-manager/ -user 101 -exec chown 999 {} +;
|
||||
}
|
||||
|
||||
##############################################################################
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
#!/bin/bash
|
||||
#!/usr/bin/with-contenv bash
|
||||
|
||||
##############################################################################
|
||||
# Migration sequence
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
#!/bin/sh
|
||||
#!/usr/bin/with-contenv sh
|
||||
|
||||
# dumping wazuh-manager.log to standard output
|
||||
exec tail -F /var/wazuh-manager/logs/wazuh-manager.log
|
||||
|
||||
+1
-1
@@ -28,7 +28,7 @@ The folder `wazuh-agent` contains a README explaining how to run a container wit
|
||||
|
||||
├── build-docker-images
|
||||
│ ├── build-images.sh
|
||||
│ ├── docker-bake.hcl
|
||||
│ ├── build-images.yml
|
||||
│ ├── README.md
|
||||
│ ├── wazuh-agent
|
||||
│ │ ├── config
|
||||
|
||||
@@ -30,9 +30,3 @@
|
||||
- [Security](ref/security.md)
|
||||
- [Performance](ref/performance.md)
|
||||
- [Glossary](ref/glossary.md)
|
||||
|
||||
---
|
||||
|
||||
# Integration Tests
|
||||
|
||||
- [Docker Integration Tests](ref/integration_test/docker_integration_tests.md)
|
||||
|
||||
@@ -38,7 +38,7 @@ The Procedure_push_docker_images.yml workflow builds and pushes multi-architectu
|
||||
2. **Multi-architecture Build**:
|
||||
- Uses Docker Buildx with QEMU for cross-platform builds
|
||||
- Builds for `linux/amd64` and `linux/arm64`
|
||||
- Leverages `docker-bake.hcl` for parallel multi-arch build configuration
|
||||
- Leverages `build-images.yml` for build configuration
|
||||
|
||||
3. **Image Publishing**:
|
||||
- Tags images appropriately based on mode
|
||||
|
||||
@@ -21,8 +21,8 @@ The Wazuh Manager container accepts the following environment variables, which c
|
||||
|
||||
```yaml
|
||||
environment:
|
||||
- INDEXER_USERNAME=wazuh-manager
|
||||
- INDEXER_PASSWORD=wazuh-manager
|
||||
- INDEXER_USERNAME=admin
|
||||
- INDEXER_PASSWORD=SecretPassword
|
||||
- WAZUH_API_URL=https://wazuh.manager
|
||||
- DASHBOARD_USERNAME=kibanaserver
|
||||
- DASHBOARD_PASSWORD=kibanaserver
|
||||
@@ -30,7 +30,7 @@ environment:
|
||||
|
||||
**Variable Descriptions:**
|
||||
|
||||
- `INDEXER_USERNAME` / `INDEXER_PASSWORD`: Credentials for accessing the Wazuh Indexer with `wazuh-manager` user or a user with the same permissions.
|
||||
- `INDEXER_USERNAME` / `INDEXER_PASSWORD`: Credentials for accessing the Wazuh Indexer with `admin` user or a user with the same permissions.
|
||||
- `WAZUH_API_URL`: URL of the Wazuh API, used by other services for communication.
|
||||
- `DASHBOARD_USERNAME` / `DASHBOARD_PASSWORD`: Credentials for the Wazuh Dashboard to authenticate with the Indexer.
|
||||
|
||||
@@ -57,8 +57,8 @@ The Wazuh Dashboard container accepts the following environment variables, which
|
||||
|
||||
```yaml
|
||||
environment:
|
||||
- INDEXER_USERNAME=wazuh-manager
|
||||
- INDEXER_PASSWORD=wazuh-manager
|
||||
- INDEXER_USERNAME=admin
|
||||
- INDEXER_PASSWORD=SecretPassword
|
||||
- WAZUH_API_URL=https://wazuh.manager
|
||||
- DASHBOARD_USERNAME=kibanaserver
|
||||
- DASHBOARD_PASSWORD=kibanaserver
|
||||
|
||||
@@ -19,11 +19,9 @@ Follow these steps to deploy the Wazuh agent using Docker.
|
||||
# ...
|
||||
environment:
|
||||
- WAZUH_MANAGER_SERVER=<YOUR_WAZUH_MANAGER_IP_OR_HOSTNAME>
|
||||
- WAZUH_REGISTRATION_PASSWORD=<authd.pass-PASSWORD>
|
||||
# ...
|
||||
```
|
||||
**Note:** Replaces `<YOUR_WAZUH_MANAGER_IP_OR_HOSTNAME>` with the actual IP address or hostname of your Wazuh manager.
|
||||
**Note:** Replaces `<authd.pass-PASSWORD>` with the password configured in the `/var/wazuh-manager/etc/authd.pass` file of the Wazuh manager server where you will connect.
|
||||
**Note:** Replace `<YOUR_WAZUH_MANAGER_IP_OR_HOSTNAME>` with the actual IP address or hostname of your Wazuh manager.
|
||||
|
||||
3. Start the environment using `docker compose`:
|
||||
|
||||
|
||||
@@ -1,332 +0,0 @@
|
||||
# Docker Integration Tests
|
||||
|
||||
Workflow file: `.github/workflows/5_check_integration_tools.yml`
|
||||
|
||||
This workflow optionally builds Docker images from the PR branch, provisions a dedicated AWS VM, deploys the Wazuh Docker stack (single-node or multi-node), and runs the integration test suite against it via SSH.
|
||||
|
||||
---
|
||||
|
||||
## Triggers
|
||||
|
||||
| Mode | Trigger | Who can trigger |
|
||||
|---|---|---|
|
||||
| PR comment | `issue_comment` on an open, non-draft PR | Any repo collaborator |
|
||||
| Manual | `workflow_dispatch` | Anyone with repo write access |
|
||||
|
||||
---
|
||||
|
||||
## Execution Flows
|
||||
|
||||
### issue_comment flow
|
||||
|
||||
```mermaid
|
||||
flowchart TD
|
||||
A[PR comment posted] --> B{Recognized command\non open non-draft PR?}
|
||||
B -- No --> Z[Ignored]
|
||||
B -- Yes --> C[get_pr_info\nReact · Extract PR data\nParse command · Create Check Run]
|
||||
C --> D[prepare\nResolve branch · Read VERSION.json]
|
||||
D --> E[build_images\nBuild + push to ECR\nalways runs on PR comment]
|
||||
E --> F{deployment_matrix}
|
||||
F --> G[docker_test\nsingle-node]
|
||||
F --> H[docker_test\nmulti-node]
|
||||
G --> I[update_check]
|
||||
H --> I
|
||||
```
|
||||
|
||||
**Recognized commands:**
|
||||
|
||||
| Comment | Deployment matrix |
|
||||
|---|---|
|
||||
| `/test-docker` | `["single-node","multi-node"]` |
|
||||
| `/test-docker-single` | `["single-node"]` |
|
||||
| `/test-docker-multi` | `["multi-node"]` |
|
||||
|
||||
When triggered by PR comment, `build_images` **always** runs — images are always built from the PR branch and pushed to ECR.
|
||||
|
||||
### workflow_dispatch flow
|
||||
|
||||
```mermaid
|
||||
flowchart TD
|
||||
A[Manual trigger] --> D[prepare\nResolve branch · Read VERSION.json]
|
||||
D --> E{Build needed?\nno version + no stage\n+ registry=ECR}
|
||||
E -- Yes --> F[build_images\nBuild + push to ECR]
|
||||
E -- No --> G{deployment_type input}
|
||||
F --> G
|
||||
G -- single-node --> H[docker_test\nsingle-node]
|
||||
G -- multi-node --> I[docker_test\nmulti-node]
|
||||
G -- both --> H & I
|
||||
```
|
||||
|
||||
`build_images` is **skipped** when either `version` or `stage` is provided, or when `registry = DockerHub`.
|
||||
|
||||
---
|
||||
|
||||
## Parameters
|
||||
|
||||
### workflow_dispatch inputs
|
||||
|
||||
| Input | Required | Default | Description |
|
||||
|---|---|---|---|
|
||||
| `pr_head_ref` | Yes | — | Branch of `wazuh-docker` to test |
|
||||
| `automation_reference` | No | `main` | Branch of `wazuh-automation` to use |
|
||||
| `deployment_type` | Yes | — | `single-node`, `multi-node`, or `both` |
|
||||
| `version` | No | — | Override image version (e.g. `5.0.1`). If empty, reads from `VERSION.json` |
|
||||
| `stage` | No | — | Image stage suffix (e.g. `beta1`, `beta2-latest`). Required when `version` is set |
|
||||
| `registry` | No | `ECR` | `ECR` (dev/built images) or `DockerHub` (released images) |
|
||||
|
||||
### issue_comment parameters
|
||||
|
||||
All parameters are derived automatically:
|
||||
|
||||
| Parameter | Source |
|
||||
|---|---|
|
||||
| `pr_head_ref` | PR head branch from GitHub API |
|
||||
| `deployment_matrix` | Parsed from comment command |
|
||||
| `version` / `stage` | Read from `VERSION.json` on the PR branch |
|
||||
| `registry` | Always ECR (images are always built) |
|
||||
| `automation_reference` | Always `main` |
|
||||
|
||||
---
|
||||
|
||||
## Image Resolution Scenarios
|
||||
|
||||
The workflow distinguishes five cases based on inputs:
|
||||
|
||||
| Case | `version` input | `stage` input | Registry | Action | Image tag |
|
||||
|---|---|---|---|---|---|
|
||||
| a.1 | empty | empty | ECR (or PR comment) | **BUILD** from PR → ECR | `{version}-{stage}-latest` |
|
||||
| a.2 | empty | empty | DockerHub | Pull (no build) | `{version}-{stage}` |
|
||||
| b.1 | set | empty | ECR | Pull (no build) | `{version}-latest` |
|
||||
| b.2 | set | empty | DockerHub | Pull (no build) | `{version}` |
|
||||
| c | set or empty | set | ECR or DockerHub | Pull (no build) | `{version}-{stage}` |
|
||||
|
||||
> When neither `version` nor `stage` is set, `version` and `stage` are read from `VERSION.json` on the target branch.
