[v5.0.0]
Added
| Issue | Comment |
|---|---|
| #2724 | Check the signature of the Wazuh packages and the checksum of tini before installing them in the images
|
| #2706 | Add Wazuh indexer dependencies on builder final stage |
| #2717 | Start the Docker integration tests from PR labels |
| #2619 | Add CA verification |
| #2606 | Support the unified WAZUH_MANAGER_ENDPOINT connection URL in the Wazuh agent, alongside WAZUH_MANAGER_SERVER and WAZUH_MANAGER_PORT
|
| #2524 | Set authd password in agents installation. |
| #2460 | Added bump-issue-link support for Revert Stage Bump. |
| #2491 | Add integration test module docs |
| #2188 | Implement the wazuh-docker integration testing module |
| #2320 | Support Revert bump functionality in wazuh-docker |
| #2276 | Add --set-as-main flag support to repository bumper — wazuh-docker
|
Changed
| Issue | Comment |
|---|---|
| #2764 | Align the docs with the 5.0.0 code and packages: published export/credentials.env, environment variables, missing certificate pair messages, certificates tool URLs, Docker backup, and the remoted bind address comment
|
| #2758 | Make the Wazuh dashboard listen on 443 inside the container in the single-node and multi-node stacks, as the image, the package and the Kubernetes deployment do
|
| #2743 | Adapt the images and stacks to the RC 2 per-package credentials and /etc/wazuh-manager, and build the final images on amazonlinux:2023-minimal with pre-pulled base images
|
| #2728 | Mount the Server API certificate issued by wazuh-certs-tool.sh on the manager node that runs the API
|
| #2716 | Rename the wazuh-wui Server API user to wazuh-internal-client, following wazuh/wazuh#40066. The WAZUH_MANAGER_WUI_PASSWORD key keeps its name
|
| #2674 | Adapt Docker images to install-time credential generation |
| #2676 | Replace manual authd.pass/<endpoint> writing in the agent's 0-wazuh-init with WAZUH_ENROLLMENT_TOKEN support, following wazuh/wazuh#39063
|
| #2652 | Mount the Wazuh manager agent listener certificate, and forward --agent-san to the certificate creation tool
|
| #2635 | Honour the scheme given in WAZUH_INDEXER_HOSTS, and drop the <ssl> block from the indexer configuration when it resolves to http
|
| #2621 | Change cluster key assigment |
| #2622 | Check the Wazuh API accounts of every manager node in check-default-credentials.sh, and document the worker step of the multi-node password change
|
| #2643 | Remove the OpenSearch demo users from the indexer image, add password-tool.sh to change the indexer and API passwords of a running deployment, and stop publishing the indexer port 9200
|
| #2601 | Regenerate the manager self-signed server certificate per container at first boot |
| #2564 | Add default AI assistant encryption key in the post installation script |
| #2581 | Change Codebuild runners to Github runners |
| #2537 | Update deployment for Wazuh Indexer 5.0.0 RBAC |
| #2539 | Add new WF for changelog check |
| #2502 | Change artifact upload and download |
| #2471 | Change runners on repository workflows 5.x |
| #2446 | PR revamp modifications 5.x |
| #2399 | Forbid pr_check workflow execution in draft PRs |
| #2375 | Unification of user UID and GID |
| #2392 | Wazuh indexer engine requirements |
| #2356 | Image build process update |
| #2333 | Add new path on artifact_urls file |
| #2341 | Unable to generate single component in Procedure_push_docker_images
|
| #2276 | Adapt bumper workflows to change main branch |
| #2288 | Ensure default values are used for variables and passwords |
| #2283 | Docker - Ensure correct Wazuh manager certificates ownership |
| #2278 | Docker - Standarize Artifact URL keys |
| #2266 | Modify artifact URLs file name. |
| #2218 | URL presigned file - Update the Wazuh Docker image creation workflow |
| #2264 | Updated wazuh-docker documentation config and tooling versions to meet new standards. |
| #2250 | Align cert generation steps with current cert-tool ip validation |
| #2229 | Modify Healthchecks |
| #2229 | Add deployment healthchecks |
| #2242 | Update artifact generation jobs to use wz-linux dedicated runner group |
| #2237 | Error during Wazuh manager entrypoint |
| #2230 | Adapt PR test for workflow_dispatch option |
| #2227 | Wazuh Manager/agent Separation - Breaking changes summary |
| #2222 | Errors in wazuh-docker PR Test |
| #2206 | Development - Separate Agent/Manager - Docker - Adapt image build process |
| #2217 | Remove revision input |
| #2196 | Build images script improvement |
| #2197 | Missing documentation in the wazuh-docker repository |
| #2195 | Add Wazuh version and revision into wazuh-certs-tool and config file |
| #2172 | Improve S3 artifact URLs handling |
| #2164 | Allow building separate targets |
| #2179 | Add developement option when tag name is only version without stage |
| #2178 | Add IMAGE_TAG stage reference |
| #2171 | Remove Wazuh agent configuration template |
| #2156 | Docker - Ensure run_as set to true for every deployment alternative
|
| #2150 | Change macOS and Windows deployment documentation |
| #2131 | Modify docker build image process |
| #2136 | Update documentation for Wazuh Docker image builder and workflow usage |
| #2081 | Configure deployment with environment variables |
| #2058 | Modify Wazuh components install method |
| #2054 | Image builder Workflow Rebuild |
| #2108 | Remove the Filebeat references and update the Wazuh dashboard plugin references to opensearch_dashboards.yml
|
