Wazuh on Kubernetes: Helm-Free Manifest Deployment

For Kubernetes shops, the official `wazuh-kubernetes` repository ships ready-to-apply manifests for the full Wazuh stack, indexer StatefulSet, server Deployment, dashboard Deployment and the supporting Services and PVCs.

1. Prerequisites

• Kubernetes 1.24+ with a default StorageClass
• kubectl access with cluster-admin rights
• At least 6 vCPU and 12 GB RAM available to the namespace
• A way to expose the dashboard (LoadBalancer or Ingress)

2. Clone the official repo

git clone https://github.com/wazuh/wazuh-kubernetes.git -b v4.9.0
cd wazuh-kubernetes

3. Set vm.max_map_count on nodes

The indexer pod requires it on every node it can land on. Either set it via a privileged DaemonSet (included in the repo) or apply it directly:

sysctl -w vm.max_map_count=262144

4. Generate certificates

wazuh/certs/indexer_cluster/generate_certs.sh
wazuh/certs/dashboard_http/generate_certs.sh

5. Apply the manifests

kubectl apply -k envs/local-env/

Use `envs/eks/` or `envs/gke/` for managed Kubernetes, they reference cloud-specific StorageClasses and LoadBalancers.

6. Verify

kubectl get pods -n wazuh
kubectl get svc -n wazuh

Wait until indexer, manager and dashboard pods are Running and Ready. Then expose the dashboard service and log in with the default admin credentials, rotate them immediately.