|
||||
|
||||
> Case a.1 always applies when triggered by PR comment, regardless of the `registry` input (which is not available in that trigger mode).
|
||||
|
||||
---
|
||||
|
||||
## Job Details
|
||||
|
||||
### Job 1 — `get_pr_info` (issue_comment only)
|
||||
|
||||
| Step | What it does |
|
||||
|---|---|
|
||||
| React to comment | Adds a 🚀 reaction to the triggering PR comment |
|
||||
| Extract PR data | Calls GitHub API to get PR `head_ref` and `head_sha` |
|
||||
| Parse command | Maps comment text → `deployment_matrix` JSON and `check_name` string |
|
||||
| Create Check Run | Creates a GitHub Check Run in `in_progress` state on the PR head SHA |
|
||||
|
||||
### Job 2 — `prepare` (both triggers)
|
||||
|
||||
| Step | What it does |
|
||||
|---|---|
|
||||
| Resolve context | Reads inputs (workflow_dispatch) or `get_pr_info` outputs (issue_comment) |
|
||||
| Checkout `VERSION.json` | Sparse-checks out only `VERSION.json` from the target branch |
|
||||
| Read version info | Extracts `version` and `stage` from `VERSION.json` |
|
||||
| Show test plan | Logs the resolved image case (a.1/a.2/b.1/b.2/c) and writes a summary table |
|
||||
|
||||
Outputs: `pr_head_ref`, `deployment_matrix`, `wazuh_version`, `wazuh_stage`.
|
||||
|
||||
### Job 3 — `build_images` (conditional)
|
||||
|
||||
Calls the reusable workflow `.github/workflows/5_build_and_push_images.yml`.
|
||||
|
||||
**Runs when:** `version == ''` AND `stage == ''` AND (`registry == 'ECR'` OR `github.event_name == 'issue_comment'`).
|
||||
|
||||
**Skipped when:** any explicit `version` or `stage` is provided, or `registry = DockerHub`.
|
||||
|
||||
| Parameter passed | Value |
|
||||
|---|---|
|
||||
| `image_tag` | `{wazuh_version}-{wazuh_stage}` |
|
||||
| `docker_reference` | `pr_head_ref` |
|
||||
| `wazuh_automation_reference` | `automation_reference` input |
|
||||
| `products` | `wazuh-manager,wazuh-dashboard,wazuh-indexer,wazuh-agent` |
|
||||
| `dev` | `true` |
|
||||
| `id` | `docker-integration-{run_id}` |
|
||||
|
||||
### Job 4 — `docker_test` (matrix, both triggers)
|
||||
|
||||
Runs once per entry in `deployment_matrix`. Each instance provisions its own VM.
|
||||
|
||||
#### Setup
|
||||
|
||||
1. Checkout `wazuh-automation` at `automation_reference`
|
||||
2. Checkout `wazuh-docker` at `pr_head_ref`
|
||||
3. Resolve image configuration (see [Image Resolution Scenarios](#image-resolution-scenarios)) → sets `DOCKER_REGISTRY`, `DOCKER_TAG`, `DOCKER_VERSION`
|
||||
4. Set up Python 3.12 and install `test_runner`
|
||||
5. Configure AWS credentials via OIDC (`AWS_IAM_DOCKER_ROLE`)
|
||||
|
||||
#### Instance allocation
|
||||
|
||||
Provisions a dedicated AWS VM using the `deployability` allocator module:
|
||||
|
||||
```bash
|
||||
python3 wazuh-automation/deployability/modules/allocation/main.py \
|
||||
--action create \
|
||||
--provider aws \
|
||||
--size large \
|
||||
--composite-name ubuntu-24-amd64 \
|
||||
--instance-name gha_{run_id}_docker_{deployment_type} \
|
||||
--label-team devops \
|
||||
--label-termination-date 1d
|
||||
```
|
||||
|
||||
The allocator writes `inventory.yml` with the SSH connection details (`ansible_host`, `ansible_port`, `ansible_user`, `ansible_ssh_private_key_file`). These are extracted and exported as `SSH_HOST`, `SSH_PORT`, `SSH_USER`, `SSH_KEY` environment variables.
|
||||
|
||||
#### VM configuration and Docker install
|
||||
|
||||
All subsequent steps run on the remote VM over SSH:
|
||||
|
||||
1. **Install Docker CE**: `curl -fsSL https://get.docker.com | sudo sh`
|
||||
2. **Login to ECR** (when registry is ECR or trigger is issue_comment): authenticates the VM's Docker daemon to the dev registry
|
||||
3. **Set `vm.max_map_count=262144`**: required for OpenSearch/Wazuh Indexer
|
||||
|
||||
#### Certificate generation and config
|
||||
|
||||
Runs on the **runner** (not the VM):
|
||||
|
||||
1. **Download `wazuh-certs-tool.sh`** directly from the packages URL:
|
||||
- Pre-release: `packages-staging.xdrsiem.wazuh.info/pre-release/{major}.x/installation-assistant/wazuh-certs-tool-{version}-{stage}.sh`
|
||||
- Release: `packages.wazuh.com/{major}.{minor}/wazuh-certs-tool-{version}-1.sh`
|
||||
|
||||
2. **Generate `config.yml`** inline based on deployment type:
|
||||
|
||||
**single-node:**
|
||||
```yaml
|
||||
nodes:
|
||||
indexer: [{ name: wazuh.indexer, dns: wazuh.indexer }]
|
||||
manager: [{ name: wazuh.manager, dns: wazuh.manager }]
|
||||
dashboard:[{ name: wazuh.dashboard, dns: wazuh.dashboard }]
|
||||
```
|
||||
|
||||
**multi-node:**
|
||||
```yaml
|
||||
nodes:
|
||||
indexer:
|
||||
- { name: wazuh1.indexer, dns: wazuh1.indexer }
|
||||
- { name: wazuh2.indexer, dns: wazuh2.indexer }
|
||||
- { name: wazuh3.indexer, dns: wazuh3.indexer }
|
||||
manager:
|
||||
- { name: wazuh.master, dns: wazuh.master, node_type: master }
|
||||
- { name: wazuh.worker, dns: wazuh.worker, node_type: worker }
|
||||
dashboard: [{ name: wazuh.dashboard, dns: wazuh.dashboard }]
|
||||
```
|
||||
|
||||
3. **Copy `wazuh-docker/` to VM** via SCP: `scp -r wazuh-docker {remote}:/tmp/wazuh-docker`
|
||||
|
||||
4. **Generate certificates on VM**: runs `tools/utils/deployment/certificates-conf.sh --cert --copy` inside `/tmp/wazuh-docker/{deployment}/`
|
||||
|
||||
#### Deployment
|
||||
|
||||
```bash
|
||||
# On the VM
|
||||
cd /tmp/wazuh-docker/{deployment_type}
|
||||
sudo docker compose up -d
|
||||
```
|
||||
|
||||
Waits up to **15 minutes** polling every 10 seconds until all non-nginx containers report `healthy` status.
|
||||
|
||||
After containers are healthy, waits for steady state:
|
||||
- `single-node`: 60 seconds
|
||||
- `multi-node`: 90 seconds
|
||||
|
||||
#### Test execution
|
||||
|
||||
```bash
|
||||
test_runner \
|
||||
--test-type "docker-{deployment_type}" \
|
||||
--deployment-type "docker-{deployment_type}" \
|
||||
--ssh-host "{SSH_HOST}" \
|
||||
--ssh-port "{SSH_PORT}" \
|
||||
--ssh-key-path "{SSH_KEY}" \
|
||||
--ssh-username "{SSH_USER}" \
|
||||
--version "{DOCKER_VERSION}" \
|
||||
--log-level INFO \
|
||||
--output github \
|
||||
--output-file "test-results-docker-{deployment_type}.github"
|
||||
```
|
||||
|
||||
| Argument | Value | Notes |
|
||||
|---|---|---|
|
||||
| `--test-type` | `docker-single-node` or `docker-multi-node` | Selects the test module set |
|
||||
| `--deployment-type` | `docker-single-node` or `docker-multi-node` | Selects the deployment profile |
|
||||
| `--ssh-host/port/key/username` | From allocator inventory | Connects to the allocated VM |
|
||||
| `--version` | Resolved `DOCKER_VERSION` | Used for version assertion tests |
|
||||
| `--output github` | — | Emits GitHub Actions annotations |
|
||||
|
||||
For details on what `docker-single-node` and `docker-multi-node` test types validate, see the `Integration Test Module — Description` of the internal documentation.
