Add documentation and update changelog

Update CHANGELOG.md format (#3647)

.github/workflows/4_build_and_push_images.yml

@@ -6,7 +6,7 @@ on:
     inputs:
       image_tag:
         description: 'Docker image tag'
-        default: '4.14.7'
+        default: '4.14.8'
         required: true
       docker_reference:
         description: 'wazuh-docker reference'
@@ -38,7 +38,7 @@ on:
     inputs:
       image_tag:
         description: 'Docker image tag'
-        default: '4.14.7'
+        default: '4.14.8'
         required: true
         type: string
       docker_reference:

.github/workflows/4_bumper_repository.yml

@@ -110,13 +110,21 @@ jobs:
           bash ${{ env.BUMP_SCRIPT_PATH }} ${{ steps.vars.outputs.script_params }}
 
       - name: Commit and push changes
+        id: bump_commit
         run: |
           git add .
-          git commit -m "feat: bump ${{ github.ref_name }}"
-          git push origin ${{ steps.vars.outputs.branch_name }}
+          if git diff --staged --quiet; then
+            echo "Nothing to bump: the repository is already at the requested version/stage. Skipping commit."
+            echo "has_changes=false" >> $GITHUB_OUTPUT
+          else
+            git commit -m "feat: bump ${{ github.ref_name }}"
+            git push origin ${{ steps.vars.outputs.branch_name }}
+            echo "has_changes=true" >> $GITHUB_OUTPUT
+          fi
 
       - name: Create pull request
         id: create_pr
+        if: steps.bump_commit.outputs.has_changes == 'true'
         run: |
           gh auth setup-git
           PR_URL=$(gh pr create \
@@ -129,14 +137,19 @@ jobs:
           echo "pull_request_url=${PR_URL}" >> $GITHUB_OUTPUT
 
       - name: Merge pull request
+        if: steps.bump_commit.outputs.has_changes == 'true'
         run: |
           # Any checks for the PR are bypassed since the branch is expected to be functional (i.e. the bump process does not introduce any bugs)
           gh pr merge "${{ steps.create_pr.outputs.pull_request_url }}" --merge --admin
 
       - name: Show logs
         run: |
-          echo "Bump complete."
-          echo "Branch: ${{ steps.vars.outputs.branch_name }}"
-          echo "PR: ${{ steps.create_pr.outputs.pull_request_url }}"
+          if [[ "${{ steps.bump_commit.outputs.has_changes }}" == "true" ]]; then
+            echo "Bump complete."
+            echo "Branch: ${{ steps.vars.outputs.branch_name }}"
+            echo "PR: ${{ steps.create_pr.outputs.pull_request_url }}"
+          else
+            echo "Bump skipped: the repository is already at the requested version/stage."
+          fi
           echo "Bumper scripts logs:"
           cat ${BUMP_LOG_PATH}/repository_bumper*log

.github/workflows/5_build_and_push_images.yml

@@ -6,7 +6,7 @@ on:
     inputs:
       image_tag:
         description: 'Docker image tag'
-        default: 'v5.0.0-beta4'
+        default: '5.0.0'
         required: true
       docker_reference:
         description: 'wazuh-docker reference'
@@ -14,7 +14,7 @@ on:
       wazuh_automation_reference:
         description: 'Branch or tag of the wazuh-automation repository'
         required: false
-        default: 'v5.0.0-beta4'
+        default: '5.0.0'
       products:
         description: 'Comma-separated list of the image names to build and push'
         default: 'wazuh-manager,wazuh-dashboard,wazuh-indexer,wazuh-agent'
@@ -42,7 +42,7 @@ on:
     inputs:
       image_tag:
         description: 'Docker image tag'
-        default: 'v5.0.0-beta4'
+        default: '5.0.0'
         required: true
         type: string
       docker_reference:
@@ -52,7 +52,7 @@ on:
       wazuh_automation_reference:
         description: 'Branch or tag of the wazuh-automation repository'
         required: false
-        default: 'v5.0.0-beta4'
+        default: '5.0.0'
         type: string
       products:
         description: 'Comma-separated list of the image names to build and push'

.github/workflows/5_check_integration_tools.yml

@@ -16,7 +16,7 @@ on:
       automation_reference:
         description: 'Branch of wazuh-automation to use'
         required: false
-        default: 'v5.0.0-beta4'
+        default: '5.0.0'
         type: string
       deployment_type:
         description: 'Deployment type to test'

