Merge 5.0.1 into main

.github/workflows/4_builderpackage_dashboard.yml

@@ -252,7 +252,7 @@ jobs:
   build-base:
     needs: [validate-job]
     name: Build dashboard
-    uses: wazuh/wazuh-dashboard/.github/workflows/4_builderpackage_dashboard_core.yml@4.14.11
+    uses: wazuh/wazuh-dashboard/.github/workflows/4_builderpackage_dashboard_core.yml@4.14.12
     with:
       CHECKOUT_TO: ${{ github.head_ref || github.ref_name }}
       ARCHITECTURE: ${{ inputs.architecture }}
@@ -265,7 +265,7 @@ jobs:
     permissions:
       pull-requests: write
       id-token: write
-    uses: wazuh/wazuh-dashboard-plugins/.github/workflows/4_builderpackage_plugins.yml@4.14.11
+    uses: wazuh/wazuh-dashboard-plugins/.github/workflows/4_builderpackage_plugins.yml@4.14.12
     with:
       reference: ${{ inputs.reference_wazuh_plugins }}
       execution_repository: 'wazuh-dashboard/4_builderpackage_dashboard'
@@ -277,7 +277,7 @@ jobs:
     permissions:
       pull-requests: write
       id-token: write
-    uses: wazuh/wazuh-security-dashboards-plugin/.github/workflows/4_builderpackage_security_plugin.yml@4.14.11
+    uses: wazuh/wazuh-security-dashboards-plugin/.github/workflows/4_builderpackage_security_plugin.yml@4.14.12
     with:
       reference: ${{ inputs.reference_security_plugins }}
       execution_repository: 'wazuh-dashboard/4_builderpackage_dashboard'

.github/workflows/5_builderpackage_dashboard.yml

@@ -578,15 +578,28 @@ jobs:
         env:
           username: 'wazuh-devel-xdrsiem-dashboard'
         run: |
-          git clone https://${{ env.username }}:${{ secrets.DASHBOARD_BOT_SMOKE_TEST_TOKEN }}@github.com/wazuh/wazuh-automation.git
-          # Workaround: AWS CodeBuild ARM runners do not have pip3 or openssh-client pre-installed
-          if ! command -v pip3 &>/dev/null || ! command -v ssh &>/dev/null; then
+          git clone https://${{ env.username }}:${{ secrets.DASHBOARD_BOT_SMOKE_TEST_TOKEN }}@github.com/wazuh/wazuh-automation.git -b $(bash dev-tools/product_version.sh)
+          # Workaround: AWS CodeBuild runners may lack openssh-client, and the Allocator package
+          # requires Python 3.12 specifically, while the runner's default python3 is 3.10.
+          # Runners with pyenv expose an inactive python3.12 shim, so `command -v` is not enough:
+          # activate pyenv's 3.12 (persisted via GITHUB_ENV for later steps) or install it via apt.
+          if ! python3.12 --version &>/dev/null; then
+            PY312=$(command -v pyenv &>/dev/null && pyenv versions --bare | grep '^3\.12' | tail -1 || true)
+            if [ -n "$PY312" ]; then
+              export PYENV_VERSION="$PY312"
+              echo "PYENV_VERSION=$PY312" >> "$GITHUB_ENV"
+            else
+              sudo apt-get update
+              sudo apt-get install -y python3.12 python3.12-venv
+            fi
+          fi
+          if ! command -v ssh &>/dev/null; then
             sudo apt-get update
-            command -v pip3 &>/dev/null || sudo apt-get install -y python3-pip
-            command -v ssh &>/dev/null || sudo apt-get install -y openssh-client
+            sudo apt-get install -y openssh-client
           fi
+          python3.12 -m ensurepip --upgrade
           cd wazuh-automation
-          pip3 install --retries 3 -r deployability/deps/requirements.txt
+          python3.12 -m pip install --retries 3 ./deployability/modules/allocation
 
       - name: RPM - Configure AWS credentials
         uses: aws-actions/configure-aws-credentials@v6
@@ -606,7 +619,7 @@ jobs:
             INSTANCE_NAME="centos_8_arm_large_aws"
             COMPOSITE_NAME="centos_stream-8-arm64"
           fi
-          python3 wazuh-automation/deployability/modules/allocation/main.py --action create --provider aws --size large --composite-name "${COMPOSITE_NAME}" --instance-name "${INSTANCE_NAME}" --inventory-output "/tmp/inventory.yaml" --track-output "/tmp/track.yaml" --label-team dashboard --label-termination-date 1d --label-creator github-actions --working-dir /tmp/dashboard --custom-tags "Product:wazuh-dashboard,Purpose:package-build,ExecutionId:${{ github.run_id }},Stage:ci"
+          python3.12 -m allocation.main --action create --provider aws --size large --composite-name "${COMPOSITE_NAME}" --instance-name "${INSTANCE_NAME}" --inventory-output "/tmp/inventory.yaml" --track-output "/tmp/track.yaml" --label-team dashboard --label-termination-date 1d --label-creator github-actions --working-dir /tmp/dashboard --custom-tags "Product:wazuh-dashboard,Purpose:package-build,ExecutionId:${{ github.run_id }},Stage:ci"
           ansible_host=$(grep 'ansible_host:' /tmp/inventory.yaml | sed 's/.*: *//')
           ansible_port=$(grep 'ansible_port:' /tmp/inventory.yaml | sed 's/.*: *//')
           ansible_user=$(grep 'ansible_user:' /tmp/inventory.yaml | sed 's/.*: *//')
@@ -709,10 +722,9 @@ jobs:
         if: ${{ always() }}
         ########################################
         run: |
-          if [ "${{ inputs.system }}" = "rpm" ]; then
+          if [ "${{ inputs.system }}" = "rpm" ] && [ -f /tmp/track.yaml ]; then
             echo "Destroying Allocator Machine"
-            cd wazuh-automation/deployability
-            python3 modules/allocation/main.py --action delete --track-output "/tmp/track.yaml"
+            python3.12 -m allocation.main --action delete --track-output "/tmp/track.yaml"
           fi
 
   upload-package:

config/opensearch_dashboards.prod.yml

@@ -1,7 +1,7 @@
 server.host: 0.0.0.0
 server.port: 443
 opensearch.hosts: https://localhost:9200
-opensearch.ssl.verificationMode: certificate
+opensearch.ssl.verificationMode: full
 #opensearch.username:
 #opensearch.password:
 opensearch.requestHeadersAllowlist: ['securitytenant', 'Authorization']

dev-tools/build-packages/build-packages.sh

@@ -94,42 +94,6 @@ get_packages(){
   cd ..
 }
 
-# Candidate refs of wazuh-installation-assistant to download the shared
-# credentials library from, in order, space separated. The Wazuh repositories
-# cut the same tag names, so a tag build resolves to the matching tag:
-#   1. WAZUH_CREDENTIALS_LIB_REF, an explicit override
-#   2. the tag being built -- and then nothing else: a release must never
-#      fall back to a branch that keeps moving after it is cut
-#   3. the branch being built, which only exists upstream when it was created
-#      there too (a feature branch 404s and falls through)
-#   4. the version branch, then the version tag
-credentials_lib_refs() {
-  local refs="" tag="" branch="" ref
-  if [ "${GITHUB_REF_TYPE:-}" = "tag" ] && [ -n "${GITHUB_REF_NAME:-}" ]; then
-    tag="${GITHUB_REF_NAME}"
-  else
-    tag="$(git -C "${root_dir}" describe --tags --exact-match 2>/dev/null || true)"
-  fi
-  if [ -z "${tag}" ]; then
-    branch="${GITHUB_HEAD_REF:-}"
-    [ -n "${branch}" ] || [ "${GITHUB_REF_TYPE:-}" != "branch" ] || branch="${GITHUB_REF_NAME:-}"
-    [ -n "${branch}" ] || branch="$(git -C "${root_dir}" rev-parse --abbrev-ref HEAD 2>/dev/null || true)"
-    [ "${branch}" != "HEAD" ] || branch=""
-  fi
-  for ref in "${WAZUH_CREDENTIALS_LIB_REF:-}" "${tag}" "${branch}"; do
-    [ -n "${ref}" ] || continue
-    case " ${refs} " in *" ${ref} "*) continue ;; esac
-    refs="${refs:+${refs} }${ref}"
-  done
-  if [ -z "${tag}" ]; then
-    for ref in "${version}" "v${version}"; do
-      case " ${refs} " in *" ${ref} "*) continue ;; esac
-      refs="${refs:+${refs} }${ref}"
-    done
-  fi
-  echo "${refs}"
-}
-
 build_tar() {
   log
   log "Building base package..."
@@ -148,8 +112,6 @@ build_tar() {
   run_with_retry docker run -t --rm \
     -e "RETRY_MAX_ATTEMPTS=${RETRY_MAX_ATTEMPTS}" \
     -e "RETRY_DELAY_SECONDS=${RETRY_DELAY_SECONDS}" \
-    -e "WAZUH_CREDENTIALS_LIB_REFS=$(credentials_lib_refs)" \
-    -e "WAZUH_CREDENTIALS_LIB_SHA256=${WAZUH_CREDENTIALS_LIB_SHA256:-}" \
     -v "${tmp_dir}/:/tmp:Z" -v "${output_dir}/:/output:Z" \
     "${container_name}" "${version}" "${revision}" "${architecture}" "${verbose}" || return 1
   cd ..

