Skip to content

Roadmap

The operator provisions and runs the full Wazuh stack (single-node and HA) with ordered, rollout-aware upgrades.

Delivered

  • Credential & certificate rotation — password rotation re-keys the running indexer via securityadmin; leaf-certificate rotation re-issues certs from the CA on demand.
  • Backups / restore — scheduled indexer snapshots to a filesystem or S3 repository, and annotation-triggered restore. See Backups & DR.
  • Index retention — opt-in ISM policy that deletes old indices.
  • Custom detection content — ship custom rules, decoders and CDB lists.
  • PVC expansion — storage.size growth in place (no StatefulSet recreation).
  • Hardening — PSA-restricted security contexts, PodDisruptionBudgets, pod anti-affinity, optional NetworkPolicies. See Security Hardening.
  • Observability — Prometheus metrics + optional ServiceMonitor.

Planned

  • Major-version upgrade orchestration — reindex handling and the 4.x → 5.x migration (the 5.x images change layout and move to env-driven config), with maintenance windows.
  • CA rotation — rotate the root CA (dual-trust window); leaf rotation already ships.
  • cert-manager integration — optional Issuer/Certificate-based TLS.
  • Autoscaling — HPA for the dashboard.
  • Multi-tenant pooling — pre-provisioned WazuhCluster pools for fast onboarding.

See the Day-2 Operations guide for operational details.