OpenSec Atlas

wazuh-kubernetes-helmchart: An Open Source Template for Security Operations (SecOps) | OpenSec Atlas

Back to Browse

Security Operations (SecOps)

Template

wazuh-kubernetes-helmchart

A community-maintained Helm chart to deploy and manage a Wazuh security cluster on Kubernetes environments.

Visit Website View on GitHub

About This Tool

Wazuh - Wazuh Kubernetes Helm chart. This repo is not maintained by Wazuh team. This is community project.

Primary Use Case

This tool enables Kubernetes users and DevOps teams to quickly deploy a scalable Wazuh cluster for intrusion detection, log analysis, and security automation within their containerized environments. It is ideal for organizations looking to integrate Wazuh's security capabilities into Kubernetes using Helm charts for simplified management and deployment.

Key Features

Helm chart for deploying Wazuh cluster components on Kubernetes
Includes configurations for Wazuh master, workers, and agents
Supports Elasticsearch and Kibana integration for log analysis and visualization
Predefined Kubernetes manifests for RBAC, secrets, services, and statefulsets
Docker image for Wazuh agent installation and management
Scripts for deployment, testing, upgrading, and removal of the cluster
Community-driven project with Slack and mailing list support

Insights & Recommendations

This Helm chart is currently built for Helm version 2 (v2.16.12); upgrading to Helm 3 is planned but not yet implemented. The repository is community-maintained and not officially supported by the Wazuh team, so users should test thoroughly before production use. It is recommended to have a working Kubernetes cluster and Helm 2 installed prior to deployment.

Installation

Clone the repository from GitHub
Navigate to the `wazuh-kubernetes/scripts` directory
Run `./test.sh` to lint and validate the Helm chart
Execute `./deploy.sh` to deploy the Wazuh cluster to your Kubernetes environment
Use `./remove.sh` to uninstall the deployment from Kubernetes

Usage

./test.sh

Validates and lints the Helm chart to ensure correctness before deployment.

./deploy.sh

Deploys the Wazuh cluster onto the connected Kubernetes environment using Helm.

./remove.sh

Removes the deployed Wazuh cluster and cleans up Kubernetes resources.

Smart Usage Notes

Integrate this Helm chart deployment into CI/CD pipelines for automated security monitoring of Kubernetes workloads.Use the Elasticsearch and Kibana integration to create custom dashboards for real-time threat visualization and incident response.Leverage the community-driven scripts to automate cluster upgrades and testing, reducing operational overhead.Combine with Kubernetes RBAC policies to enforce least privilege and secure agent communications within the cluster.Use the Wazuh agent logs collected via this deployment to feed threat intelligence platforms for enhanced detection capabilities.