Cluster mode by default #7701

felipegonzalezmv · 2025-09-03T18:09:45Z

Description

This PR implements "Cluster by Default" functionality for Wazuh Dashboard v5.0+. The changes eliminate the distinction between cluster and manager modes, making cluster mode mandatory for all Wazuh installations.

Key Changes:

Removed conditional logic that switches between /cluster/ and /manager/ endpoints
Updated all filters to consistently use cluster.name instead of manager.name
Simplified UI components to always assume cluster mode is enabled
Updated RBAC permissions from manager:* actions to cluster:* actions
Removed cluster-disabled components and related UX elements
Updated sample data generation to use cluster-aware defaults
Eliminated /cluster/status endpoint calls as cluster is always enabled in v5.0+

Issues Resolved

Resolves Cluster mode by default #7688 - Cluster mode by default
Related to Cluster by default wazuh#31295 - Parent issue for cluster by default implementation
Addresses findings from spike Spike - Cluster by default #7670

Evidence

✅ Cluster Dashboard: Always shows cluster disable: false
✅ Dashboard Filters: Consistently use cluster.name across all views
✅ Management Components: No longer display cluster/manager mode toggles
✅ Agent Registration: Uses cluster endpoints exclusively
✅ Configuration Management: Operates with cluster-aware paths
✅ Statistics Overview: Shows cluster mode as default
✅ Sample Data: Functions correctly with cluster-by-default configuration

[Space reserved for screenshots]

Test

Filter Verification:
- Navigate to any dashboard (Overview, Agents, Security Events, etc.)
- Verify all filters use cluster.name field instead of manager.name
- Check that implicit filters (compliance, vulnerabilities) are applied correctly
- Confirm search queries include cluster context automatically
UI Components Testing:
- ✅ Verify cluster-disabled.js component no longer appears
- ✅ Check statistics overview always assumes cluster mode
- ✅ Test module configuration works with cluster nodes
- ✅ Verify vulnerability detection uses cluster endpoints only
- ✅ Confirm cluster overview loads without conditional checks
- ✅ Test configuration editing always uses cluster paths
RBAC & Permissions Testing:
- ✅ Verify manager:read, manager:update_config, manager:restart permissions removed
- ✅ Confirm cluster:status permission no longer referenced
- ✅ Test cluster:read, cluster:update_config, cluster:restart permissions work
- ✅ Check user authorization prompts use correct cluster permissions

Endpoint Testing Results

All critical endpoints verified to work correctly:

Configuration Management: ✅ Local and cluster node configuration access
Agent Registration: ✅ Cluster-aware endpoint routing
Logs Access: ✅ Local manager logs for cluster node
Cluster Operations: ✅ Node management and status checks
Authentication & Authorization: ✅ Updated RBAC permissions

Check List

All tests pass
[] New functionality includes testing
[] New functionality has been documented
Update CHANGELOG.md
Commits are signed per the DCO using --signoff

se cluster mode - Always use cluster.name instead of conditional cluster/manager logic - Update PatternDataSourceFilterManager to use cluster mode by default - Simplify last alerts query and service to always use cluster field - Update FilterHandler.managerQuery to default to cluster.name - Modify FIM and MITRE alert filters to use cluster.name consistently - Update compliance table requirement flyout filters

- Remove clusterStatusResponse function from register-agent-services - Update wz-fetch.js functions to use cluster endpoints only - Change /manager/ endpoints to /cluster/local/ for local configuration - Simplify restartNodeSelected, fetchFile, saveConfiguration functions - Update query-config.js to use cluster endpoints consistently - Remove cluster status checks from reload-cluster-manager-callout Related to: #7688

- Remove cluster-disabled component completely - Update module_configuration to always use cluster nodes - Simplify statistics-overview to always use cluster mode - Update validation functions to use cluster endpoints only - Change logs path from /manager/logs to /cluster/local/logs - Remove cluster status checks from UI components - Update cluster-overview to always show cluster dashboard - Simplify vulnerability module check to use cluster only - Update refresh-cluster-info and edit-configuration components

- Standardize the formatting of API request calls in valid-configuration.ts and valid-configuration.js to improve readability and maintainability. - Ensure consistent use of line breaks and indentation for better code clarity.

- Remove unnecessary conditional checks for cluster status in the WazuhApiCtrl class.

… formatting - Simplified the structure of the API request call to fetch cluster nodes. - Enhanced the formatting of the return object for clarity and consistency.

- Remove cluster/manager conditional in sample data generation - