Support ARM architecture for Wazuh central components

[c-bordon]

Description

In the Wazuh 4.10.2 version, Wazuh central components support ARM64 architecture, so it is necessary to verify that the operating systems supported by Ansible for AMD64 architecture also support ARM64.

Tasks

• Investigate the availability of supported OS for Ansible deployment for ARM architecture
• Analyze what changes would be necessary to make in the playbooks to support the ARM architecture
• Revise the installation documentation to include instructions and notes specific to ARM architecture setups.
• Perform tests for the ARM architecture
• Verify that the deployment works for both AMD64 and ARM64 architectures

Related

Modify installation scripts for ARM architecture.

[YisDav]

Ansible Compatibility with ARM64

Based on my research, Ansible is compatible with ARM64 architecture and supports the same operating systems as it does for AMD64, provided there is an SSH connection to the client. This means that the following operating systems are supported for ARM64 deployment:

• CentOS 8
• Amazon Linux 2
• Ubuntu 22.04
• RHEL 8

Additionally, Ansible facts can be utilized to dynamically retrieve the architecture of the target system (ansible_architecture), thereby facilitating seamless access to the host's architectural information. This allows us to identify whether the current host is AMD64 or ARM64. The possible values returned by the architecture fact are:

• armv6l: armhf
• armv7l: armhf
• aarch64: arm64
• x86_64: amd64
• i386: i386

Sources:

• Ansible Community Documentation: Discovering variables and facts
• Stack Overflow: Architecture fact in Ansible
• GitHub: Ansible grep for 'ansible_architecture'

[YisDav]

Required changes

Playbooks

• Remove unsupported parameter "warn: false" in the check-packages main task
• Modify the Wazuh components packages download URL in packages_uri.txt for the check-packages task

Workflows

• Adapt the var assignation of COMPOSITE_NAME to perform ARM64 instance allocation (i.e., Distributed & AIO PR checks)

[YisDav]

Filebeat compatibility issue

Using the distributed Ansible workflow, a cluster of instances was launched, where the two servers (manager and worker) had ARM architecture, while the rest of the components had AMD architecture. The deployment was tested with version v4.9.2 (the latest version available in production). We also forced the use of Pre-Release for the arm64 package for Wazuh Manager.

Workflow link: here

In this process, the following error was encountered (for both yum and apt), corresponding to no **filebeat package being found available for the arm64 architecture**.

RHEL-based

Debian-based

[teddytpc1]

Packages were generated: info.

[YisDav]

Update

Using the packages previously uploaded, and performing a fixed setting of the repository, versioning and package download variables (among others), a functional deployment of Ansible on ARM64 hosts was achieved.

The tested hosts were: Ubuntu 22, AL2, RHEL8, CentOS 8, with an AIO and distributed installation.

Evidence

Workflow execution links:

• AIO: https://github.com/wazuh/wazuh-ansible/actions/runs/12876770897
• Distributed: https://github.com/wazuh/wazuh-ansible/actions/runs/12887975714

Conclusion

With minor adjustments (see) to versions and repositories, the Wazuh Ansible installation method successfully enables the installation of Wazuh on ARM64 hosts.

Therefore, it can be concluded that the repository configuration for version 4.12.0 is fully compatible with installing Wazuh on various hosts, including both AMD64 and ARM64 architectures, across different operating systems.