|
||||
|
||||
#### Reporting
|
||||
|
||||
| Output | When | Content |
|
||||
|---|---|---|
|
||||
| Step summary | Always | Test results appended to `$GITHUB_STEP_SUMMARY` |
|
||||
| PR comment | `issue_comment` trigger only | Posts or updates a comment (marker: `<!-- docker-integration-check-{deployment} -->`) with ✅/❌ and results |
|
||||
| Artifact: `test-results-docker-{deployment}-{run_id}` | Always | Results file, retained 7 days |
|
||||
| Artifact: `docker-logs-{deployment}-{run_id}` | On failure only | Full `docker compose logs` output, retained 7 days |
|
||||
|
||||
#### Cleanup (always runs, even on failure)
|
||||
|
||||
1. `docker compose down -v` on the VM (stops containers and removes volumes)
|
||||
2. Deallocate the VM:
|
||||
```bash
|
||||
python3 wazuh-automation/deployability/modules/allocation/main.py \
|
||||
--action delete \
|
||||
--track-output {ALLOCATOR_PATH}/track.yml
|
||||
```
|
||||
|
||||
### Job 5 — `update_check` (issue_comment only)
|
||||
|
||||
Updates the GitHub Check Run created in Job 1:
|
||||
|
||||
| `docker_test` result | Check conclusion |
|
||||
|---|---|
|
||||
| `success` | `success` — ✅ All Docker integration tests passed |
|
||||
| `failure` | `failure` — ❌ One or more tests failed |
|
||||
| `cancelled` | `cancelled` |
|
||||
|
||||
---
|
||||
|
||||
## Required Secrets and Variables
|
||||
|
||||
### Secrets
|
||||
|
||||
| Secret | Used by |
|
||||
|---|---|
|
||||
| `AWS_IAM_DOCKER_ROLE` | OIDC role for AWS operations (allocator + ECR) |
|
||||
| `GH_CLONE_TOKEN` | Checkout `wazuh-automation` |
|
||||
| `GITHUB_TOKEN` | PR comments and Check Run updates (built-in) |
|
||||
|
||||
### Repository variables
|
||||
|
||||
| Variable | Used by |
|
||||
|---|---|
|
||||
| `IMAGE_REGISTRY_PROD` | DockerHub registry URL |
|
||||
| `IMAGE_REGISTRY_DEV` | ECR registry URL |
|
||||
|
||||
---
|
||||
|
||||
## Permissions
|
||||
|
||||
| Permission | Purpose |
|
||||
|---|---|
|
||||
| `id-token: write` | OIDC authentication to AWS |
|
||||
| `contents: read` | Checkout repository |
|
||||
| `pull-requests: write` | Post PR comments |
|
||||
| `issues: write` | Post comments via issues API |
|
||||
| `checks: write` | Create and update GitHub Check Runs |
|
||||
|
||||
---
|
||||
|
||||
## Instance Naming
|
||||
|
||||
Allocated VMs are named:
|
||||
|
||||
```
|
||||
gha_{github.run_id}_docker_{deployment_type}
|
||||
```
|
||||
|
||||
Example: `gha_12345678_docker_single-node`
|
||||
|
||||
VMs are tagged with `termination-date: 1d` — they are automatically terminated after 24 hours as a safety net, even if the cleanup step fails.
|
||||
@@ -0,0 +1,283 @@
|
||||
# Opendistro data migration to Wazuh indexer on docker.
|
||||
This procedure explains how to migrate Opendistro data from Opendistro to Wazuh indexer in docker production deployments.
|
||||
The example is migrating from v4.2 to v4.4.
|
||||
|
||||
## Procedure
|
||||
Assuming that you have a v4.2 production deployment, perform the following steps.
|
||||
|
||||
**1. Stop 4.2 environment**
|
||||
`docker-compose -f production-cluster.yml stop`
|
||||
|
||||
**2. List elasticsearch volumes**
|
||||
`docker volume ls --filter name='wazuh-docker_elastic-data'`
|
||||
|
||||
**3. Inspect elasticsearch volume**
|
||||
`docker volume inspect wazuh-docker_elastic-data-1`
|
||||
|
||||
**4. Spin down the 4.2 environment.**
|
||||
`docker-compose -f production-cluster.yml down`
|
||||
|
||||
**Steps 5 and 6 can be done with the volume-migrator.sh script, specifying Docker compose version and project name as parameters.**
|
||||
|
||||
Ex: $ multi-node/volume-migrator.sh 1.25.0 multi-node
|
||||
|
||||
**5. Run the volume create command:** create new indexer and Wazuh manager volumes using the `com.docker.compose.version` label value from the previous command.
|
||||
|
||||
```
|
||||
docker volume create \
|
||||
--label com.docker.compose.project=multi-node \
|
||||
--label com.docker.compose.version=1.25.0 \
|
||||
--label com.docker.compose.volume=wazuh-indexer-data-1 \
|
||||
multi-node_wazuh-indexer-data-1
|
||||
```
|
||||
```
|
||||
docker volume create \
|
||||
--label com.docker.compose.project=multi-node \
|
||||
--label com.docker.compose.version=1.25.0 \
|
||||
--label com.docker.compose.volume=wazuh-indexer-data-2 \
|
||||
multi-node_wazuh-indexer-data-2
|
||||
```
|
||||
```
|
||||
docker volume create \
|
||||
--label com.docker.compose.project=multi-node \
|
||||
--label com.docker.compose.version=1.25.0 \
|
||||
--label com.docker.compose.volume=wazuh-indexer-data-3 \
|
||||
multi-node_wazuh-indexer-data-3
|
||||
```
|
||||
```
|
||||
docker volume create \
|
||||
--label com.docker.compose.project=multi-node \
|
||||
--label com.docker.compose.version=1.25.0 \
|
||||
--label com.docker.compose.volume=master_wazuh_api_configuration \
|
||||
multi-node_master_wazuh_api_configuration
|
||||
```
|
||||
```
|
||||
docker volume create \
|
||||
--label com.docker.compose.project=multi-node \
|
||||
--label com.docker.compose.version=1.25.0 \
|
||||
--label com.docker.compose.volume=master_wazuh_etc \
|
||||
multi-node_docker_wazuh_etc
|
||||
```
|
||||
```
|
||||
docker volume create \
|
||||
--label com.docker.compose.project=multi-node \
|
||||
--label com.docker.compose.version=1.25.0 \
|
||||
--label com.docker.compose.volume=master-wazuh-logs \
|
||||
multi-node_master-wazuh-logs
|
||||
```
|
||||
```
|
||||
docker volume create \
|
||||
--label com.docker.compose.project=multi-node \
|
||||
--label com.docker.compose.version=1.25.0 \
|
||||
--label com.docker.compose.volume=master-wazuh-queue \
|
||||
multi-node_master-wazuh-queue
|
||||
```
|
||||
```
|
||||
docker volume create \
|
||||
--label com.docker.compose.project=multi-node \
|
||||
--label com.docker.compose.version=1.25.0 \
|
||||
--label com.docker.compose.volume=master-wazuh-var-multigroups \
|
||||
multi-node_master-wazuh-var-multigroups
|
||||
```
|
||||
```
|
||||
docker volume create \
|
||||
--label com.docker.compose.project=multi-node \
|
||||
--label com.docker.compose.version=1.25.0 \
|
||||
--label com.docker.compose.volume=master-wazuh-active-response \
|
||||
multi-node_master-wazuh-active-response
|
||||
```
|
||||
```
|
||||
docker volume create \
|
||||
--label com.docker.compose.project=multi-node \
|
||||
--label com.docker.compose.version=1.25.0 \
|
||||
--label com.docker.compose.volume=master-wazuh-etc \
