Skip to content

Troubleshooting

Cluster stuck in Provisioning

Check which condition is not yet True:

kubectl get wazuhcluster demo -n wazuh-demo -o jsonpath='{.status.conditions}' | jq

The reconcile gates each stage on the previous one, so the first False condition tells you where it is waiting.

Indexer not becoming ready

kubectl get pods -n wazuh-demo -l app.kubernetes.io/component=indexer
kubectl logs -n wazuh-demo demo-indexer-0

The indexer readiness probe reflects real cluster health: it queries _cluster/health?wait_for_status=yellow, so a pod stays not ready until the OpenSearch cluster forms and shards reach at least yellow. A pod that is Running but never Ready usually means the cluster has not formed (peers cannot discover each other) or shards are stuck red.

Common causes:

  • vm.max_map_count too low — by default the indexer pod runs a privileged init container to set it to 262144. If your nodes block privileged init containers, set the sysctl on the node pool and disable the init container with indexer.tuneMaxMapCount: false.
  • Cluster not forming — in ha mode the pods must reach each other over the headless service (port 9300). Check the indexer logs for discovery/master-election errors.
  • PVC not bound — check the StorageClass and that a default exists if you did not set storage.storageClassName.

securityadmin Job failing

kubectl logs -n wazuh-demo job/demo-indexer-securityinit

The Job retries until the indexer security index is reachable. Persistent failures usually mean the indexer never became healthy — fix the indexer first.

Manager workers not joining the cluster

Workers reach the master through the *-manager-master headless Service on 1516 using the shared cluster-key. Check:

kubectl exec -n wazuh-demo demo-manager-master-0 -- /var/ossec/bin/cluster_control -l

Dashboard cannot reach the indexer

The dashboard authenticates as kibanaserver. Confirm the credential applied:

kubectl logs -n wazuh-demo deploy/demo-dashboard | grep -i opensearch

If you rotated demo-credentials manually, the securityadmin Job must be re-run for the indexer to accept the new password (automated rotation is a roadmap item).

Storage expansion not taking effect

Increasing storage.size patches the PVCs and recreates the StatefulSet (keeping pods). If the new size doesn't apply, check that the StorageClass allows it:

kubectl get storageclass <class> -o jsonpath='{.allowVolumeExpansion}'   # must be true
kubectl get pvc -n wazuh-demo -l app.kubernetes.io/instance=demo

A PVC stuck Resizing/FileSystemResizePending is the CSI driver finishing online expansion — the recreate restarts the pod to complete it. Shrinking is intentionally refused. See Day-2 Operations → Growing storage.