CHANGELOG.md

@@ -2,78 +2,89 @@
 
 ### Added
 
-- Set authd password in agents installation. ([#2524](https://github.com/wazuh/wazuh-docker/issues/2524))
-- Added bump-issue-link support for Revert Stage Bump. ([#2505](https://github.com/wazuh/wazuh-docker/pull/2505))
-- Add integration test module docs ([#2491](https://github.com/wazuh/wazuh-docker/pull/2491))
-- Implement the wazuh-docker integration testing module ([#2188](https://github.com/wazuh/wazuh-docker/issues/2188))
-- Support Revert bump functionality in wazuh-docker ([#2320](https://github.com/wazuh/wazuh-docker/issues/2320))
-- Docker and AMI workflows failing during stage release (v5.0.0-beta1) ([#35457](https://github.com/wazuh/wazuh/issues/35457))
-- Add `--set-as-main` flag support to repository bumper — `wazuh-docker` ([#2276](https://github.com/wazuh/wazuh-docker/issues/2276))
+
+| Issue | Comment |
+| - | - |
+| [#2524](https://github.com/wazuh/wazuh-docker/issues/2524) | Set authd password in agents installation. |
+| [#2505](https://github.com/wazuh/wazuh-docker/pull/2505) | Added bump-issue-link support for Revert Stage Bump. |
+| [#2491](https://github.com/wazuh/wazuh-docker/pull/2491) | Add integration test module docs |
+| [#2188](https://github.com/wazuh/wazuh-docker/issues/2188) | Implement the wazuh-docker integration testing module |
+| [#2320](https://github.com/wazuh/wazuh-docker/issues/2320) | Support Revert bump functionality in wazuh-docker |
+| [#35457](https://github.com/wazuh/wazuh/issues/35457) | Docker and AMI workflows failing during stage release (v5.0.0-beta1) |
+| [#2276](https://github.com/wazuh/wazuh-docker/issues/2276) | Add `--set-as-main` flag support to repository bumper — `wazuh-docker` |
 
