Tag: DevSecOps tools

TL;DR: Learn how to deploy the Wazuh agent in Kubernetes environments with a security-first approach. This guide covers prerequisites, installation steps, hardening techniques, troubleshooting tips, and advanced integrations to ensure production-grade security. By the end, you’ll have a robust monitoring solution integrated into your DevSecOps workflows.

Introduction to Wazuh and Its Role in DevSecOps

Imagine your Kubernetes cluster as a bustling city. Pods are the residents, services are the infrastructure, and the API server is the mayor. Now, who’s the city’s security team? That’s where Wazuh comes in. Wazuh is an open-source security platform designed to monitor and protect your infrastructure, ensuring that every pod, node, and service operates within secure boundaries.

Wazuh excels at intrusion detection, vulnerability assessment, and compliance monitoring, making it a natural fit for Kubernetes environments. In the world of DevSecOps, where security is baked into every stage of the development pipeline, Wazuh shines as a tool that bridges the gap between development agility and operational security.

Whether you’re running a self-hosted Kubernetes cluster or leveraging managed services like Amazon EKS or Google GKE, integrating Wazuh ensures that your environment is continuously monitored for threats, misconfigurations, and compliance violations.

In addition to its core features, Wazuh provides centralized management for agents deployed across multiple nodes. This is particularly useful for Kubernetes environments, where clusters can scale dynamically. By leveraging Wazuh, you can ensure that security scales alongside your infrastructure.

Another key advantage of Wazuh is its ability to integrate with other tools in the DevSecOps ecosystem. For example, pairing Wazuh with CI/CD pipelines allows you to automate security checks during application deployment, ensuring vulnerabilities are identified before they reach production.

Wazuh also supports integration with SIEM (Security Information and Event Management) solutions like Splunk or Elastic Stack, enabling advanced log analysis and correlation. This makes it easier to detect complex attack patterns and respond proactively.

Pre-requisites for Setting Up Wazuh Agent

Before diving into the installation process, it’s crucial to ensure your environment meets the necessary requirements. A misstep here can lead to deployment issues or, worse, security vulnerabilities.

System Requirements and Compatibility Checks

Wazuh agents are lightweight and can run on most Linux distributions, including Ubuntu, CentOS, and Debian. For Kubernetes, ensure your cluster is running version 1.20 or later, as older versions may lack critical security features like PodSecurityPolicies and advanced RBAC configurations.

Additionally, verify that your nodes have sufficient resources. While Wazuh agents are efficient, they still require CPU and memory allocations to process logs and communicate with the Wazuh manager.

It’s also important to ensure your Kubernetes cluster has a supported container runtime, such as containerd or CRI-O. Docker is deprecated in Kubernetes, and using unsupported runtimes can lead to compatibility issues.

Another consideration is the operating system of your nodes. Ensure that your OS is up-to-date with the latest security patches and kernel updates. Outdated systems can introduce vulnerabilities that compromise the Wazuh agent’s effectiveness.

Necessary Kubernetes Cluster Configurations

Ensure your cluster has network policies enabled to restrict communication between pods. This is especially important for Wazuh agents, which need secure connectivity to the Wazuh manager. If you’re using a managed Kubernetes service, check the provider’s documentation for enabling network policies.

Also, confirm that your cluster has a central logging solution, such as Fluentd or Elasticsearch, as Wazuh integrates seamlessly with these tools for enhanced visibility.

Another critical configuration is enabling Kubernetes audit logs. Audit logs provide detailed information about API server requests, which can be ingested by Wazuh for security analysis. To enable audit logging, update your Kubernetes API server configuration:

apiServer:
  auditLog:
    enabled: true
    logPath: "/var/log/kubernetes/audit.log"
    maxAge: 30
    maxSize: 100

Additionally, consider enabling encryption for audit logs to protect sensitive data. This can be done by configuring your logging backend to use encrypted storage.
⚠️ Security Note: Audit logs can contain sensitive information. Ensure they are stored securely and access is restricted to authorized personnel.
Access Control and Permissions Setup
Wazuh agents require specific permissions to access logs and system metrics. Create a dedicated Kubernetes service account for the agent and assign it minimal RBAC permissions. Avoid granting cluster-admin privileges unless absolutely necessary.
Here’s an example of a Kubernetes RBAC configuration for the Wazuh agent:
apiVersion: v1
kind: ServiceAccount
metadata:
  name: wazuh-agent
  namespace: security-monitoring
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: wazuh-agent-role
  namespace: security-monitoring
rules:
- apiGroups: [""]
  resources: ["pods", "nodes", "events"]
  verbs: ["get", "list", "watch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: wazuh-agent-rolebinding
  namespace: security-monitoring
subjects:
- kind: ServiceAccount
  name: wazuh-agent
  namespace: security-monitoring
roleRef:
  kind: Role
  name: wazuh-agent-role
  apiGroup: rbac.authorization.k8s.io