| #2072 | Exclude the customized configuration files from the image build |
| #1933 | Remove Wazuh Manager deprecated daemons and CLI tools |
| #1891 | DevOps - Docker - OpenSearch 3.0 deprecated settings |
Removed
| Issue | Comment |
|---|---|
| #2762 | Remove the undocumented /wazuh-migration path from the manager image: it copied 4.x files (including global.db, which 5.0 refuses) into the manager on start; the supported path is the 4.x to 5.0 manager migration of wazuh/wazuh, now documented for Docker in the upgrade guide
|
Fixed
| Issue | Comment |
|---|---|
| #2780 | Drop the /var/log/dnf.log and /var/log/dnf.rpm.log <localfile> blocks the agent package adds in the builder stage, which the final agent image does not have, and fail the build if ossec.conf monitors a file missing from the image
|
| #2776 | Fixing integration tests |
| #1154 | Fix partial password changes when password-tool.sh failed in the middle of the password change process |
| #2742 | Build the final images from the production packages with build-images.sh --release, instead of falling back to the pre-release packages of the VERSION.json stage while the GitHub release is still a draft or the GitHub API is rate-limited
|
| #2756 | Stop the manager before password-tool.sh writes the rotated wazuh-manager password into its keystore, and keep the manager supervisor from killing the container during a restart or reload
|
| #2760 | Stop publishing and exposing 514/udp, which the Wazuh manager 5.0 does not listen on, and let opensearch_dashboards.yml be mounted as a single file by writing its settings through the file instead of sed -i
|
| #2723 | Remove the stale internal_options.conf entry from the Wazuh manager PERMANENT_DATA_EXCP list, so wazuh-manager-internal-options.conf overrides survive upgrades, and fail the image build when a listed path does not exist
|
| #2721 | Stop certificates-conf.sh when wazuh-certs-tool.sh fails or wazuh-certificates/ is missing, and give config.yml back to the user who ran it with sudo
|
| #2720 | Download the artifact_urls file of the requested version in build-images.sh instead of reusing a leftover artifact_urls.yaml, and add -a/--artifact-urls to build from a given file
|
| #2719 | Report that the Wazuh agent connects without verifying the manager when no TLS material is configured |
| #2690 | Unset INDEXER_PASSWORD and DASHBOARD_PASSWORD after keystore write |
| #2675 | Fixed docker-agent package generation: seed the CHANGE_MANAGER_ENDPOINT placeholder in the Dockerfile itself instead of relying on the installer, which stopped writing it without an enrollment token
|
| #2664 | Enable strict TLS hostname verification by default between the dashboard and the indexer |
| #2628 | Persist the Wazuh manager data directory on a named volume in the single-node and multi-node deployments, so the deployed detection content survives recreating the container, and refresh the content the image owns from the image on every start
|
| #2629 | Append opensearch_security.cookie.ttl when missing from opensearch_dashboards.yml instead of silently discarding OPENSEARCH_SECURITY_COOKIE_TTL; removed the PATTERN, CHECKS_*, APP_TIMEOUT, API_SELECTOR, IP_SELECTOR, IP_IGNORE and WAZUH_MONITORING_* environment variables, which no longer correspond to any setting the dashboard plugin accepts
|
| #2638 | Fixed manager/dashboard environment variable attribution and documented missing manager variables |
| #2631 | Escape special sed replacement characters so passwords and keys with &, , or the delimiter are no longer corrupted or silently discarded |
| #2632 | Fix agent re creation and re-enrollment |
| #2626 | Supervise the manager daemons from the entrypoint and exit if a critical one dies, so restart: always can bring the container back instead of it staying up indefinitely with a dead API
|
| #2634 | Default WAZUH_CLUSTER_BIND_ADDR to 0.0.0.0 so the published manager image actually starts |
| #2630 | Fixed WAZUH_INDEXER_HOSTS parsing: hosts without an explicit port, URLs with a scheme, and bracketed IPv6 addresses were silently mangled instead of being parsed correctly, and unparseable values were written to the config without any error |
| #2627 | Fixed manager and dashboard healthchecks to correctly detect failures instead of always reporting healthy |
| #2604 | Adapt Wazuh manager image to new enroll process |
| #2594 | Added diffutils to the Wazuh agent image so FIM report_changes can generate content diffs
|
| #2590 | Restore WAZUH_MANAGER_PORT support in the Wazuh agent image and document the enrollment variables removed in 5.0.0
|
| #2578 | Report skipped bumps in the repository bumper workflow |
| #2584 | Adapt certificate deployment to the unified manager certificate layout (root:wazuh-manager 0640, dir 1770) |
| #2563 | Fixed changelog check workflow to accept Prior versions entries |
| #2529 | Fix bumper workflow failure when bump produces no changes |
| #2477 | Bumper script issue when the tag is set to false |
| #2443 | Fix reported WF vulnerabilities |
| #2422 | Adapt Wazuh manager healthcheck with local binaries |
| #2337 | The Wazuh Docker image cannot be built during the Nightly |
| #35457 | Docker and AMI workflows failing during stage release (v5.0.0-beta1) |
| #2274 | PR check issues |
| #2271 | Wazuh manager Healthcheck |
| #2258 | Delete WAZUH_AGENT_GROUPS of Wazuh 5.0.0 images build |
| #2128 | Development - DevOps 5.0 adaptation - Docker - Delete lists directory references |