|
||||
multi-node_master-wazuh-etc
|
||||
```
|
||||
```
|
||||
docker volume create \
|
||||
--label com.docker.compose.project=multi-node \
|
||||
--label com.docker.compose.version=1.25.0 \
|
||||
--label com.docker.compose.volume=master-wazuh-var \
|
||||
multi-node_master-wazuh-var
|
||||
```
|
||||
```
|
||||
docker volume create \
|
||||
--label com.docker.compose.project=multi-node \
|
||||
--label com.docker.compose.version=1.25.0 \
|
||||
--label com.docker.compose.volume=worker_wazuh_api_configuration \
|
||||
multi-node_worker_wazuh_api_configuration
|
||||
```
|
||||
```
|
||||
docker volume create \
|
||||
--label com.docker.compose.project=multi-node \
|
||||
--label com.docker.compose.version=1.25.0 \
|
||||
--label com.docker.compose.volume=worker_wazuh_etc \
|
||||
multi-node_worker-wazuh-etc
|
||||
```
|
||||
```
|
||||
docker volume create \
|
||||
--label com.docker.compose.project=multi-node \
|
||||
--label com.docker.compose.version=1.25.0 \
|
||||
--label com.docker.compose.volume=worker-wazuh-logs \
|
||||
multi-node_worker-wazuh-logs
|
||||
```
|
||||
```
|
||||
docker volume create \
|
||||
--label com.docker.compose.project=multi-node \
|
||||
--label com.docker.compose.version=1.25.0 \
|
||||
--label com.docker.compose.volume=worker-wazuh-queue \
|
||||
multi-node_worker-wazuh-queue
|
||||
```
|
||||
```
|
||||
docker volume create \
|
||||
--label com.docker.compose.project=multi-node \
|
||||
--label com.docker.compose.version=1.25.0 \
|
||||
--label com.docker.compose.volume=worker-wazuh-var-multigroups \
|
||||
multi-node_worker-wazuh-var-multigroups
|
||||
```
|
||||
```
|
||||
docker volume create \
|
||||
--label com.docker.compose.project=multi-node \
|
||||
--label com.docker.compose.version=1.25.0 \
|
||||
--label com.docker.compose.volume=worker-wazuh-active-response \
|
||||
multi-node_worker-wazuh-active-response
|
||||
```
|
||||
```
|
||||
docker volume create \
|
||||
--label com.docker.compose.project=multi-node \
|
||||
--label com.docker.compose.version=1.25.0 \
|
||||
--label com.docker.compose.volume=worker-wazuh-etc \
|
||||
multi-node_worker-wazuh-etc
|
||||
```
|
||||
```
|
||||
docker volume create \
|
||||
--label com.docker.compose.project=multi-node \
|
||||
--label com.docker.compose.version=1.25.0 \
|
||||
--label com.docker.compose.volume=worker-wazuh-var \
|
||||
multi-node_worker-wazuh-var
|
||||
```
|
||||
**6. Copy the volume content from elasticsearch to Wazuh indexer volumes and old Wazuh manager content to new volumes.**
|
||||
```
|
||||
docker container run --rm -it \
|
||||
-v wazuh-docker_elastic-data-1:/from \
|
||||
-v multi-node_wazuh-indexer-data-1:/to \
|
||||
alpine ash -c "cd /from ; cp -avp . /to"
|
||||
```
|
||||
```
|
||||
docker container run --rm -it \
|
||||
-v wazuh-docker_elastic-data-2:/from \
|
||||
-v multi-node_wazuh-indexer-data-2:/to \
|
||||
alpine ash -c "cd /from ; cp -avp . /to"
|
||||
```
|
||||
```
|
||||
docker container run --rm -it \
|
||||
-v wazuh-docker_elastic-data-3:/from \
|
||||
-v multi-node_wazuh-indexer-data-3:/to \
|
||||
alpine ash -c "cd /from ; cp -avp . /to"
|
||||
```
|
||||
```
|
||||
docker container run --rm -it \
|
||||
-v wazuh-docker_ossec-api-configuration:/from \
|
||||
-v multi-node_master-wazuh-api-configuration:/to \
|
||||
alpine ash -c "cd /from ; cp -avp . /to"
|
||||
```
|
||||
```
|
||||
docker container run --rm -it \
|
||||
-v wazuh-docker_ossec-etc:/from \
|
||||
-v multi-node_master-wazuh-etc:/to \
|
||||
alpine ash -c "cd /from ; cp -avp . /to"
|
||||
```
|
||||
```
|
||||
docker container run --rm -it \
|
||||
-v wazuh-docker_ossec-logs:/from \
|
||||
-v multi-node_master-wazuh-logs:/to \
|
||||
alpine ash -c "cd /from ; cp -avp . /to"
|
||||
```
|
||||
```
|
||||
docker container run --rm -it \
|
||||
-v wazuh-docker_ossec-queue:/from \
|
||||
-v multi-node_master-wazuh-queue:/to \
|
||||
alpine ash -c "cd /from ; cp -avp . /to"
|
||||
```
|
||||
```
|
||||
docker container run --rm -it \
|
||||
-v wazuh-docker_ossec-var-multigroups:/from \
|
||||
-v multi-node_master-wazuh-var-multigroups:/to \
|
||||
alpine ash -c "cd /from ; cp -avp . /to"
|
||||
```
|
||||
```
|
||||
docker container run --rm -it \
|
||||
-v wazuh-docker_ossec-active-response:/from \
|
||||
-v multi-node_master-wazuh-active-response:/to \
|
||||
alpine ash -c "cd /from ; cp -avp . /to"
|
||||
```
|
||||
```
|
||||
docker container run --rm -it \
|
||||
-v wazuh-docker-etc:/from \
|
||||
-v multi-node_master-etc:/to \
|
||||
alpine ash -c "cd /from ; cp -avp . /to"
|
||||
```
|
||||
```
|
||||
docker container run --rm -it \
|
||||
-v wazuh-docker-var:/from \
|
||||
-v multi-node_master-wazuh-var:/to \
|
||||
alpine ash -c "cd /from ; cp -avp . /to"
|
||||
```
|
||||
```
|
||||
docker container run --rm -it \
|
||||
-v wazuh-docker_worker-ossec-api-configuration:/from \
|
||||
-v multi-node_worker-wazuh-api-configuration:/to \
|
||||
alpine ash -c "cd /from ; cp -avp . /to"
|
||||
```
|
||||
```
|
||||
docker container run --rm -it \
|
||||
-v wazuh-docker_worker-ossec-etc:/from \
|
||||
-v multi-node_worker-wazuh-etc:/to \
|
||||
alpine ash -c "cd /from ; cp -avp . /to"
|
||||
```
|
||||
```
|
||||
docker container run --rm -it \
|
||||
-v wazuh-docker_worker-ossec-logs:/from \
|
||||
-v multi-node_worker-wazuh-logs:/to \
|
||||
alpine ash -c "cd /from ; cp -avp . /to"
|
||||
```
|
||||
```
|
||||
docker container run --rm -it \
|
||||
-v wazuh-docker_worker-ossec-queue:/from \
|
||||
-v multi-node_worker-wazuh-queue:/to \
|
||||
alpine ash -c "cd /from ; cp -avp . /to"
|
||||
```
|
||||
```
|
||||
docker container run --rm -it \
|
||||
-v wazuh-docker_worker-ossec-var-multigroups:/from \
|
||||
-v multi-node_worker-wazuh-var-multigroups:/to \
|
||||
alpine ash -c "cd /from ; cp -avp . /to"
|
||||
```
|
||||
```
|
||||
docker container run --rm -it \
|
||||
-v wazuh-docker_worker-ossec-active-response:/from \
|
||||
-v multi-node_worker-wazuh-active-response:/to \
|
||||
alpine ash -c "cd /from ; cp -avp . /to"
|
||||
```
|
||||
```
|
||||
docker container run --rm -it \
|
||||
-v wazuh-docker_worker-etc:/from \
|
||||
-v multi-node_worker-wazuh-etc:/to \
|
||||
alpine ash -c "cd /from ; cp -avp . /to"
|
||||
```
|
||||
```
|
||||
docker container run --rm -it \
|
||||
-v wazuh-docker_worker-var:/from \
|
||||
-v multi-node_worker-wazuh-var:/to \
|
||||
alpine ash -c "cd /from ; cp -avp . /to"