By limiting the agent’s permissions to specific namespaces and resources, you reduce the risk of privilege escalation.
For additional security, consider using Kubernetes PodSecurityPolicies or Open Policy Agent (OPA) to enforce strict security controls on the agent pods.
Step-by-Step Guide to Installing Wazuh Agent
Now that the groundwork is complete, let’s move on to installing the Wazuh agent. This section covers downloading, configuring, and deploying the agent in your Kubernetes cluster.
Downloading and Configuring the Wazuh Agent
Start by downloading the Wazuh agent package from the official repository. For Kubernetes deployments, Wazuh provides pre-built Docker images that simplify the process.
# Pull the Wazuh agent Docker image
docker pull wazuh/wazuh-agent:latest

Next, configure the agent to communicate with your Wazuh manager. Create a configuration file (ossec.conf) with the manager’s IP address and secure communication settings.
<agent_config>
  <server>
    <address>192.168.1.100</address>
    <port>1514</port>
  </server>
</agent_config>

To further secure communication, enable TLS in the configuration file:
<agent_config>
  <server>
    <address>192.168.1.100</address>
    <port>1514</port>
    <protocol>tls</protocol>
  </server>
</agent_config>

Ensure that the Wazuh manager has the corresponding TLS certificates configured to establish a secure connection.
💡 Pro Tip: Use environment variables to dynamically configure the agent’s settings during deployment, reducing the need for manual updates.
Deploying the Agent Using Kubernetes Manifests or Helm Charts
Wazuh supports deployment via Kubernetes manifests or Helm charts. For simplicity, we’ll use Helm:
# Add the Wazuh Helm repository
helm repo add wazuh https://packages.wazuh.com/helm/

# Install the Wazuh agent
helm install wazuh-agent wazuh/wazuh-agent --namespace security-monitoring

Ensure the agent pods are running and connected to the Wazuh manager by checking the logs:
# Check pod logs
kubectl logs -n security-monitoring wazuh-agent-0

If you encounter issues during deployment, verify the Helm chart values file for misconfigurations. Common mistakes include incorrect manager IP addresses or missing TLS certificates.
For advanced deployments, customize the Helm chart values file to include specific resource limits, environment variables, and security settings.
Validating the Installation and Connectivity
Once deployed, validate that the agent is successfully communicating with the Wazuh manager. Use the Wazuh dashboard to verify that logs and metrics are being received.
If the agent fails to connect, check the following:

Firewall rules blocking communication between the agent and manager.
Incorrect port configuration in the ossec.conf file.
TLS certificate mismatches, if enabled.

Additionally, use network debugging tools like tcpdump or wireshark to analyze traffic between the agent and manager.
💡 Pro Tip: Use Kubernetes port-forwarding to access the Wazuh dashboard locally if it’s not exposed externally.
Hardening Wazuh Agent for Production Use
Deploying the Wazuh agent is only half the battle. To ensure it operates securely in production, follow these hardening steps.
Implementing Secure Communication Protocols
Enable TLS for all communication between the Wazuh agent and manager. This prevents data interception and ensures integrity.
# Example of enabling TLS in ossec.conf
<agent_config>
  <server>
    <address>192.168.1.100</address>
    <port>1514</port>
    <protocol>tls</protocol>
  </server>
</agent_config>

Generate and manage TLS certificates using tools like OpenSSL or Kubernetes Secrets. Store certificates securely and rotate them periodically.
For added security, configure mutual TLS (mTLS) to authenticate both the agent and manager during communication.
Configuring Resource Limits and Monitoring Agent Performance
Set CPU and memory limits in the Kubernetes manifest to prevent the agent from consuming excessive resources:
resources:
  limits:
    memory: "512Mi"
    cpu: "500m"
  requests:
    memory: "256Mi"
    cpu: "250m"

Monitor the agent’s performance using Kubernetes metrics-server or Prometheus. Configure alerts for high resource usage to prevent disruptions.
⚠️ Security Note: Outdated agents are a common attack vector. Schedule regular updates to stay ahead of threats.
Regular Updates and Patching
Keep the Wazuh agent updated to the latest version to mitigate vulnerabilities. Use a CI/CD pipeline to automate updates and rollbacks.
Test updates in a staging environment before deploying them to production. This ensures compatibility and reduces the risk of downtime.
Additionally, subscribe to Wazuh’s security advisories to stay informed about new vulnerabilities and patches.
Monitoring and Troubleshooting Wazuh Agent
Even with a secure setup, issues can arise. This section covers monitoring and troubleshooting techniques to keep your Wazuh agent operational.
Using Wazuh Dashboards for Real-Time Insights
The Wazuh dashboard provides real-time visibility into your environment. Use it to monitor agent status, analyze logs, and detect anomalies.
Integrate the dashboard with Elasticsearch for advanced querying and visualization. For example, create custom Kibana dashboards to track security metrics specific to your cluster.
Additionally, use the Wazuh API to extract data programmatically for integration into third-party monitoring tools.
Common Issues and Their Resolutions
Here are some common issues you might encounter:

Agent not connecting to manager: Check network policies and firewall rules.
High resource usage: Adjust resource limits in the Kubernetes manifest.
Log ingestion delays: Verify the manager’s processing capacity and disk I/O.