 ### Changed
 
-- Update deployment for Wazuh Indexer 5.0.0 RBAC ([#2537](https://github.com/wazuh/wazuh-docker/issues/2537))
-- Add new WF for changelog check ([#2539](https://github.com/wazuh/wazuh-docker/pull/2539))
-- Change artifact upload and download ([#2502](https://github.com/wazuh/wazuh-docker/issues/2502))
-- Change runners on repository workflows 5.x ([#2471](https://github.com/wazuh/wazuh-docker/issues/2471))
-- PR revamp modifications 5.x ([#2446](https://github.com/wazuh/wazuh-docker/issues/2446))
-- Forbid pr_check workflow execution in draft PRs ([#2399](https://github.com/wazuh/wazuh-docker/issues/2399))
-- Unification of user UID and GID ([#2375](https://github.com/wazuh/wazuh-docker/issues/2375))
-- Wazuh indexer engine requirements ([#2392](https://github.com/wazuh/wazuh-docker/issues/2392))
-- Image build process update ([#2356](https://github.com/wazuh/wazuh-docker/issues/2356))
-- Add new path on artifact_urls file ([#2344](https://github.com/wazuh/wazuh-docker/issues/2344))
-- Unable to generate single component in `Procedure_push_docker_images` ([#2341](https://github.com/wazuh/wazuh-docker/issues/2341))
-- Adapt bumper workflows to change main branch ([#2294](https://github.com/wazuh/wazuh-docker/issues/2294))
-- Ensure default values are used for variables and passwords ([#2288](https://github.com/wazuh/wazuh-docker/issues/2288))
-- Docker - Ensure correct Wazuh manager certificates ownership ([#2283](https://github.com/wazuh/wazuh-docker/issues/2283))
-- Docker - Standarize Artifact URL keys ([#2278](https://github.com/wazuh/wazuh-docker/issues/2278))
-- Modify artifact URLs file name. ([#2266](https://github.com/wazuh/wazuh-docker/issues/2266))
-- URL presigned file -  Update the Wazuh Docker image creation workflow ([#2218](https://github.com/wazuh/wazuh-docker/issues/2218))
-- Updated wazuh-docker documentation config and tooling versions to meet new standards. ([#2264](https://github.com/wazuh/wazuh-docker/issues/2264))
-- Align cert generation steps with current cert-tool ip validation ([#2250](https://github.com/wazuh/wazuh-docker/issues/2250))
-- Modify Healthchecks ([#2252](https://github.com/wazuh/wazuh-docker/issues/2252))
-- Add deployment healthchecks ([#2251](https://github.com/wazuh/wazuh-docker/issues/2251))
-- Update artifact generation jobs to use wz-linux dedicated runner group ([#2242](https://github.com/wazuh/wazuh-docker/issues/2242))
-- Error during Wazuh manager entrypoint ([#2237](https://github.com/wazuh/wazuh-docker/issues/2237))
-- Adapt PR test for workflow_dispatch option ([#2230](https://github.com/wazuh/wazuh-docker/issues/2230))
-- Wazuh Manager/agent Separation - Breaking changes summary ([#2227](https://github.com/wazuh/wazuh-docker/issues/2227))
-- Errors in wazuh-docker PR Test ([#2222](https://github.com/wazuh/wazuh-docker/issues/2222))
-- Development - Separate Agent/Manager - Docker - Adapt image build process ([#2206](https://github.com/wazuh/wazuh-docker/issues/2206))
-- Remove revision input ([#2217](https://github.com/wazuh/wazuh-docker/issues/2217))
-- Build images script improvement ([#2196](https://github.com/wazuh/wazuh-docker/issues/2196))
-- Missing documentation in the wazuh-docker repository ([#2197](https://github.com/wazuh/wazuh-docker/issues/2197))
-- Add Wazuh version and revision into wazuh-certs-tool and config file ([#2195](https://github.com/wazuh/wazuh-docker/issues/2195))
-- Improve S3 artifact URLs handling ([#2172](https://github.com/wazuh/wazuh-docker/issues/2172))
-- Allow building separate targets ([#2164](https://github.com/wazuh/wazuh-docker/issues/2164))
-- Add developement option when tag name is only version without stage ([#2179](https://github.com/wazuh/wazuh-docker/issues/2179))
-- Add IMAGE_TAG stage reference ([#2178](https://github.com/wazuh/wazuh-docker/issues/2178))
-- Remove Wazuh agent configuration template ([#2171](https://github.com/wazuh/wazuh-docker/issues/2171))
-- Docker - Ensure `run_as` set to true for every deployment alternative ([#2156](https://github.com/wazuh/wazuh-docker/issues/2156))
-- Change macOS and Windows deployment documentation ([#2150](https://github.com/wazuh/wazuh-docker/issues/2150))
-- Modify docker build image process ([#2131](https://github.com/wazuh/wazuh-docker/issues/2131))
-- Update documentation for Wazuh Docker image builder and workflow usage ([#2136](https://github.com/wazuh/wazuh-docker/issues/2136))
-- Configure deployment with environment variables ([#2081](https://github.com/wazuh/wazuh-docker/issues/2081))
-- Modify Wazuh components install method ([#2058](https://github.com/wazuh/wazuh-docker/issues/2058))
-- Image builder Workflow Rebuild ([#2054](https://github.com/wazuh/wazuh-docker/issues/2054))
-- Remove Wazuh Manager deprecated daemons and CLI tools ([#1933](https://github.com/wazuh/wazuh-docker/issues/1933))
-- DevOps - Docker - OpenSearch 3.0 deprecated settings ([#1891](https://github.com/wazuh/wazuh-docker/issues/1891))
+
+| Issue | Comment |
+| - | - |
+| [#2564](https://github.com/wazuh/wazuh-docker/issues/2564) | Add default AI assistant encryption key in the post installation script |
