DaemonSet container progress

[nshenry03]

Hi @jesuslinares,

Thank you for the work you've done here; it's great and really helpful.

You mention in the instructions that you are researching if the agent is able to run as a DaemonSet container:

We are researching if the agent is able to run as a DaemonSet container. A DaemonSet is a special type of Pod which is logically guaranteed to run on each Kubernetes node. This kind of agent will have access only to its container, so we should mount volumes used by other containers to monitor logs, files, etc.

Has there been any progress on this? Seems to be a requirement for my team rather than installing the agent on the host. Any help or advice would be appreciated.

Thanks!

[jesuslinares]

Hi @nshenry03 ,

I didn't have the chance to implement and test it, but it should not be complicated.

Usually, we install the Wazuh agent in the Docker host, so it is able to access logs from other containers, run commands, use the Docker wodle, etc. If you install the Wazuh agent in a container (using a DaemonSet), you need to grant access from that pod to the things you want to monitor. So, the real challenge is how to configure or improve the Wazuh agent to be more powerful in container environments. That is the part that we are researching. Any feedback is welcome.

This is a related issue in Wazuh mailing list: https://groups.google.com/forum/#!topic/wazuh/tlFKymhOm_Q.

I hope it helps.

[lshahar]

There is any eta to release the daemonset / docker image for testing? I would like to use it :+1:

[chowmean]

Hi @jesuslinares and @nshenry03 , I would like to take this forwards. Will you be able to share the knowledge or track that you have decided. I will try to take this forward from there.

[konangc87]

@jesuslinares, @Dwordcito Another user asked when the support to monitor/collect info using an agent as a deamonset will be available. Here's the slack link: https://wazuh.slack.com/archives/C0A933R8E/p1606837317137900 and the user question: "I launched a wazuh agent as daemonset in kubernetes. If I understand correctly, then there is no way to collect information about the system’s packages/osts and send reports on OS HOST, right? Is there any plan to make such support in future versions?" Do we have any update on this? Thanks

[pyToshka]

You can check my example of daemon set for agent https://github.com/pyToshka/docker-wazuh-agent/blob/main/wazuh-daemonset.yaml

[cakhanif]

Hi @pyToshka , is this work?

[pyToshka]

@cakhanif yes it is

[Umair841]

hey guys ..!! I have deployed Wazuh DemonSet and it is successfully working ..!! but in my manager alerts, I am getting only events/logs for Start/stop and exec logs ..!! how can I get every bit of log of container for example "installing any package or executing any command in container" here My WazuhDemonSet file

apiVersion: apps/v1 kind: DaemonSet metadata: name: wazuh-daemonset namespace: default labels: k8s-app: wazuh-daemonset spec: selector: matchLabels: name: wazuh-daemonset template: metadata: labels: name: wazuh-daemonset spec: tolerations:

this toleration is to have the daemonset runnable on master nodes

  # remove it if your masters can't run pods
  - key: node-role.kubernetes.io/master
    effect: NoSchedule
  containers:
  - name: wazuh-daemonset
    image: <my-Custom-Image>
    resources:
      limits:
        memory: 200Mi
      requests:
        cpu: 100m
        memory: 200Mi
    volumeMounts:
    - name: docker
      mountPath: /var/run/docker.sock
    - name: varlibdockercontainers
      mountPath: /var/lib/docker/containers
    - mountPath: /var/run
      name: var-run
    - mountPath: /host/dev
      name: dev
    - mountPath: /host/sys
      name: sys
      readOnly: true
    - mountPath: /host/proc
      name: proc
      readOnly: true
    - mountPath: /host/etc
      name: etc
      readOnly: true
    - mountPath: /host/boot
      name: boot
      readOnly: true
    - mountPath: /host/usr
      name: usr
      readOnly: true
    - mountPath: /host/lib/modules
      name: modules
      readOnly: true
    - mountPath: /host/var/log
      name: log
      readOnly: true
  terminationGracePeriodSeconds: 5
  volumes:
  - name: varlibdockercontainers
    hostPath:
      path: /var/lib/docker/containers
  - name: docker
    hostPath:
      path: /var/run/docker.sock
  - name: var-run
    hostPath:
      path: /var/run
  - name: dev
    hostPath:
      path: /dev
  - name: sys
    hostPath:
      path: /sys
  - name: proc
    hostPath:
      path: /proc
  - name: etc
    hostPath:
      path: /etc
  - name: boot
    hostPath:
      path: /boot
  - name: usr
    hostPath:
      path: /usr
  - name: modules
    hostPath:
      path: /lib/modules
  - name: log
    hostPath:
      path: /var/log

[rucciva]

Hi all, just want to share my version of wazuh agent as daemonset, which need to share host network, ipc, pid, and chrooted to the mounted root of host so that all the default rules reference the actual host file (not the container file) with minimum changes to the host dir (create wazuh user if not exist and modify /var/ossec dir). https://github.com/TelkomIndonesia/wazuh-agent-docker/blob/master/wazuh-daemonset.yaml. Any feedbacks are welcome.