deploying wazuh-manager and replace ossec.conf after pods running - kubernetes

Question

I'm deployingwazuh-manager on my kubernetes clusterand I need to disabled some security check features from theossec.confand I'm trying to copy theconfig-map ossec.conf(my setup) with the one from the wazuh-manager image but if I'm creating the "volume mount" on /var/ossec/etc/ossec.conf" it will delete everything from the /var/ossec/etc/(when wazuh-manager pods is deployed it will copy all files that this manager needs).So, I'm thinking to create a new volume mount"/wazuh/ossec.conf"with"lifecycle poststart sleep > exec command "cp /wazuh/ossec.conf > /var/ossec/etc/ "but I'm getting an error that"cannot find /var/ossec/etc/".

apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: wazuh-manager
  labels:
    node-type: master
spec:
  replicas: 1
  selector:
    matchLabels:
      appComponent:  wazuh-manager
      node-type: master
  serviceName: wazuh
  template:
    metadata:
      labels:
        appComponent: wazuh-manager
        node-type: master
      name: wazuh-manager
    spec:
      volumes:
        - name: ossec-conf
          configMap:
            name: ossec-config
      containers:
        - name: wazuh-manager
          image: wazuh-manager4.8
          lifecycle:
            postStart:
              exec: 
                command: ["/bin/sh", "-c", "cp  /wazuh/ossec.conf >/var/ossec/etc/ossec.conf"]
          resources:
          securityContext:  
            capabilities:
              add: ["SYS_CHROOT"]
          volumeMounts:
            - name: ossec-conf
              mountPath: /wazuh/ossec.conf
              subPath: master.conf
              readOnly: true
          ports:
            - containerPort: 8855
              name: registration     
  volumeClaimTemplates:
    - metadata:
        name: wazuh-disk
      spec:
        accessModes: ReadWriteOnce
        storageClassName: wazuh-csi-disk
        resources:
          requests:
            storage: 50

error:

$ kubectl get pods -n wazuh

wazuh-1670333556-0        0/1     PostStartHookError: command '/bin/sh -c cp  /wazuh/ossec.conf > /var/ossec/etc/ossec.conf' exited with 1: /bin/sh: /var/ossec/etc/ossec.conf: No such file or directory...

Answer 1

Within the wazuh-kubernetes repository you have a file for each of the Wazuh manager cluster nodes:

wazuh/wazuh_managers/wazuh_conf/master.conffor the Wazuh Manager master node.

wazuh/wazuh_managers/wazuh_conf/worker.conffor the Wazuh Manager worker node.

With these files, in theKustomization.ymlscript, configmaps are created:

configMapGenerator:
   -name: indexer-conf
     files:
       - indexer_stack/wazuh-indexer/indexer_conf/opensearch.yml
       - indexer_stack/wazuh-indexer/indexer_conf/internal_users.yml
   -name: wazuh-conf
     files:
       -wazuh_managers/wazuh_conf/master.conf
       -wazuh_managers/wazuh_conf/worker.conf
   -name: dashboard-conf
     files:
       - indexer_stack/wazuh-dashboard/dashboard_conf/opensearch_dashboards.yml

Then, in the deployment manifest, they are mounted to persist the configurations in the ossec.conf file of each cluster node:

wazuh/wazuh_managers/wazuh-master-sts.yaml:

...
    specification:
       volumes:
         -name:config
           configMap:
             name: wazuh-conf 
...
     volumeMounts:
             -name:config
               mountPath: /wazuh-config-mount/etc/ossec.conf
               subPath: master.conf 
...

It should be noted that the configuration files that you need to copy into the/var/ossec/directory must be mounted on the/wazuh-config-mount/directory and then the Wazuh Manager image entrypoint takes care of copying it to its location at the start of the container. As an example, the configmap is mounted to/wazuh-config-mount/etc/ossec.confand then copied to/var/ossec/etc/ossec.confat startup.