+| [#2537](https://github.com/wazuh/wazuh-docker/issues/2537) | Update deployment for Wazuh Indexer 5.0.0 RBAC |
+| [#2539](https://github.com/wazuh/wazuh-docker/pull/2539) | Add new WF for changelog check |
+| [#2502](https://github.com/wazuh/wazuh-docker/issues/2502) | Change artifact upload and download |
+| [#2471](https://github.com/wazuh/wazuh-docker/issues/2471) | Change runners on repository workflows 5.x |
+| [#2446](https://github.com/wazuh/wazuh-docker/issues/2446) | PR revamp modifications 5.x |
+| [#2399](https://github.com/wazuh/wazuh-docker/issues/2399) | Forbid pr_check workflow execution in draft PRs |
+| [#2375](https://github.com/wazuh/wazuh-docker/issues/2375) | Unification of user UID and GID |
+| [#2392](https://github.com/wazuh/wazuh-docker/issues/2392) | Wazuh indexer engine requirements |
+| [#2356](https://github.com/wazuh/wazuh-docker/issues/2356) | Image build process update |
+| [#2344](https://github.com/wazuh/wazuh-docker/issues/2344) | Add new path on artifact_urls file |
+| [#2341](https://github.com/wazuh/wazuh-docker/issues/2341) | Unable to generate single component in `Procedure_push_docker_images` |
+| [#2294](https://github.com/wazuh/wazuh-docker/issues/2294) | Adapt bumper workflows to change main branch |
+| [#2288](https://github.com/wazuh/wazuh-docker/issues/2288) | Ensure default values are used for variables and passwords |
+| [#2283](https://github.com/wazuh/wazuh-docker/issues/2283) | Docker - Ensure correct Wazuh manager certificates ownership |
+| [#2278](https://github.com/wazuh/wazuh-docker/issues/2278) | Docker - Standarize Artifact URL keys |
+| [#2266](https://github.com/wazuh/wazuh-docker/issues/2266) | Modify artifact URLs file name. |
+| [#2218](https://github.com/wazuh/wazuh-docker/issues/2218) | URL presigned file -  Update the Wazuh Docker image creation workflow |
+| [#2264](https://github.com/wazuh/wazuh-docker/issues/2264) | Updated wazuh-docker documentation config and tooling versions to meet new standards. |
+| [#2250](https://github.com/wazuh/wazuh-docker/issues/2250) | Align cert generation steps with current cert-tool ip validation |
+| [#2252](https://github.com/wazuh/wazuh-docker/issues/2252) | Modify Healthchecks |
+| [#2251](https://github.com/wazuh/wazuh-docker/issues/2251) | Add deployment healthchecks |
+| [#2242](https://github.com/wazuh/wazuh-docker/issues/2242) | Update artifact generation jobs to use wz-linux dedicated runner group |
+| [#2237](https://github.com/wazuh/wazuh-docker/issues/2237) | Error during Wazuh manager entrypoint |
+| [#2230](https://github.com/wazuh/wazuh-docker/issues/2230) | Adapt PR test for workflow_dispatch option |
+| [#2227](https://github.com/wazuh/wazuh-docker/issues/2227) | Wazuh Manager/agent Separation - Breaking changes summary |
+| [#2222](https://github.com/wazuh/wazuh-docker/issues/2222) | Errors in wazuh-docker PR Test |
+| [#2206](https://github.com/wazuh/wazuh-docker/issues/2206) | Development - Separate Agent/Manager - Docker - Adapt image build process |
+| [#2217](https://github.com/wazuh/wazuh-docker/issues/2217) | Remove revision input |
+| [#2196](https://github.com/wazuh/wazuh-docker/issues/2196) | Build images script improvement |
+| [#2197](https://github.com/wazuh/wazuh-docker/issues/2197) | Missing documentation in the wazuh-docker repository |
+| [#2195](https://github.com/wazuh/wazuh-docker/issues/2195) | Add Wazuh version and revision into wazuh-certs-tool and config file |
+| [#2172](https://github.com/wazuh/wazuh-docker/issues/2172) | Improve S3 artifact URLs handling |
+| [#2164](https://github.com/wazuh/wazuh-docker/issues/2164) | Allow building separate targets |
+| [#2179](https://github.com/wazuh/wazuh-docker/issues/2179) | Add developement option when tag name is only version without stage |
+| [#2178](https://github.com/wazuh/wazuh-docker/issues/2178) | Add IMAGE_TAG stage reference |
+| [#2171](https://github.com/wazuh/wazuh-docker/issues/2171) | Remove Wazuh agent configuration template |
+| [#2156](https://github.com/wazuh/wazuh-docker/issues/2156) | Docker - Ensure `run_as` set to true for every deployment alternative |
+| [#2150](https://github.com/wazuh/wazuh-docker/issues/2150) | Change macOS and Windows deployment documentation |
+| [#2131](https://github.com/wazuh/wazuh-docker/issues/2131) | Modify docker build image process |
+| [#2136](https://github.com/wazuh/wazuh-docker/issues/2136) | Update documentation for Wazuh Docker image builder and workflow usage |
+| [#2081](https://github.com/wazuh/wazuh-docker/issues/2081) | Configure deployment with environment variables |
+| [#2058](https://github.com/wazuh/wazuh-docker/issues/2058) | Modify Wazuh components install method |
+| [#2054](https://github.com/wazuh/wazuh-docker/issues/2054) | Image builder Workflow Rebuild |
+| [#1933](https://github.com/wazuh/wazuh-docker/issues/1933) | Remove Wazuh Manager deprecated daemons and CLI tools |
+| [#1891](https://github.com/wazuh/wazuh-docker/issues/1891) | DevOps - Docker - OpenSearch 3.0 deprecated settings |
 