|
||||
```
|
||||
|
||||
**7. Start the 4.4 environment.**
|
||||
```
|
||||
git checkout 4.4
|
||||
cd multi-node
|
||||
docker-compose -f generate-indexer-certs.yml run --rm generator
|
||||
docker-compose up -d
|
||||
```
|
||||
|
||||
**8. Check the access to Wazuh dashboard**: go to the Wazuh dashboard using the web browser and check the data.
|
||||
@@ -9,11 +9,10 @@ services:
|
||||
wazuh1.indexer:
|
||||
condition: service_healthy
|
||||
healthcheck:
|
||||
test: [ "CMD-SHELL", "/var/wazuh-manager/bin/wazuh-manager-control status 2>/dev/null | grep -q 'not running' && exit 1 || exit 0" ]
|
||||
test: [ "CMD-SHELL", "curl -k -s -o /dev/null https://localhost:55000 || exit 1" ]
|
||||
interval: 15s
|
||||
timeout: 5s
|
||||
retries: 5
|
||||
start_period: 60s
|
||||
ulimits:
|
||||
memlock:
|
||||
soft: -1
|
||||
@@ -31,15 +30,15 @@ services:
|
||||
- WAZUH_NODE_TYPE=master
|
||||
- WAZUH_CLUSTER_BIND_ADDR=0.0.0.0
|
||||
- WAZUH_CLUSTER_NODES=wazuh.master
|
||||
- INDEXER_USERNAME=wazuh-manager
|
||||
- INDEXER_PASSWORD=wazuh-manager
|
||||
- INDEXER_USERNAME=admin
|
||||
- INDEXER_PASSWORD=admin
|
||||
volumes:
|
||||
- master-wazuh-api-configuration:/var/wazuh-manager/api/configuration
|
||||
- master-wazuh-etc:/var/wazuh-manager/etc
|
||||
- master-wazuh-logs:/var/wazuh-manager/logs
|
||||
- master-wazuh-queue:/var/wazuh-manager/queue
|
||||
- master-wazuh-var-multigroups:/var/wazuh-manager/var/multigroups
|
||||
- ./config/root-ca/certs/root-ca.pem:/var/wazuh-manager/etc/certs/root-ca.pem
|
||||
- ./config/wazuh_master/certs/root-ca.pem:/var/wazuh-manager/etc/certs/root-ca.pem
|
||||
- ./config/wazuh_master/certs/wazuh.master.pem:/var/wazuh-manager/etc/certs/manager.pem
|
||||
- ./config/wazuh_master/certs/wazuh.master-key.pem:/var/wazuh-manager/etc/certs/manager-key.pem
|
||||
|
||||
@@ -49,11 +48,11 @@ services:
|
||||
container_name: multi-node-wazuh.worker
|
||||
restart: always
|
||||
healthcheck:
|
||||
test: [ "CMD-SHELL", "/var/wazuh-manager/bin/wazuh-manager-control status 2>/dev/null | grep -v apid | grep -q 'not running' && exit 1 || exit 0" ]
|
||||
interval: 15s
|
||||
test: [ "CMD-SHELL", "timeout 2 bash -c '</dev/tcp/localhost/1514' || exit 1" ]
|
||||
interval: 5s
|
||||
timeout: 5s
|
||||
retries: 5
|
||||
start_period: 60s
|
||||
retries: 10
|
||||
start_period: 30s
|
||||
ulimits:
|
||||
memlock:
|
||||
soft: -1
|
||||
@@ -70,15 +69,15 @@ services:
|
||||
- WAZUH_NODE_TYPE=worker
|
||||
- WAZUH_CLUSTER_BIND_ADDR=0.0.0.0
|
||||
- WAZUH_CLUSTER_NODES=wazuh.master
|
||||
- INDEXER_USERNAME=wazuh-manager
|
||||
- INDEXER_PASSWORD=wazuh-manager
|
||||
- INDEXER_USERNAME=admin
|
||||
- INDEXER_PASSWORD=admin
|
||||
volumes:
|
||||
- worker-wazuh-api-configuration:/var/wazuh-manager/api/configuration
|
||||
- worker-wazuh-etc:/var/wazuh-manager/etc
|
||||
- worker-wazuh-logs:/var/wazuh-manager/logs
|
||||
- worker-wazuh-queue:/var/wazuh-manager/queue
|
||||
- worker-wazuh-var-multigroups:/var/wazuh-manager/var/multigroups
|
||||
- ./config/root-ca/certs/root-ca.pem:/var/wazuh-manager/etc/certs/root-ca.pem
|
||||
- ./config/wazuh_worker/certs/root-ca.pem:/var/wazuh-manager/etc/certs/root-ca.pem
|
||||
- ./config/wazuh_worker/certs/wazuh.worker.pem:/var/wazuh-manager/etc/certs/manager.pem
|
||||
- ./config/wazuh_worker/certs/wazuh.worker-key.pem:/var/wazuh-manager/etc/certs/manager-key.pem
|
||||
|
||||
@@ -114,7 +113,7 @@ services:
|
||||
start_period: 60s
|
||||
volumes:
|
||||
- wazuh-indexer-data-1:/var/lib/wazuh-indexer
|
||||
- ./config/root-ca/certs/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem
|
||||
- ./config/wazuh1_indexer/certs/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem
|
||||
- ./config/wazuh1_indexer/certs/wazuh1.indexer-key.pem:/usr/share/wazuh-indexer/config/certs/indexer-key.pem
|
||||
- ./config/wazuh1_indexer/certs/wazuh1.indexer.pem:/usr/share/wazuh-indexer/config/certs/indexer.pem
|
||||
- ./config/wazuh1_indexer/certs/admin.pem:/usr/share/wazuh-indexer/config/certs/admin.pem
|
||||
@@ -154,7 +153,7 @@ services:
|
||||
start_period: 60s
|
||||
volumes:
|
||||
- wazuh-indexer-data-2:/var/lib/wazuh-indexer
|
||||
- ./config/root-ca/certs/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem
|
||||
- ./config/wazuh2_indexer/certs/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem
|
||||
- ./config/wazuh2_indexer/certs/wazuh2.indexer-key.pem:/usr/share/wazuh-indexer/config/certs/indexer-key.pem
|
||||
- ./config/wazuh2_indexer/certs/wazuh2.indexer.pem:/usr/share/wazuh-indexer/config/certs/indexer.pem
|
||||
|
||||
@@ -192,7 +191,7 @@ services:
|
||||
start_period: 60s
|
||||
volumes:
|
||||
- wazuh-indexer-data-3:/var/lib/wazuh-indexer
|
||||
- ./config/root-ca/certs/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem
|
||||
- ./config/wazuh3_indexer/certs/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem
|
||||
- ./config/wazuh3_indexer/certs/wazuh3.indexer-key.pem:/usr/share/wazuh-indexer/config/certs/indexer-key.pem
|
||||
- ./config/wazuh3_indexer/certs/wazuh3.indexer.pem:/usr/share/wazuh-indexer/config/certs/indexer.pem
|
||||
|
||||
@@ -213,6 +212,8 @@ services:
|
||||
- SERVER_PORT=5601
|
||||
- SERVER_HOST=0.0.0.0
|
||||
- OPENSEARCH_HOSTS=["https://wazuh1.indexer:9200","https://wazuh2.indexer:9200","https://wazuh3.indexer:9200"]
|
||||
- INDEXER_USERNAME=admin
|
||||
- INDEXER_PASSWORD=admin
|
||||
- WAZUH_API_URL=https://wazuh.master
|
||||
- DASHBOARD_USERNAME=kibanaserver
|
||||
- DASHBOARD_PASSWORD=kibanaserver
|
||||
@@ -222,7 +223,7 @@ services:
|
||||
volumes:
|
||||
- ./config/wazuh_dashboard/certs/wazuh.dashboard.pem:/usr/share/wazuh-dashboard/config/certs/wazuh-dashboard.pem
|
||||
- ./config/wazuh_dashboard/certs/wazuh.dashboard-key.pem:/usr/share/wazuh-dashboard/config/certs/wazuh-dashboard-key.pem
|
||||
- ./config/root-ca/certs/root-ca.pem:/usr/share/wazuh-dashboard/config/certs/root-ca.pem
|
||||
- ./config/wazuh_dashboard/certs/root-ca.pem:/usr/share/wazuh-dashboard/config/certs/root-ca.pem
|
||||
- wazuh-dashboard-config:/usr/share/wazuh-dashboard/config
|
||||
- wazuh-dashboard-custom:/usr/share/wazuh-dashboard/plugins/wazuh/public/assets/custom
|
||||
depends_on:
|
||||
|
||||
Executable
+213
@@ -0,0 +1,213 @@
|
||||
docker volume create \
|
||||
--label com.docker.compose.project=$2 \
|
||||
--label com.docker.compose.version=$1 \
|
||||
--label com.docker.compose.volume=wazuh-indexer-data-1 \
|
||||
$2_wazuh-indexer-data-1
|
||||
|
||||
docker volume create \
|
||||
--label com.docker.compose.project=$2 \
|
||||
--label com.docker.compose.version=$1 \
|
||||
--label com.docker.compose.volume=wazuh-indexer-data-2 \
|
||||
$2_wazuh-indexer-data-2
|
||||
|
||||
docker volume create \
|
||||
--label com.docker.compose.project=$2 \
|
||||
--label com.docker.compose.version=$1 \
|
||||
--label com.docker.compose.volume=wazuh-indexer-data-3 \
|
||||
$2_wazuh-indexer-data-3
|
||||
|
||||
docker volume create \
|
||||
--label com.docker.compose.project=$2 \
|
||||
--label com.docker.compose.version=$1 \
|
||||
--label com.docker.compose.volume=master_wazuh_api_configuration \
|
||||
