Configuration options

Beyond topology and storage, the operator exposes the most commonly tuned Wazuh settings, grouped by component. Anything not modeled can be set through the raw escape hatches.

Indexer tuning

spec:
  indexer:
    heapSize: "2g"          # OpenSearch JVM heap; ~50% of the memory limit
    tuneMaxMapCount: true   # privileged init container for vm.max_map_count
    extraConfig: |          # appended verbatim to opensearch.yml
      plugins.index_state_management.enabled: true
    podDisruptionBudget:
      enabled: true         # default in ha; maxUnavailable: 1

• heapSize sets -Xms/-Xmx (default 1g). Size it to roughly half the indexer memory limit.
• tuneMaxMapCount (default true) runs a privileged init container to set vm.max_map_count=262144, which OpenSearch requires. Set it to false on clusters that enforce Pod Security Admission restricted and pre-tune the sysctl at the node pool — otherwise the privileged init container is rejected and the indexer never starts.
• extraConfig is appended to opensearch.yml for ILM, advanced tuning, etc.
• podDisruptionBudget.enabled creates a maxUnavailable: 1 PDB (default on with ≥2 replicas) so a node drain cannot break indexer quorum. See Day-2 → Node maintenance.

Manager capabilities

These map to Wazuh manager (ossec.conf) sections and are rendered for every manager node.

spec:
  manager:
    config:
      fileIntegrityMonitoring:        # syscheck / FIM
        enabled: true                 # default true
        directories:                  # default: /etc, /usr/bin, /usr/sbin, /bin, /sbin
          - /etc
          - /var/www
      vulnerabilityDetection:
        enabled: true                 # default true
      securityConfigurationAssessment:
        enabled: true                 # default true
      extraConfig: |                  # raw XML appended inside <ossec_config>
        <localfile>
          <log_format>syslog</log_format>
          <location>/var/log/secure</location>
        </localfile>

Capability	Section	Default
File Integrity Monitoring	syscheck	on, baseline directories
Vulnerability Detection	vulnerability-detection	on
Security Configuration Assessment	sca	on

extraConfig is the escape hatch for any section the operator does not model directly — integration (Slack, VirusTotal, PagerDuty), localfile (log collection), command, active-response, cloud wodles, and so on. Paste standard Wazuh XML.

Alerting

spec:
  manager:
    alerts:
      logLevel: 3                     # minimum severity logged (1-16), default 3
      email:
        enabled: true
        smtpServer: smtp.example.com
        from: wazuh@example.com
        to:
          - soc@example.com
          - ops@example.com

When email.enabled is set, the operator writes the <global> email settings, an <email_alert_level> of 12, and one <email_alerts> block per recipient.

Credentials, TLS, exposure

Covered elsewhere: TLS & Credentials (passwords, agent enrollment), and the WazuhCluster reference (agentService, dashboard.ingress, image overrides).

Config changes roll the pods

Editing any of these re-renders the ConfigMaps and rolls the affected pods automatically (via the config checksum), so changes take effect without manual restarts.