 ### Removed
 
-- None
+| Issue | Comment |
+| - | - |
 
 ### Fixed
 
-- Fix bumper workflow failure when bump produces no changes ([#2533](https://github.com/wazuh/wazuh-docker/pull/2533))
-- Bumper script issue when the tag is set to false ([#2477](https://github.com/wazuh/wazuh-docker/issues/2477))
-- Fix reported WF vulnerabilities ([#2443](https://github.com/wazuh/wazuh-docker/issues/2443))
-- Adapt Wazuh manager healthcheck with local binaries ([#2422](https://github.com/wazuh/wazuh-docker/issues/2422))
-- The Wazuh Docker image cannot be built during the Nightly ([#2337](https://github.com/wazuh/wazuh-docker/issues/2337))
-- Docker and AMI workflows failing during stage release (v5.0.0-beta1) ([#35457](https://github.com/wazuh/wazuh/issues/35457))
-- PR check issues ([#2274](https://github.com/wazuh/wazuh-docker/issues/2274))
-- Wazuh manager Healthcheck ([#2271](https://github.com/wazuh/wazuh-docker/issues/2271))
-- Delete WAZUH_AGENT_GROUPS of Wazuh 5.0.0 images build ([#2258](https://github.com/wazuh/wazuh-docker/issues/2258))
-- Development - DevOps 5.0 adaptation - Docker - Delete lists directory references ([#2128](https://github.com/wazuh/wazuh-docker/issues/2128))
 
-## Prior version
+| Issue | Comment |
+| - | - |
+| [#2533](https://github.com/wazuh/wazuh-docker/pull/2533) | Fix bumper workflow failure when bump produces no changes |
+| [#2477](https://github.com/wazuh/wazuh-docker/issues/2477) | Bumper script issue when the tag is set to false |
+| [#2443](https://github.com/wazuh/wazuh-docker/issues/2443) | Fix reported WF vulnerabilities |
+| [#2422](https://github.com/wazuh/wazuh-docker/issues/2422) | Adapt Wazuh manager healthcheck with local binaries |
+| [#2337](https://github.com/wazuh/wazuh-docker/issues/2337) | The Wazuh Docker image cannot be built during the Nightly |
+| [#35457](https://github.com/wazuh/wazuh/issues/35457) | Docker and AMI workflows failing during stage release (v5.0.0-beta1) |
+| [#2274](https://github.com/wazuh/wazuh-docker/issues/2274) | PR check issues |
+| [#2271](https://github.com/wazuh/wazuh-docker/issues/2271) | Wazuh manager Healthcheck |
+| [#2258](https://github.com/wazuh/wazuh-docker/issues/2258) | Delete WAZUH_AGENT_GROUPS of Wazuh 5.0.0 images build |
+| [#2128](https://github.com/wazuh/wazuh-docker/issues/2128) | Development - DevOps 5.0 adaptation - Docker - Delete lists directory references |
+
+## Prior versions
 - []()

VERSION.json

@@ -1,4 +1,4 @@
 {
     "version": "5.0.0",
-    "stage": "beta4"
+    "stage": "rc1"
 }

build-docker-images/wazuh-dashboard/Dockerfile

@@ -44,6 +44,9 @@ RUN mkdir -p $INSTALL_DIR/data/wazuh/config && chmod -R 775 $INSTALL_DIR/data/wa
 RUN mkdir -p $INSTALL_DIR/data/wazuh/logs && chmod -R 775 $INSTALL_DIR/data/wazuh/logs
 RUN setcap 'cap_net_bind_service=-ep' /usr/share/wazuh-dashboard/node/bin/node
 