dev-tools/build-packages/config/wazuh-dashboard

@@ -61,22 +61,6 @@ start() {
     return 1
   fi
 
-  # Resolve the kibanaserver and wazuh-internal-client passwords into the
-  # keystore, as the systemd unit's ExecStartPre does. It names every missing
-  # key on failure.
-  if ! /usr/share/wazuh-dashboard/bin/resolve-credentials --prestart; then
-    emit "$name not started: its credentials could not be resolved"
-    return 1
-  fi
-
-  # Resolve the kibanaserver and wazuh-internal-client passwords into the
-  # keystore, as the systemd unit's ExecStartPre does. It names every missing
-  # key on failure.
-  if ! /usr/share/wazuh-dashboard/bin/resolve-credentials --prestart; then
-    emit "$name not started: its credentials could not be resolved"
-    return 1
-  fi
-
 
   # Run the program!
 

dev-tools/build-packages/credentials/README.md

@@ -84,9 +84,24 @@ Issued by `--install` only:
   A pair staged in `ca/` by the operator (no marker) is validated and used, and never removed.
   The leaf is RSA 2048, SHA-256, 10 years backdated one day, `serverAuth,clientAuth`,
   `CN=<host>`. `dashboard.pem` holds the leaf followed by the CA. Its SANs are `DNS:<host>`, the
-  FQDN when it differs, every global address of the default-route interfaces, or
-  `WAZUH_DASHBOARD_CERT_SANS` (an empty list is refused); `localhost`, `127.0.0.1` and `::1` are
-  always added. The CA certificate is published as `export/ca.pem`.
+  FQDN when it differs, every global address of the host, or `WAZUH_DASHBOARD_CERT_SANS` (an
+  empty list is refused); `localhost`, `127.0.0.1` and `::1` are always added. The CA certificate
+  is published as `export/ca.pem`.
+- Addresses, the manager's rule: every interface, whether or not it carries the default route or
+  is up. For IPv6 that is usually up only: on a down interface the kernel removes the addresses
+  or keeps them tentative, which are left out, as the manager does. Interfaces with no address
+  check, such as dummy ones, keep them, and they are named. IPv4 from the interfaces and the
+  `/32 host LOCAL` entries of `/proc/net/fib_trie`; IPv6 from `/proc/net/if_inet6`, without
+  deprecated, tentative or DAD-failed ones. Loopback and link-local
+  are left out. Unlike the manager, two kinds of IPv4 entries are named too, since `fib_trie`
+  records no scope and no interface: addresses added with `scope link` or `scope host`, and
+  single addresses routed to the host with `ip route add local <address>`. The default-route
+  interfaces come first, the preferred route's first, so the URL the install prints stays on them.
+  When `fib_trie` cannot be read, only the interfaces that are up are named, with a warning.
+- The certificate shows these addresses to every client, container bridges and Kubernetes service
+  addresses included. To name others, or fewer, set `WAZUH_DASHBOARD_CERT_SANS` in `local.env`.
+- To re-issue: remove the pair and run `--install`. With no CA in `ca/`, a new one is minted, and
+  clients must trust the new `export/ca.pem`.
 
 ## Peer CAs