Deployment Modes

spec.deploymentMode selects the topology. It drives default replica counts and the indexer/manager cluster configuration.

ha (default)

Production topology for client hosting:

• Indexer ×3 (OpenSearch cluster, quorum of master-eligible nodes)
• Manager master ×1 + workers ×2 (agents enroll on the master, stream events to workers)
• Dashboard ×1

spec:
  deploymentMode: ha
  indexer:
    replicas: 3
  manager:
    workers:
      replicas: 2

single-node

Smallest viable footprint for small clients or development:

• Indexer ×1 (discovery.type: single-node)
• Manager master only (no workers; agents send both enrollment and events to the master)
• Dashboard ×1

spec:
  deploymentMode: single-node

Tuning

Replica counts, resources, storage size/class, image registry/version, agent-service type and dashboard ingress are all configurable per component — see the WazuhCluster reference.

Mode is chosen at creation time

OpenSearch cannot change discovery.type after bootstrap, so switching an existing cluster between single-node and ha is not an in-place migration. Pick the mode when you create the cluster.