+# Delete default keystore
+RUN if [ -f /etc/wazuh-dashboard/opensearch_dashboards.keystore ]; then rm -f /etc/wazuh-dashboard/opensearch_dashboards.keystore; fi
+
 ################################################################################
 # Build stage 1 (the current Wazuh dashboard image):
 # Copy wazuh-dashboard from builder

build-docker-images/wazuh-dashboard/config/entrypoint.sh

@@ -20,9 +20,14 @@ DASHBOARD_PASSWORD="${DASHBOARD_PASSWORD:-kibanaserver}"
 
 # Create and configure Wazuh dashboard keystore
 
-yes | $OPENSEARCH_DASHBOARDS_HOME/bin/opensearch-dashboards-keystore create --allow-root && \
-echo $DASHBOARD_USERNAME | $OPENSEARCH_DASHBOARDS_HOME/bin/opensearch-dashboards-keystore add opensearch.username --stdin --allow-root && \
-echo $DASHBOARD_PASSWORD | $OPENSEARCH_DASHBOARDS_HOME/bin/opensearch-dashboards-keystore add opensearch.password --stdin --allow-root
+
+if  [ ! -f "$OPENSEARCH_DASHBOARDS_HOME/config/opensearch_dashboards.keystore" ]; then
+    echo "The keystore is not available; creating a new keystore."
+    "$OPENSEARCH_DASHBOARDS_HOME/bin/opensearch-dashboards-keystore" create --allow-root
+    head -c 32 /dev/urandom | base64 | tr -d '\n' | "$OPENSEARCH_DASHBOARDS_HOME/bin/opensearch-dashboards-keystore" add wazuh_ai_assistant.encryptionKey --stdin --allow-root
+fi
+echo $DASHBOARD_USERNAME | "$OPENSEARCH_DASHBOARDS_HOME/bin/opensearch-dashboards-keystore" add opensearch.username --stdin --allow-root -f
+echo $DASHBOARD_PASSWORD | "$OPENSEARCH_DASHBOARDS_HOME/bin/opensearch-dashboards-keystore" add opensearch.password --stdin --allow-root -f
 
 /wazuh_dashboard_config.sh
 

docs/ref/configuration/configuration-files.md

@@ -17,6 +17,14 @@
 * **`opensearch_dashboards.yml`**: The main configuration file for OpenSearch Dashboards. Controls server host/port, OpenSearch connection URL, SSL settings, and Wazuh plugin settings.
     * **Customization**: Mount a custom `opensearch_dashboards.yml` into the dashboard container at `/usr/share/wazuh-dashboard/config/opensearch_dashboards.yml` and custom `wazuh.yml` into the dashboard container at `/usr/share/wazuh-dashboard/data/wazuh/config/wazuh.yml` .
 * **Wazuh Plugin Settings**: The Wazuh plugin for the dashboard has its own configuration, often within `opensearch_dashboards.yml` or managed through environment variables, specifying the Wazuh API URL and credentials.
+* **`opensearch_dashboards.keystore`**: Secure storage for the dashboard secrets, located at `/usr/share/wazuh-dashboard/config/opensearch_dashboards.keystore`. The image is shipped without a keystore; the container entrypoint creates it on the first start and adds a randomly generated `wazuh_ai_assistant.encryptionKey`, which the AI assistant uses to encrypt its data. The `opensearch.username` and `opensearch.password` entries are set on every start from the `DASHBOARD_USERNAME` and `DASHBOARD_PASSWORD` environment variables.
+    * **Customization**: To set your own key, add it through the keystore tool inside the dashboard container and restart the service:
+        ```bash
+        echo "<your-encryption-key>" | docker compose exec -T wazuh.dashboard \
+          /usr/share/wazuh-dashboard/bin/opensearch-dashboards-keystore add wazuh_ai_assistant.encryptionKey --stdin --allow-root -f
+        docker compose restart wazuh.dashboard
+        ```
+    * **Important**: The keystore is created only when it does not already exist, so the encryption key stays stable across restarts as long as the `/usr/share/wazuh-dashboard/config` volume is kept. If the keystore is deleted, the entrypoint generates a new key on the next start and any data encrypted with the previous one becomes unreadable.
 
