# wazuh-docker-kubernetes-monitoring

Companion files for the lesson [Monitoring Docker and Kubernetes with Wazuh](https://maheshtata.com/wazuh/wazuh-docker-kubernetes-monitoring/).

Tested against the Wazuh 5.0 beta5 documentation (September 2026). Wazuh 5.0 is
still in beta, so treat every value as subject to change at GA.

| File | What it is | Where it goes |
| --- | --- | --- |
| `docker-listener.ossec.conf.fragment.xml` | `wodle name="docker-listener"` block for a Docker host | agent `ossec.conf`, or a group's `agent.conf` |
| `wazuh-agent-daemonset.yaml` | Wazuh agent DaemonSet, reproduced verbatim from the official Kubernetes deployment page | `kubectl apply -f` |

## About the DaemonSet manifest

`wazuh-agent-daemonset.yaml` is the documentation's **"Other cluster types"**
variant, copied unchanged apart from a comment header. The EKS variant in the
same documentation is identical except that it omits the
`/var/run/docker.sock` volume and its mount. That socket is what lets the node
agent observe Docker events, so keep it unless you are on a runtime that does
not expose it.

The manifest runs five init containers before the agent starts:

1. Clean stale PID and lock files.
2. Seed `/var/ossec` from the image into the hostPath, first run only.
3. Fix ownership: `999:999` on `etc logs queue var rids tmp active-response`,
   `0:0` on `bin` and `lib`.
4. Write `ossec.conf` with the manager endpoint, registration server and
   `spec.nodeName` as the agent name.
5. Copy `authd.pass` in from a Kubernetes Secret, `0:999` mode `0640`.

Agent state persists on a hostPath at `/var/lib/wazuh`. Without it, every pod
restart re-enrols and your agent list fills with duplicates.

### Known discrepancy in the published manifest

The manifest writes a **4.x-shaped** `ossec.conf`: `<client><server>`, port
`1514` for events, port `1515` for enrolment. The rest of the Wazuh 5.0
documentation describes agent-to-manager communication over HTTPS on port
`1517` with an `<agent><manager>` block, and the `wazuh/wazuh-agent` Docker
image takes `WAZUH_MANAGER_ENDPOINT` of the form `host:1517/wazuh-manager/`.

The Kubernetes manifests, service definitions and network policies in the beta
all carry the legacy port numbers consistently, so the manifest is internally
coherent. Apply it as published, confirm the agent reaches Active, and re-check
at GA. Changing the ports here alone will break against the shipped services.

## Order of operations

1. Create the agent group on the manager. Enrolment into a group that does not
   exist is rejected in Wazuh 5.0.
2. `kubectl create namespace wazuh-daemonset`
3. `kubectl create secret generic wazuh-authd-pass -n wazuh-daemonset --from-literal=authd.pass=<PASSWORD>`
   The manager's value is in `/var/wazuh-manager/etc/authd.pass`.
4. Replace `<EXTERNAL_IP_WAZUH_EVENTS>` and `<EXTERNAL_IP_WAZUH_REGISTRATION>`
   in the manifest.
5. `kubectl apply -f wazuh-agent-daemonset.yaml`
6. `kubectl get pods -n wazuh-daemonset -o wide`

## Notes

- The Docker listener is agent-side and needs the pinned Python dependencies
  on the host. An unpinned `urllib3` is the most common cause of a silent
  failure.
- Docker findings land in `wazuh-findings-v5-system-activity` under the
  `docker` integration. Filter on `event.dataset:docker.events` in Discover.
- The image tag `wazuh/wazuh-agent:5.0.0-beta5-latest` is a beta tag. Pin to a
  digest for anything that has to be reproducible.
- The 5.0 beta documentation has **no Kubernetes audit log page** and no
  Kubernetes ruleset integration. Collecting the API server audit log with
  `<localfile>` works, but the decoder and rules would be yours to write.
- Do not try to FIM other containers' filesystems from the node agent. Watch
  the host paths that persist instead: runtime configuration, kubelet
  configuration, static pod manifests, certificate stores.