Skip to content

Day-2 Operations

How the operator behaves after the initial bring-up, and what still needs care.

Scaling

# Indexer nodes
kubectl patch wazuhcluster acme -n wazuh-acme --type=merge \
  -p '{"spec":{"indexer":{"replicas":5}}}'

# Manager workers
kubectl patch wazuhcluster acme -n wazuh-acme --type=merge \
  -p '{"spec":{"manager":{"workers":{"replicas":3}}}}'

The StatefulSet scales and the config checksum rolls existing pods so discovery settings stay consistent. Vertical changes (resources) also roll the pods through the normal StatefulSet update.

Growing storage

Increase a component's storage.size and the operator expands it in place:

kubectl patch wazuhcluster acme -n wazuh-acme --type=merge \
  -p '{"spec":{"indexer":{"storage":{"size":"200Gi"}}}}'

This is exactly the manual procedure — patch the PVCs, leave the StatefulSet alone — done automatically and safely:

  • It patches the existing PVCs to the new size (online CSI expansion).
  • It never deletes or recreates the StatefulSet. A StatefulSet's volumeClaimTemplates are immutable, so the operator pins that field to the live value when it reconciles — the apply is a no-op there and is not rejected. The template keeps its original size; the PVCs carry the real, larger size.
  • If you later scale up, the new pod's PVC is created at the template size and grown to the desired size on the next reconcile (the expansion runs over every ordinal each pass), so everything converges without manual steps.

Requirements and caveats:

  • The StorageClass must set allowVolumeExpansion: true.
  • Growth only — shrinking is refused (and unsupported by Kubernetes).
  • Expansion is online for most CSI drivers; a few need a pod restart to finish the filesystem resize.

Rotating credentials

Change a password (inline or in the credentials Secret) and the operator re-keys the running indexer and rolls the consumers automatically — see TLS & Credentials → Rotating credentials. It is gated so a rotation cannot lock you out.

Configuration changes

Edit any component field; the operator re-renders the ConfigMaps and rolls the affected pods automatically (see Upgrades → config changes).

Observability

  • kubectl get wazuhcluster — MODE / VERSION / PHASE.
  • status.conditions — per-component readiness (IndexerReady, ManagerReady, DashboardReady, Ready).
  • Operator metrics on :8080 (wazuhcluster_reconciles_total, wazuhcluster_reconcile_duration_seconds, wazuhcluster_component_ready). The chart exposes them through a metrics Service. With the Prometheus Operator installed, set operator.metrics.serviceMonitor.enabled=true to scrape them via a ServiceMonitor (tune interval/scrapeTimeout, add labels for Prometheus release selection).

Node maintenance & disruption budgets

For multi-replica components the operator creates a PodDisruptionBudget with maxUnavailable: 1, so a node drain (kubectl drain) can never evict more than one indexer or one worker at a time — protecting OpenSearch quorum during maintenance.

  • Enabled by default for the ha indexer (3 replicas) and workers (2 replicas).
  • Never created below two replicas (e.g. single-node), where a maxUnavailable: 1 budget would block all voluntary evictions of the sole pod.
  • Opt out per component with indexer.podDisruptionBudget.enabled: false or manager.workers.podDisruptionBudget.enabled: false. Turning it off (or scaling below two replicas) removes the budget so it can no longer block drains.
kubectl get pdb -n wazuh-demo

Deletion

Deleting a WazuhCluster cascades to all children (StatefulSets, Deployment, Services, ConfigMaps, Secrets, Job, Ingress, and their PVCs) via owner references. A finalizer guards the terminal status update.

kubectl delete wazuhcluster demo -n wazuh-demo

Known limitations (planned follow-ups)

  • deploymentMode switch — not an in-place migration (see Deployment Modes).
  • Backups / restore — no integration yet; snapshot the indexer manually.
  • Certificate / CA rotation — not yet automated (credential rotation is).
  • Major-version upgrades — reindex/breaking-change steps are not orchestrated.

See the Roadmap for what is planned next.