For persistent issues, use Kubernetes debugging tools like kubectl exec to inspect the agent pod and diagnose problems.
In cases where logs are missing or incomplete, verify the agent’s configuration file (ossec.conf) for errors or missing parameters.
Best Practices for Maintaining Operational Security
Regularly audit agent configurations and monitor for unauthorized changes. Use tools like OPA (Open Policy Agent) to enforce security policies across your cluster.
Additionally, implement periodic security reviews to identify gaps and improve your deployment’s resilience against emerging threats.
For long-term security, consider automating compliance checks using Wazuh’s built-in rules and alerts.
Advanced Wazuh Integrations
Beyond basic deployment, Wazuh offers advanced integrations that can further enhance your Kubernetes security posture.
Integrating Wazuh with CI/CD Pipelines
Integrate Wazuh into your CI/CD pipelines to automate security checks during application deployment. For example, use Wazuh’s API to scan container images for vulnerabilities before they are deployed.
Here’s an example of a pipeline step that uses Wazuh for vulnerability scanning:
steps:
  - name: Scan Container Image
    script:
      - curl -X POST -H "Content-Type: application/json" -d '{"image": "my-app:latest"}' http://wazuh-manager/api/v1/vulnerability-scan

Integrating Wazuh with your CI/CD pipeline ensures that security is enforced at every stage of the development lifecycle.
💡 Pro Tip: Combine Wazuh with tools like Trivy or Clair for comprehensive container security scanning.
Multi-Manager Setup for High Availability
For large-scale deployments, consider setting up multiple Wazuh managers for high availability. Use Kubernetes load balancers to distribute agent traffic across managers.
Here’s an example of a Kubernetes Service configuration for load balancing:
apiVersion: v1
kind: Service
metadata:
  name: wazuh-manager-lb
  namespace: security-monitoring
spec:
  type: LoadBalancer
  ports:
    - port: 1514
      targetPort: 1514
  selector:
    app: wazuh-manager

This setup ensures that your agents remain connected even if one manager goes offline.
Additionally, configure health checks for the load balancer to detect and route traffic away from unhealthy managers.
Frequently Asked Questions
What is the role of Wazuh in Kubernetes security?
Wazuh acts as an intrusion detection system, compliance monitor, and vulnerability scanner, providing comprehensive security for Kubernetes environments.
Can I deploy Wazuh agents in managed Kubernetes services?
Yes, Wazuh agents can be deployed in managed services like Amazon EKS, Google GKE, and Azure AKS. Ensure the service supports network policies and RBAC.
How do I troubleshoot agent connectivity issues?
Check the agent logs, verify network policies, and ensure the manager’s IP address and port are correctly configured in ossec.conf.
Is Wazuh suitable for small-scale Kubernetes clusters?
Absolutely. Wazuh’s lightweight agents make it suitable for both small and large-scale clusters.
🛠️ Recommended Resources:

Tools and books mentioned in (or relevant to) this article:

Learning Helm — Managing apps on Kubernetes with the Helm package manager ($35-45)
Kubernetes in Action, 2nd Edition — The definitive guide to deploying and managing K8s in production ($45-55)
Hacking Kubernetes — Threat-driven analysis and defense of K8s clusters ($40-50)
GitOps and Kubernetes — Continuous deployment with Argo CD, Jenkins X, and Flux ($40-50)


Conclusion and Next Steps
Setting up the Wazuh agent in Kubernetes involves careful planning, secure configurations, and ongoing monitoring. By following this guide, you’ve ensured a production-grade, security-first deployment that aligns with DevSecOps principles.
Here’s what to remember:

Always enable TLS for secure communication.
Set resource limits to prevent overconsumption.
Regularly update and patch the agent.

Want to dive deeper into Wazuh integrations? Check out their official documentation or explore advanced configurations like multi-manager setups.
References

Wazuh Official Documentation
Kubernetes Documentation
Helm Documentation

📋 Disclosure: Some links in this article are affiliate links. If you purchase through these links, I earn a small commission at no extra cost to you. I only recommend products I’ve personally used or thoroughly evaluated. This helps support orthogonal.info and keeps the content free.