wazuh-daemonset.yaml

apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: wazuh-agent
  namespace: wazuh
spec:
  selector:
    matchLabels:
      app: wazuh-agent
  template:
    metadata:
      labels:
        app: wazuh-agent
      name: wazuh-agent
    spec:
      hostPID: true
      hostIPC: true
      hostNetwork: true
      initContainers:
        - image: busybox
          name: wazuh-user
          resources:
            limits:
              cpu: 100m
              memory: 256Mi
            requests:
              cpu: 50m
              memory: 128Mi
          volumeMounts:
            - mountPath: /host
              name: hostroot
          command:
            - chroot
            - /host
            - sh
            - -c
            - id wazuh || useradd wazuh
      containers:
        - name: wazuh-agent
          image: ghcr.io/telkomindonesia/wazuh-agent:4.4.1-3
          livenessProbe:
            exec:
              command:
                - chroot
                - /host
                - /var/ossec/bin/wazuh-control
                - status
            initialDelaySeconds: 30
            periodSeconds: 10
            timeoutSeconds: 10
            failureThreshold: 5
          imagePullPolicy: Always
          securityContext:
            privileged: true
            runAsUser: 0
          resources:
            limits:
              memory: 512Mi
          env:
            - name: WAZUH_MANAGER_ADDRESS
              value: manager.wazuh.changeme
            - name: WAZUH_RULESET_SCA
              value: cis_ubuntu18-04,sca_unix_audit
            - name: WAZUH_AGENT_NAME
              valueFrom:
                fieldRef:
                  fieldPath: spec.nodeName
          volumeMounts:
            - mountPath: /host
              name: hostroot
              readOnly: true
            - mountPath: /host/var/ossec
              name: varossec
            - mountPath: /var/ossec/etc/authd.pass
              name: wazuh-authd-pass
              subPath: authd.pass
      volumes:
        - name: hostroot
          hostPath:
            path: /
        - name: varossec
          hostPath:
            path: /var/ossec
        - name: wazuh-authd-pass
          secret:
            secretName: wazuh-authd-pass