$2_master_wazuh_api_configuration
|
||||
|
||||
docker volume create \
|
||||
--label com.docker.compose.project=$2 \
|
||||
--label com.docker.compose.version=$1 \
|
||||
--label com.docker.compose.volume=master_wazuh_etc \
|
||||
$2_docker_wazuh_etc
|
||||
|
||||
docker volume create \
|
||||
--label com.docker.compose.project=$2 \
|
||||
--label com.docker.compose.version=$1 \
|
||||
--label com.docker.compose.volume=master-wazuh-logs \
|
||||
$2_master-wazuh-logs
|
||||
|
||||
docker volume create \
|
||||
--label com.docker.compose.project=$2 \
|
||||
--label com.docker.compose.version=$1 \
|
||||
--label com.docker.compose.volume=master-wazuh-queue \
|
||||
$2_master-wazuh-queue
|
||||
|
||||
docker volume create \
|
||||
--label com.docker.compose.project=$2 \
|
||||
--label com.docker.compose.version=$1 \
|
||||
--label com.docker.compose.volume=master-wazuh-var-multigroups \
|
||||
$2_master-wazuh-var-multigroups
|
||||
|
||||
docker volume create \
|
||||
--label com.docker.compose.project=$2 \
|
||||
--label com.docker.compose.version=$1 \
|
||||
--label com.docker.compose.volume=master-wazuh-active-response \
|
||||
$2_master-wazuh-active-response
|
||||
|
||||
docker volume create \
|
||||
--label com.docker.compose.project=$2 \
|
||||
--label com.docker.compose.version=$1 \
|
||||
--label com.docker.compose.volume=master-wazuh-etc \
|
||||
$2_master-wazuh-etc
|
||||
|
||||
docker volume create \
|
||||
--label com.docker.compose.project=$2 \
|
||||
--label com.docker.compose.version=$1 \
|
||||
--label com.docker.compose.volume=master-wazuh-var \
|
||||
$2_master-wazuh-var
|
||||
|
||||
docker volume create \
|
||||
--label com.docker.compose.project=$2 \
|
||||
--label com.docker.compose.version=$1 \
|
||||
--label com.docker.compose.volume=worker_wazuh_api_configuration \
|
||||
$2_worker_wazuh_api_configuration
|
||||
|
||||
docker volume create \
|
||||
--label com.docker.compose.project=$2 \
|
||||
--label com.docker.compose.version=$1 \
|
||||
--label com.docker.compose.volume=worker_wazuh_etc \
|
||||
$2_worker-wazuh-etc
|
||||
|
||||
docker volume create \
|
||||
--label com.docker.compose.project=$2 \
|
||||
--label com.docker.compose.version=$1 \
|
||||
--label com.docker.compose.volume=worker-wazuh-logs \
|
||||
$2_worker-wazuh-logs
|
||||
|
||||
docker volume create \
|
||||
--label com.docker.compose.project=$2 \
|
||||
--label com.docker.compose.version=$1 \
|
||||
--label com.docker.compose.volume=worker-wazuh-queue \
|
||||
$2_worker-wazuh-queue
|
||||
|
||||
docker volume create \
|
||||
--label com.docker.compose.project=$2 \
|
||||
--label com.docker.compose.version=$1 \
|
||||
--label com.docker.compose.volume=worker-wazuh-var-multigroups \
|
||||
$2_worker-wazuh-var-multigroups
|
||||
|
||||
docker volume create \
|
||||
--label com.docker.compose.project=$2 \
|
||||
--label com.docker.compose.version=$1 \
|
||||
--label com.docker.compose.volume=worker-wazuh-active-response \
|
||||
$2_worker-wazuh-active-response
|
||||
|
||||
docker volume create \
|
||||
--label com.docker.compose.project=$2 \
|
||||
--label com.docker.compose.version=$1 \
|
||||
--label com.docker.compose.volume=worker-wazuh-etc \
|
||||
$2_worker-wazuh-etc
|
||||
|
||||
docker volume create \
|
||||
--label com.docker.compose.project=$2 \
|
||||
--label com.docker.compose.version=$1 \
|
||||
--label com.docker.compose.volume=worker-wazuh-var \
|
||||
$2_worker-wazuh-var
|
||||
|
||||
docker container run --rm -it \
|
||||
-v wazuh-docker_worker-var:/from \
|
||||
-v $2_worker-wazuh-var:/to \
|
||||
alpine ash -c "cd /from ; cp -avp . /to"
|
||||
|
||||
docker container run --rm -it \
|
||||
-v wazuh-docker_elastic-data-1:/from \
|
||||
-v $2_wazuh-indexer-data-1:/to \
|
||||
alpine ash -c "cd /from ; cp -avp . /to"
|
||||
|
||||
docker container run --rm -it \
|
||||
-v wazuh-docker_elastic-data-2:/from \
|
||||
-v $2_wazuh-indexer-data-2:/to \
|
||||
alpine ash -c "cd /from ; cp -avp . /to"
|
||||
|
||||
docker container run --rm -it \
|
||||
-v wazuh-docker_elastic-data-3:/from \
|
||||
-v $2_wazuh-indexer-data-3:/to \
|
||||
alpine ash -c "cd /from ; cp -avp . /to"
|
||||
|
||||
docker container run --rm -it \
|
||||
-v wazuh-docker_ossec-api-configuration:/from \
|
||||
-v $2_master-wazuh-api-configuration:/to \
|
||||
alpine ash -c "cd /from ; cp -avp . /to"
|
||||
|
||||
docker container run --rm -it \
|
||||
-v wazuh-docker_ossec-etc:/from \
|
||||
-v $2_master-wazuh-etc:/to \
|
||||
alpine ash -c "cd /from ; cp -avp . /to"
|
||||
|
||||
docker container run --rm -it \
|
||||
-v wazuh-docker_ossec-logs:/from \
|
||||
-v $2_master-wazuh-logs:/to \
|
||||
alpine ash -c "cd /from ; cp -avp . /to"
|
||||
|
||||
docker container run --rm -it \
|
||||
-v wazuh-docker_ossec-queue:/from \
|
||||
-v $2_master-wazuh-queue:/to \
|
||||
alpine ash -c "cd /from ; cp -avp . /to"
|
||||
|
||||
docker container run --rm -it \
|
||||
-v wazuh-docker_ossec-var-multigroups:/from \
|
||||
-v $2_master-wazuh-var-multigroups:/to \
|
||||
alpine ash -c "cd /from ; cp -avp . /to"
|
||||
|
||||
docker container run --rm -it \
|
||||
-v wazuh-docker_ossec-active-response:/from \
|
||||
-v $2_master-wazuh-active-response:/to \
|
||||
alpine ash -c "cd /from ; cp -avp . /to"
|
||||
|
||||
docker container run --rm -it \
|
||||
-v wazuh-docker-etc:/from \
|
||||
-v $2_master-wazuh-etc:/to \
|
||||
alpine ash -c "cd /from ; cp -avp . /to"
|
||||
|
||||
docker container run --rm -it \
|
||||
-v wazuh-docker-var:/from \
|
||||
-v $2_master-wazuh-var:/to \
|
||||
alpine ash -c "cd /from ; cp -avp . /to"
|
||||
|
||||
docker container run --rm -it \
|
||||
-v wazuh-docker_worker-ossec-api-configuration:/from \
|
||||
-v $2_worker-wazuh-api-configuration:/to \
|
||||
alpine ash -c "cd /from ; cp -avp . /to"
|
||||
|
||||
docker container run --rm -it \
|
||||
-v wazuh-docker_worker-ossec-etc:/from \
|
||||
-v $2_worker-wazuh-etc:/to \
|
||||
alpine ash -c "cd /from ; cp -avp . /to"
|
||||
|
||||
docker container run --rm -it \
|
||||
-v wazuh-docker_worker-ossec-logs:/from \
|
||||
-v $2_worker-wazuh-logs:/to \
|
||||
alpine ash -c "cd /from ; cp -avp . /to"
|
||||
|
||||
docker container run --rm -it \
|
||||
-v wazuh-docker_worker-ossec-queue:/from \
|
||||
-v $2_worker-wazuh-queue:/to \
|
||||
alpine ash -c "cd /from ; cp -avp . /to"
|
||||
|
||||
docker container run --rm -it \
|
||||
-v wazuh-docker_worker-ossec-var-multigroups:/from \
|
||||
-v $2_worker-wazuh-var-multigroups:/to \
|
||||
alpine ash -c "cd /from ; cp -avp . /to"
|
||||
|
||||
docker container run --rm -it \
|
||||
-v wazuh-docker_worker-ossec-active-response:/from \
|
||||
-v $2_worker-wazuh-active-response:/to \
|
||||
alpine ash -c "cd /from ; cp -avp . /to"
|
||||
|
||||
docker container run --rm -it \
|
||||
-v wazuh-docker_worker-etc:/from \
|
||||
-v $2_worker-wazuh-etc:/to \
|
||||
alpine ash -c "cd /from ; cp -avp . /to"
|
||||
|
||||
docker container run --rm -it \
|
||||
-v wazuh-docker_worker-var:/from \
|
||||
-v $2_worker-wazuh-var:/to \
|
||||
alpine ash -c "cd /from ; cp -avp . /to"
|
||||
@@ -9,11 +9,10 @@ services:
|
||||
