Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

PoC of managing certificates with cert-manager #577

Open
wants to merge 2 commits into
base: master
Choose a base branch
from
Open

PoC of managing certificates with cert-manager #577

wants to merge 2 commits into from

Conversation

gecube
Copy link

@gecube gecube commented Feb 1, 2024

This PR closes #576

@gecube gecube mentioned this pull request Feb 26, 2024
Open
nicolasjulian
nicolasjulian reviewed Mar 27, 2024
View reviewed changes
wazuh/wazuh_managers/wazuh-worker-sts.yaml Outdated
@@ -39,7 +39,7 @@ spec:
name: wazuh-conf
- name: filebeat-certs
secret:
secretName: indexer-certs
secretName: fliebeat-tls
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hello, I tried these changes, and I spotted this typo for the secret name here.

  Normal   Scheduled    31s                default-scheduler  Successfully assigned wazuh/wazuh-manager-worker-0 to node1
  Warning  FailedMount  15s (x6 over 30s)  kubelet            MountVolume.SetUp failed for volume "filebeat-certs" : secret "fliebeat-tls" not found

Should be filebeat-tls

Thank you

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@nicolasjulian Thank you very much for the comments. I will check and fix.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

thanks. Could you make another try please?

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hello,

Everything looks good on my end. I've but I corrected a typo locally. However, I noticed that for the current stable image version 4.7.3, the configuration mismatch is (( this is before your latest commit )):

uiSettings.overrides.defaultRoute: /app/wazuh

Is there has been a change to the default route in newer versions? in 4.9.0?

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@nicolasjulian could you test once more please? If the path should be changed, I can do it.

@alex-Qk alex-Qk mentioned this pull request May 3, 2024
Open
@gecube gecube mentioned this pull request May 29, 2024
Closed
@gecube gecube mentioned this pull request Sep 13, 2024
Open
zznyjidi
zznyjidi reviewed Sep 18, 2024
View reviewed changes
wazuh/certs/node.yaml Outdated Show resolved Hide resolved
@gecube gecube closed this Sep 23, 2024
@gecube gecube reopened this Sep 23, 2024
@gecube
Copy link
Author

gecube commented Sep 23, 2024

@CarlosALgit Hi! Could you kindly review the PR and give your feedback?

@gecube gecube mentioned this pull request Sep 23, 2024
Open
@zznyjidi
Copy link

zznyjidi commented Oct 4, 2024 •
edited
Loading

Also, to make vulnerability detection work, the config file for the master and worker pod also needs to be changed
In file wazuh/wazuh_managers/wazuh_conf/master.conf
and wazuh/wazuh_managers/wazuh_conf/worker.conf

<ssl>
  <certificate_authorities>
    <ca>/etc/ssl/root-ca.pem</ca>
  </certificate_authorities>
  <certificate>/etc/ssl/filebeat.pem</certificate>
  <key>/etc/ssl/filebeat.key</key>
</ssl>

this part is using the original certificate path and should be changed to

<ssl>
  <certificate_authorities>
    <ca>/etc/ssl/ca.crt</ca>
  </certificate_authorities>
  <certificate>/etc/ssl/tls.crt</certificate>
  <key>/etc/ssl/tls.key</key>
</ssl>

@gecube
Copy link
Author

gecube commented Oct 4, 2024

@zznyjidi thanks, I will fix.

@gecube
Copy link
Author

gecube commented Oct 7, 2024

@zznyjidi kindly check.

lwille
lwille approved these changes Nov 20, 2024
View reviewed changes
Copy link

@lwille lwille left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Amazing work. Can't wait to see this merged!

@AurimasNav
Copy link

Been trying to offload certs to separate secret store and sync them with external-secrets to implement this gitops way, stumbling on every possible occasion. This can't come soon enough.

@gecube
Copy link
Author

gecube commented Nov 26, 2024

@AurimasNav Hi! Could I help somehow?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@mirwanda mirwanda mirwanda approved these changes

@nicolasjulian nicolasjulian nicolasjulian left review comments

@zznyjidi zznyjidi zznyjidi approved these changes

@pyToshka pyToshka pyToshka approved these changes

@itmustbejj itmustbejj itmustbejj approved these changes

@lwille lwille lwille approved these changes

At least 1 approving review is required to merge this pull request.

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

Feature request: manage certificates by cert-manager
8 participants
@gecube @zznyjidi @AurimasNav @lwille @itmustbejj @pyToshka @nicolasjulian @mirwanda