Indexer initialization plugin

[davidjiglesias]

Description

This issue aims to ensure that the Wazuh Indexer validates and sets up all required components during its initialization phase. This includes the creation and verification of necessary indices, pipelines, and security roles. By doing so, the Indexer avoids startup inconsistencies, reduces integration issues with Wazuh Servers, and simplifies the overall deployment process.

Functional requirements

1. The Wazuh Indexer must ensure all required components are initialized before accepting indexing requests. These include:
   • Stream indices, mappings, and ingest pipelines.
   • State indices, mappings, and ingest pipelines.
   • Role-Based Access Control (RBAC): Ensure required users exist with minimal necessary permissions.
   • Rollover and alias configuration for stream indices.
2. The Indexer plugin must use OpenSearch’s plugin and lifecycle APIs to initialize the features listed above during startup.
3. The Indexer plugin must include error handling that provides clear, actionable, and user-friendly error messages if any component fails to initialize.
4. The Wazuh Indexer must block ingestion and indexing operations until it confirms that all initialization tasks are complete and successful. This includes rejecting API requests during the unready state.
5. The plugin must ensure that the process to create and assign custom roles for built-in users is documented thoroughly, including permission scopes.

Non-functional requirements

• Resilience: The plugin must gracefully handle and retry temporary failures (e.g., index service delays or permission issues), with configurable backoff.
• Security: The plugin must follow the principle of least privilege when assigning default roles and permissions, and validate RBAC integrity before enabling indexing.
• Observability: All steps of the initialization process must be clearly logged.
• Performance: Initialization should complete within a defined timeout (e.g., 60 seconds by default).
• Maintainability: Initialization logic must be modular and documented, allowing future updates to add support for new index types, roles, or mappings with minimal changes.

Implementation restrictions

1. This feature will be developed as an OpenSearch plugin.
2. The plugin must be implemented in Java, following OpenSearch plugin development standards.
3. The plugin will be included by default in Wazuh Indexer packages and initialized automatically at node startup.

Plan

Spike

• Spike - Identify stream and state indices #432
• Spike - Identify Wazuh Indexer users #467
• Spike - Viability analysis of creating ISM policies within a plugin #435
• Spike - Viability analysis of blocking indexing operations #433
• Spike - Review mappings and ISM policy for wazuh-statistics and wazuh-monitoring #468

Development

• Prepare wazuh-indexer-plugins repo for 5.x #438
• Implement indices creation for 5.0.0 #434
• Create Wazuh Indexer users and roles #462
• Create ISM rollover policy for stateless indices #466

Requirements traceability matrix

• Checkpoint - Review documentation for the initialization plugin
• Checkpoint - Initialization plugin E2E test

Notes

• Future work:
• Technical debt:
• Missed requirements:
• Other considerations: