<p>I'm deploying <strong>wazuh-manager on my kubernetes cluster</strong> and I need to disabled some security check features from the <strong>ossec.conf</strong> and I'm trying to copy the <strong>config-map ossec.conf(my setup) with the one from the wazuh-manager image but if I'm creating the &quot;volume mount&quot; on /var/ossec/etc/ossec.conf&quot; it will delete everything from the /var/ossec/etc/(when wazuh-manager pods is deployed it will copy all files that this manager needs).</strong>
So, I'm thinking to create a new volume mount <strong>&quot;/wazuh/ossec.conf&quot;</strong> with <strong>&quot;lifecycle poststart sleep &gt; exec command &quot;cp  /wazuh/ossec.conf &gt; /var/ossec/etc/ &quot;</strong> but I'm getting an error that <em><strong>&quot;cannot find  /var/ossec/etc/&quot;.</strong></em></p>
<pre><code>apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: wazuh-manager
  labels:
    node-type: master
spec:
  replicas: 1
  selector:
    matchLabels:
      appComponent:  wazuh-manager
      node-type: master
  serviceName: wazuh
  template:
    metadata:
      labels:
        appComponent: wazuh-manager
        node-type: master
      name: wazuh-manager
    spec:
      volumes:
        - name: ossec-conf
          configMap:
            name: ossec-config
      containers:
        - name: wazuh-manager
          image: wazuh-manager4.8
          lifecycle:
            postStart:
              exec: 
                command: [&quot;/bin/sh&quot;, &quot;-c&quot;, &quot;cp  /wazuh/ossec.conf &gt;/var/ossec/etc/ossec.conf&quot;]
          resources:
          securityContext:  
            capabilities:
              add: [&quot;SYS_CHROOT&quot;]
          volumeMounts:
            - name: ossec-conf
              mountPath: /wazuh/ossec.conf
              subPath: master.conf
              readOnly: true
          ports:
            - containerPort: 8855
              name: registration     
  volumeClaimTemplates:
    - metadata:
        name: wazuh-disk
      spec:
        accessModes: ReadWriteOnce
        storageClassName: wazuh-csi-disk
        resources:
          requests:
            storage: 50
</code></pre>
<p><strong>error:</strong></p>
<pre><code>$ kubectl get pods -n wazuh

wazuh-1670333556-0        0/1     PostStartHookError: command '/bin/sh -c cp  /wazuh/ossec.conf &gt; /var/ossec/etc/ossec.conf' exited with 1: /bin/sh: /var/ossec/etc/ossec.conf: No such file or directory...
</code></pre>

Ciocoiu Petrisor
<p>Within the wazuh-kubernetes repository you have a file for each of the Wazuh manager cluster nodes:</p>
<p><strong>wazuh/wazuh_managers/wazuh_conf/master.conf</strong> for the Wazuh Manager master node.</p>
<p><strong>wazuh/wazuh_managers/wazuh_conf/worker.conf</strong> for the Wazuh Manager worker node.</p>
<p>With these files, in the <strong>Kustomization.yml</strong> script, configmaps are created:</p>
<pre><code>configMapGenerator:
   -name: indexer-conf
     files:
       - indexer_stack/wazuh-indexer/indexer_conf/opensearch.yml
       - indexer_stack/wazuh-indexer/indexer_conf/internal_users.yml
   -name: wazuh-conf
     files:
       -wazuh_managers/wazuh_conf/master.conf
       -wazuh_managers/wazuh_conf/worker.conf
   -name: dashboard-conf
     files:
       - indexer_stack/wazuh-dashboard/dashboard_conf/opensearch_dashboards.yml
</code></pre>
<p>Then, in the deployment manifest, they are mounted to persist the configurations in the ossec.conf file of each cluster node:</p>
<p><strong>wazuh/wazuh_managers/wazuh-master-sts.yaml</strong>:</p>
<pre><code>...
    specification:
       volumes:
         -name:config
           configMap:
             name: wazuh-conf 
...
     volumeMounts:
             -name:config
               mountPath: /wazuh-config-mount/etc/ossec.conf
               subPath: master.conf 
...
</code></pre>
<p>It should be noted that the configuration files that you need to copy into the <strong>/var/ossec/</strong> directory must be mounted on the <strong>/wazuh-config-mount/</strong> directory and then the Wazuh Manager image entrypoint takes care of copying it to its location at the start of the container. As an example, the configmap is mounted to <strong>/wazuh-config-mount/etc/ossec.conf</strong> and then copied to <strong>/var/ossec/etc/ossec.conf</strong> at startup.</p>