 ## Applying Configuration Changes
 
@@ -42,6 +50,12 @@ To persist files or directories in your Wazuh deployment, you can mount them as
 
 > **Important**: Ensure that files exist on the host before starting the containers. If the file doesn't exist, Docker will create a directory instead, which may cause startup failures.
 
+### Wazuh Dashboard keystore
+
+The `docker-compose.yml` files mount the named volume `wazuh-dashboard-config` on `/usr/share/wazuh-dashboard/config`, which is where `opensearch_dashboards.keystore` is stored. Keeping this volume preserves the `wazuh_ai_assistant.encryptionKey` generated on the first start.
+
+Removing the volume (for example, with `docker compose down -v`) deletes the keystore. The next start creates a new one with a different encryption key, and data encrypted by the AI assistant with the previous key can no longer be decrypted.
+
 For more information on Docker volumes and bind mounts, refer to the official Docker documentation:
 - [Use volumes](https://docs.docker.com/storage/volumes/)
 - [Bind mounts](https://docs.docker.com/storage/bind-mounts/)

docs/ref/security.md

@@ -7,6 +7,7 @@ This section summarizes security recommendations for Wazuh Docker deployments (s
 - Do not use default credentials. The Compose examples include placeholder values for the Wazuh API, Dashboard, and Indexer access.
 - Prefer injecting secrets at runtime (for example, via your CI/CD secret store or an external secrets manager) instead of hardcoding them in `docker-compose.yml`.
 - Rotate credentials regularly and after any suspected exposure.
+- The Wazuh dashboard keeps its secrets in `opensearch_dashboards.keystore`, persisted in the `wazuh-dashboard-config` volume. It stores the Indexer credentials and the `wazuh_ai_assistant.encryptionKey`, generated at random on the first start and unique per deployment. Restrict access to that volume and to `docker compose exec` on the dashboard container, and do not copy the keystore between deployments.
 
 ## Certificates and TLS
 

docs/ref/upgrade.md

@@ -10,6 +10,8 @@ Below is a step-by-step example of how to perform this update:
    docker-compose down
    ```
 
+   > **Important**: Do not add the `-v` flag. It removes the named volumes, including `wazuh-dashboard-config`, which holds the Wazuh dashboard keystore. Losing that keystore regenerates the `wazuh_ai_assistant.encryptionKey` on the next start and makes the data previously encrypted by the AI assistant unreadable.
+
 2. **Update the image tags**:
    Edit your `docker-compose.yml` file and update the `image` field for all Wazuh services to the desired version.
 
@@ -24,15 +26,15 @@ Below is a step-by-step example of how to perform this update:
    ```yaml
    services:
      wazuh.manager:
-       image: wazuh/wazuh-manager:5.0.0-beta4
+       image: wazuh/wazuh-manager:5.0.0
        ...
 
      wazuh.indexer:
-       image: wazuh/wazuh-indexer:5.0.0-beta4
+       image: wazuh/wazuh-indexer:5.0.0
        ...
 
      wazuh.dashboard:
-       image: wazuh/wazuh-dashboard:5.0.0-beta4
+       image: wazuh/wazuh-dashboard:5.0.0
        ...
    ```
 
@@ -48,27 +50,27 @@ Below is a step-by-step example of how to perform this update:
    ```yaml
    services:
      wazuh.master:
-       image: wazuh/wazuh-manager:5.0.0-beta4
+       image: wazuh/wazuh-manager:5.0.0
        ...
 
      wazuh.worker:
-       image: wazuh/wazuh-manager:5.0.0-beta4
+       image: wazuh/wazuh-manager:5.0.0
        ...
 
      wazuh1.indexer:
-       image: wazuh/wazuh-indexer:5.0.0-beta4
+       image: wazuh/wazuh-indexer:5.0.0
        ...
 
      wazuh2.indexer:
-       image: wazuh/wazuh-indexer:5.0.0-beta4
+       image: wazuh/wazuh-indexer:5.0.0
        ...
 
      wazuh3.indexer:
-       image: wazuh/wazuh-indexer:5.0.0-beta4
+       image: wazuh/wazuh-indexer:5.0.0
        ...
 