wazuh.indexer:
|
||||
condition: service_healthy
|
||||
healthcheck:
|
||||
test: [ "CMD-SHELL", "/var/wazuh-manager/bin/wazuh-manager-control status 2>/dev/null | grep -q 'not running' && exit 1 || exit 0" ]
|
||||
test: [ "CMD-SHELL", "curl -k -s -o /dev/null https://localhost:55000 || exit 1" ]
|
||||
interval: 15s
|
||||
timeout: 5s
|
||||
retries: 5
|
||||
start_period: 60s
|
||||
ulimits:
|
||||
memlock:
|
||||
soft: -1
|
||||
@@ -31,15 +30,15 @@ services:
|
||||
- WAZUH_NODE_NAME=manager
|
||||
- WAZUH_CLUSTER_NODES=wazuh.manager
|
||||
- WAZUH_CLUSTER_BIND_ADDR=wazuh.manager
|
||||
- INDEXER_USERNAME=wazuh-manager
|
||||
- INDEXER_PASSWORD=wazuh-manager
|
||||
- INDEXER_USERNAME=admin
|
||||
- INDEXER_PASSWORD=admin
|
||||
volumes:
|
||||
- wazuh_api_configuration:/var/wazuh-manager/api/configuration
|
||||
- wazuh_etc:/var/wazuh-manager/etc
|
||||
- wazuh_logs:/var/wazuh-manager/logs
|
||||
- wazuh_queue:/var/wazuh-manager/queue
|
||||
- wazuh_var_multigroups:/var/wazuh-manager/var/multigroups
|
||||
- ./config/root-ca/certs/root-ca.pem:/var/wazuh-manager/etc/certs/root-ca.pem
|
||||
- ./config/wazuh_manager/certs/root-ca.pem:/var/wazuh-manager/etc/certs/root-ca.pem
|
||||
- ./config/wazuh_manager/certs/wazuh.manager.pem:/var/wazuh-manager/etc/certs/manager.pem
|
||||
- ./config/wazuh_manager/certs/wazuh.manager-key.pem:/var/wazuh-manager/etc/certs/manager-key.pem
|
||||
|
||||
@@ -74,7 +73,7 @@ services:
|
||||
start_period: 60s
|
||||
volumes:
|
||||
- wazuh-indexer-data:/var/lib/wazuh-indexer
|
||||
- ./config/root-ca/certs/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem
|
||||
- ./config/wazuh_indexer/certs/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem
|
||||
- ./config/wazuh_indexer/certs/wazuh.indexer-key.pem:/usr/share/wazuh-indexer/config/certs/indexer-key.pem
|
||||
- ./config/wazuh_indexer/certs/wazuh.indexer.pem:/usr/share/wazuh-indexer/config/certs/indexer.pem
|
||||
- ./config/wazuh_indexer/certs/admin.pem:/usr/share/wazuh-indexer/config/certs/admin.pem
|
||||
@@ -97,6 +96,8 @@ services:
|
||||
- SERVER_PORT=5601
|
||||
- SERVER_HOST=0.0.0.0
|
||||
- OPENSEARCH_HOSTS=https://wazuh.indexer:9200
|
||||
- INDEXER_USERNAME=admin
|
||||
- INDEXER_PASSWORD=admin
|
||||
- WAZUH_API_URL=https://wazuh.manager
|
||||
- DASHBOARD_USERNAME=kibanaserver
|
||||
- DASHBOARD_PASSWORD=kibanaserver
|
||||
@@ -106,7 +107,7 @@ services:
|
||||
volumes:
|
||||
- ./config/wazuh_dashboard/certs/wazuh.dashboard.pem:/usr/share/wazuh-dashboard/config/certs/dashboard.pem
|
||||
- ./config/wazuh_dashboard/certs/wazuh.dashboard-key.pem:/usr/share/wazuh-dashboard/config/certs/dashboard-key.pem
|
||||
- ./config/root-ca/certs/root-ca.pem:/usr/share/wazuh-dashboard/config/certs/root-ca.pem
|
||||
- ./config/wazuh_dashboard/certs/root-ca.pem:/usr/share/wazuh-dashboard/config/certs/root-ca.pem
|
||||
- wazuh-dashboard-config:/usr/share/wazuh-dashboard/config
|
||||
- wazuh-dashboard-custom:/usr/share/wazuh-dashboard/plugins/wazuh/public/assets/custom
|
||||
depends_on:
|
||||
|
||||
+56
-80
@@ -9,8 +9,6 @@ DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
||||
LOG_FILE="${DIR}/tools/repository_bumper_$(date +"%Y-%m-%d_%H-%M-%S-%3N").log"
|
||||
VERSION=""
|
||||
STAGE=""
|
||||
TAG=""
|
||||
REFERENCE=""
|
||||
FILES_EDITED=()
|
||||
FILES_EXCLUDED='--exclude="repository_bumper_*.log" --exclude="CHANGELOG.md" --exclude="repository_bumper.sh" --exclude="*_bumper_repository.yml" --exclude="mermaid-init.js" --exclude="mermaid.min.js"'
|
||||
|
||||
@@ -76,44 +74,40 @@ update_stage_in_files() {
|
||||
FILES_EDITED+=("${file}")
|
||||
fi
|
||||
done
|
||||
}
|
||||
|
||||
# Compute the value written into branch reference defaults ("<key>: '...'").
|
||||
# Without --tag, references stay branch-like (e.g. 5.0.0).
|
||||
# With --tag, references become tag-like (e.g. v5.0.0-beta3), or a plain release
|
||||
# tag (e.g. v5.0.0) when no stage is provided.
|
||||
build_reference() {
|
||||
if [[ -n "$TAG" ]]; then
|
||||
if [[ -z "$STAGE" ]]; then
|
||||
REFERENCE="v${VERSION}"
|
||||
else
|
||||
REFERENCE="v${VERSION}-${STAGE}"
|
||||
fi
|
||||
else
|
||||
REFERENCE="${VERSION}"
|
||||
if [ $STAGE != "alpha0" ]; then
|
||||
version_tag_string=": 'v${VERSION}'"
|
||||
files_tag=( $(grep_command "${version_tag_string}" "${DIR}") )
|
||||
for file in "${files_tag[@]}"; do
|
||||
sed -i -E "s/(: )'v${VERSION}'/\1'v${VERSION}-${STAGE}'/g" "${file}"
|
||||
if [[ $(git diff --name-only "${file}") ]]; then
|
||||
FILES_EDITED+=("${file}")
|
||||
fi
|
||||
done
|
||||
|
||||
version_number_string=": '${VERSION}'"
|
||||
files_version=( $(grep -RlE ": '[0-9]\.[0-9]+\.[0-9]+'" "${DIR}") )
|
||||
for file in "${files_version[@]}"; do
|
||||
sed -i -E "s/(: )'${VERSION}'/\1'v${VERSION}-${STAGE}'/g" "${file}"
|
||||
if [[ $(git diff --name-only "${file}") ]]; then
|
||||
FILES_EDITED+=("${file}")
|
||||
fi
|
||||
done
|
||||
fi
|
||||
}
|
||||
|
||||
# Tag mode only: normalize every reference to the current version
|
||||
# (branch-like "5.0.0", "v5.0.0" or "v5.0.0-<stage>") into ${REFERENCE}.
|
||||
# Matching is restricted to "<key>: '...'" entries so plain version strings
|
||||
# elsewhere in the repository are left untouched.
|
||||
update_tag_references() {
|
||||
local V_ESC="${VERSION//./\\.}"
|
||||
files=( $(grep_command "${VERSION}" "${DIR}") )
|
||||
for file in "${files[@]}"; do
|
||||
sed -Ei "s/(:[[:space:]]*')v?${V_ESC}(-[A-Za-z0-9]+)?(')/\1${REFERENCE}\3/g" "${file}"
|
||||
if [[ $(git diff --name-only "${file}") ]]; then
|
||||
FILES_EDITED+=("${file}")
|
||||
fi
|
||||
done
|
||||
}
|
||||
|
||||
update_main_in_files() {
|
||||
local main_string=": 'main'"
|
||||
if [[ $STAGE == "alpha0" ]]; then
|
||||
bump_value="${VERSION}"
|
||||
else
|
||||
bump_value="v${VERSION}"
|
||||
fi
|
||||
main_string=": 'main'"
|
||||
files=( $(grep_command "${main_string}" "${DIR}") )
|
||||
for file in "${files[@]}"; do
|
||||
sed -Ei "s/(:[[:space:]])'main'/\1'${REFERENCE}'/g" "${file}"
|
||||
if [[ "$skip_urls" != "yes" ]]; then
|
||||
sed -Ei "s/(:[[:space:]])'main'/\1'${bump_value}'/g" "${file}"
|
||||
fi
|
||||
if [[ $(git diff --name-only "${file}") ]]; then
|
||||
FILES_EDITED+=("${file}")
|
||||
fi
|
||||
@@ -147,8 +141,8 @@ main() {
|
||||
shift 2
|
||||
;;
|
||||
--tag)
|
||||
TAG="yes"
|
||||
shift 1
|
||||
TAG="$2"
|
||||
shift 2
|
||||
;;
|
||||
--set-as-main)
|
||||
set_as_main="yes"
|
||||
@@ -161,33 +155,15 @@ main() {
|
||||
esac
|
||||
done
|
||||
|
||||
# --tag rewrites branch references into tag-like references (e.g. v5.0.0-beta3)
|
||||
# and re-tags the Docker images accordingly. It is mutually exclusive with
|
||||
# --set-as-main, which keeps references on main.
|
||||
if [[ -n "$TAG" && -n "$set_as_main" ]]; then
|
||||
echo "Error: --tag cannot be combined with --set-as-main." | tee -a "${LOG_FILE}"
|
||||
# Validate arguments
|
||||
if [[ -z "${VERSION}" ]]; then
|
||||
echo "Error: --version argument is required." | tee -a "${LOG_FILE}"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Read the current version/stage early: tag scenarios may omit --version and/or