      wazuh.dashboard:
-       image: wazuh/wazuh-dashboard:5.0.0-beta4
+       image: wazuh/wazuh-dashboard:5.0.0
        ...
    ```
 

multi-node/docker-compose.yml

@@ -1,7 +1,7 @@
 # Wazuh App Copyright (C) 2017, Wazuh Inc. (License GPLv2)
 services:
   wazuh.master:
-    image: wazuh/wazuh-manager:5.0.0-beta4
+    image: wazuh/wazuh-manager:5.0.0
     hostname: wazuh.master
     container_name: multi-node-wazuh.master
     restart: always
@@ -44,7 +44,7 @@ services:
       - ./config/wazuh_master/certs/wazuh.master-key.pem:/var/wazuh-manager/etc/certs/manager-key.pem
 
   wazuh.worker:
-    image: wazuh/wazuh-manager:5.0.0-beta4
+    image: wazuh/wazuh-manager:5.0.0
     hostname: wazuh.worker
     container_name: multi-node-wazuh.worker
     restart: always
@@ -83,7 +83,7 @@ services:
       - ./config/wazuh_worker/certs/wazuh.worker-key.pem:/var/wazuh-manager/etc/certs/manager-key.pem
 
   wazuh1.indexer:
-    image: wazuh/wazuh-indexer:5.0.0-beta4
+    image: wazuh/wazuh-indexer:5.0.0
     hostname: wazuh1.indexer
     container_name: multi-node-wazuh1.indexer
     restart: always
@@ -121,7 +121,7 @@ services:
       - ./config/wazuh1_indexer/certs/admin-key.pem:/usr/share/wazuh-indexer/config/certs/admin-key.pem
 
   wazuh2.indexer:
-    image: wazuh/wazuh-indexer:5.0.0-beta4
+    image: wazuh/wazuh-indexer:5.0.0
     hostname: wazuh2.indexer
     container_name: multi-node-wazuh2.indexer
     restart: always
@@ -159,7 +159,7 @@ services:
       - ./config/wazuh2_indexer/certs/wazuh2.indexer.pem:/usr/share/wazuh-indexer/config/certs/indexer.pem
 
   wazuh3.indexer:
-    image: wazuh/wazuh-indexer:5.0.0-beta4
+    image: wazuh/wazuh-indexer:5.0.0
     hostname: wazuh3.indexer
     container_name: multi-node-wazuh3.indexer
     restart: always
@@ -197,7 +197,7 @@ services:
       - ./config/wazuh3_indexer/certs/wazuh3.indexer.pem:/usr/share/wazuh-indexer/config/certs/indexer.pem
 
   wazuh.dashboard:
-    image: wazuh/wazuh-dashboard:5.0.0-beta4
+    image: wazuh/wazuh-dashboard:5.0.0
     hostname: wazuh.dashboard
     container_name: multi-node-wazuh.dashboard
     restart: always

single-node/docker-compose.yml

@@ -1,7 +1,7 @@
 # Wazuh App Copyright (C) 2017, Wazuh Inc. (License GPLv2)
 services:
   wazuh.manager:
-    image: wazuh/wazuh-manager:5.0.0-beta4
+    image: wazuh/wazuh-manager:5.0.0
     hostname: wazuh.manager
     container_name: single-node-wazuh.manager
     restart: always
@@ -44,7 +44,7 @@ services:
       - ./config/wazuh_manager/certs/wazuh.manager-key.pem:/var/wazuh-manager/etc/certs/manager-key.pem
 
   wazuh.indexer:
-    image: wazuh/wazuh-indexer:5.0.0-beta4
+    image: wazuh/wazuh-indexer:5.0.0
     hostname: wazuh.indexer
     container_name: single-node-wazuh.indexer
     restart: always
@@ -81,7 +81,7 @@ services:
       - ./config/wazuh_indexer/certs/admin-key.pem:/usr/share/wazuh-indexer/config/certs/admin-key.pem
 
   wazuh.dashboard:
-    image: wazuh/wazuh-dashboard:5.0.0-beta4
+    image: wazuh/wazuh-dashboard:5.0.0
     hostname: wazuh.dashboard
     container_name: single-node-wazuh.dashboard
     restart: always

wazuh-agent/docker-compose.yml

@@ -1,7 +1,7 @@
 # Wazuh App Copyright (C) 2017, Wazuh Inc. (License GPLv2)
 services:
   wazuh.agent:
-    image: wazuh/wazuh-agent:5.0.0-beta4
+    image: wazuh/wazuh-agent:5.0.0
     restart: always
     environment:
       - WAZUH_MANAGER_SERVER=<WAZUH_MANAGER_IP>