|
||||
# --stage and reuse the values already stored in VERSION.json.
|
||||
get_old_version_and_stage
|
||||
|
||||
# Resolve and validate arguments depending on the mode
|
||||
if [[ -n "$TAG" ]]; then
|
||||
# Tag mode: version defaults to the current one; stage is optional
|
||||
# (absent yields a release tag without a stage suffix).
|
||||
[[ -z "$VERSION" ]] && VERSION="$OLD_VERSION"
|
||||
else
|
||||
# Branch mode: a full version + stage bump is required
|
||||
if [[ -z "${VERSION}" ]]; then
|
||||
echo "Error: --version argument is required." | tee -a "${LOG_FILE}"
|
||||
exit 1
|
||||
fi
|
||||
if [[ -z "${STAGE}" ]]; then
|
||||
echo "Error: --stage argument is required." | tee -a "${LOG_FILE}"
|
||||
exit 1
|
||||
fi
|
||||
if [[ -z "${STAGE}" ]]; then
|
||||
echo "Error: --stage argument is required." | tee -a "${LOG_FILE}"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Validate if version is in the correct format
|
||||
@@ -196,25 +172,28 @@ main() {
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Validate if stage is in the correct format (when provided)
|
||||
if [[ -n "${STAGE}" ]]; then
|
||||
STAGE=$(echo "${STAGE}" | tr '[:upper:]' '[:lower:]')
|
||||
if ! [[ "${STAGE}" =~ ^(alpha[0-9]*|beta[0-9]*|rc[0-9]*|stable)$ ]]; then
|
||||
echo "Error: Stage must be one of the following examples: alpha1, beta1, rc1, stable." | tee -a "${LOG_FILE}"
|
||||
exit 1
|
||||
fi
|
||||
# Validate if stage is in the correct format
|
||||
STAGE=$(echo "${STAGE}" | tr '[:upper:]' '[:lower:]')
|
||||
if ! [[ "${STAGE}" =~ ^(alpha[0-9]*|beta[0-9]*|rc[0-9]*|stable)$ ]]; then
|
||||
echo "Error: Stage must be one of the following examples: alpha1, beta1, rc1, stable." | tee -a "${LOG_FILE}"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Compute the value written into branch reference defaults
|
||||
build_reference
|
||||
echo "Reference for branch defaults: ${REFERENCE}" | tee -a "${LOG_FILE}"
|
||||
|
||||
# Convert 'main' references unless they must keep pointing to main (set-as-main)
|
||||
# Set skip_urls variable based on set_as_main flag
|
||||
if [[ -z "$set_as_main" ]]; then
|
||||
echo "Updating 'main' references to ${REFERENCE}" | tee -a "${LOG_FILE}"
|
||||
update_main_in_files
|
||||
echo "Updating version from main to $VERSION" | tee -a "${LOG_FILE}"
|
||||
update_main_in_files "$VERSION" "$STAGE"
|
||||
fi
|
||||
|
||||
# Validate if tag is true or false
|
||||
if [[ -n "${TAG}" && ! "${TAG}" =~ ^(true|false)$ ]]; then
|
||||
echo "Error: --tag must be either true or false." | tee -a "${LOG_FILE}"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Get old version and stage
|
||||
get_old_version_and_stage
|
||||
|
||||
if [[ "${OLD_VERSION}" != "${VERSION}" ]]; then
|
||||
echo "Updating version from ${OLD_VERSION} to ${VERSION}" | tee -a "${LOG_FILE}"
|
||||
update_version_in_files "${VERSION}"
|
||||
@@ -224,13 +203,10 @@ main() {
|
||||
update_stage_in_files "$VERSION" "$STAGE"
|
||||
fi
|
||||
|
||||
# Tag mode: normalize remaining version references and re-tag the Docker images
|
||||
# (image tags carry no leading 'v', e.g. 5.0.0-beta3).
|
||||
if [[ -n "$TAG" ]]; then
|
||||
echo "Updating version references to tag reference ${REFERENCE}" | tee -a "${LOG_FILE}"
|
||||
update_tag_references
|
||||
echo "Updating Docker images tag to ${REFERENCE#v}" | tee -a "${LOG_FILE}"
|
||||
update_docker_images_tag "${REFERENCE#v}"
|
||||
# Update Docker images tag if tag is true
|
||||
if [[ "${TAG}" == "true" ]]; then
|
||||
echo "Updating Docker images tag to ${VERSION}-${STAGE}" | tee -a "${LOG_FILE}"
|
||||
update_docker_images_tag "${VERSION}-${STAGE}"
|
||||
fi
|
||||
|
||||
|
||||
|
||||
@@ -77,8 +77,6 @@ node_to_dir() {
|
||||
# ---------------------------------------------------------------------------
|
||||
|
||||
# Parse config.yml
|
||||
export WAZUH_UID=101
|
||||
export WAZUH_GID=101
|
||||
if $DO_COPY || $DO_PRIV; then
|
||||
if [ ! -f "$CONFIG_FILE" ]; then
|
||||
echo "Error: Configuration file $CONFIG_FILE not found."
|
||||
@@ -104,6 +102,7 @@ if $DO_COPY; then
|
||||
echo "Copying certificates for indexer: $node -> config/$dir_name/certs/"
|
||||
mkdir -p "./config/$dir_name/certs"
|
||||
cp "$OUTPUT_DIR/${node}"* "./config/$dir_name/certs/"
|
||||
cp "$OUTPUT_DIR"/root-ca* "./config/$dir_name/certs/"
|
||||
if $FIRST_INDEXER; then
|
||||
cp "$OUTPUT_DIR"/admin* "./config/$dir_name/certs/"
|
||||
FIRST_INDEXER=false
|
||||
@@ -115,6 +114,7 @@ if $DO_COPY; then
|
||||
echo "Copying certificates for manager: $node -> config/$dir_name/certs/"
|
||||
mkdir -p "./config/$dir_name/certs"
|
||||
cp "$OUTPUT_DIR/${node}"* "./config/$dir_name/certs/"
|
||||
cp "$OUTPUT_DIR"/root-ca* "./config/$dir_name/certs/"
|
||||
done
|
||||
|
||||
for node in "${DASHBOARD_NODES[@]}"; do
|
||||
@@ -122,37 +122,32 @@ if $DO_COPY; then
|
||||
echo "Copying certificates for dashboard: $node -> config/$dir_name/certs/"
|
||||
mkdir -p "./config/$dir_name/certs"
|
||||
cp "$OUTPUT_DIR/${node}"* "./config/$dir_name/certs/"
|
||||
cp "$OUTPUT_DIR"/root-ca* "./config/$dir_name/certs/"
|
||||
done
|
||||
echo "Copying root-ca certificates -> config/root-ca/certs/"
|
||||
mkdir -p "./config/root-ca/certs"
|
||||
cp "$OUTPUT_DIR"/root-ca* "./config/root-ca/certs/"
|
||||
fi
|
||||
|
||||
# 3. Set ownership and permissions
|
||||
if $DO_PRIV; then
|
||||
for node in "${INDEXER_NODES[@]}"; do
|
||||
dir_name=$(node_to_dir "$node")
|
||||
echo "Setting permissions for indexer $node (${WAZUH_UID}:${WAZUH_GID})"
|
||||
chown -R ${WAZUH_UID}:${WAZUH_GID} "./config/$dir_name/certs"
|
||||
echo "Setting permissions for indexer $node (1000:1000)"
|
||||
chown -R 1000:1000 "./config/$dir_name/certs"
|
||||
chmod 400 "./config/$dir_name/certs/"*
|
||||
done
|
||||
|
||||
for node in "${MANAGER_NODES[@]}"; do
|
||||
dir_name=$(node_to_dir "$node")
|
||||
echo "Setting permissions for manager $node (${WAZUH_UID}:${WAZUH_GID})"
|
||||
chown -R ${WAZUH_UID}:${WAZUH_GID} "./config/$dir_name/certs"
|
||||
echo "Setting permissions for manager $node (999:999)"
|
||||
chown -R 999:999 "./config/$dir_name/certs"
|
||||
chmod 400 "./config/$dir_name/certs/"*
|
||||
done
|
||||
|
||||
for node in "${DASHBOARD_NODES[@]}"; do
|
||||
dir_name=$(node_to_dir "$node")
|
||||
echo "Setting permissions for dashboard $node (${WAZUH_UID}:${WAZUH_GID})"
|
||||
chown -R ${WAZUH_UID}:${WAZUH_GID} "./config/$dir_name/certs"
|
||||
echo "Setting permissions for dashboard $node (1000:1000)"
|
||||
chown -R 1000:1000 "./config/$dir_name/certs"
|
||||
chmod 400 "./config/$dir_name/certs/"*
|
||||
done
|
||||
echo "Setting permissions for root-ca certificates (${WAZUH_UID}:${WAZUH_GID})"
|
||||
chown -R ${WAZUH_UID}:${WAZUH_GID} "./config/root-ca/certs"
|
||||
chmod 400 "./config/root-ca/certs/"*
|
||||
fi
|
||||
|
||||
echo "Process completed."
|
||||
|
||||
@@ -5,4 +5,3 @@ services:
|
||||
restart: always
|
||||
environment:
|
||||
- WAZUH_MANAGER_SERVER=<WAZUH_MANAGER_IP>
|
||||
- WAZUH_REGISTRATION_PASSWORD=<authd.pass-PASSWORD>
|
||||
|
||||
Reference in New Issue
Block a user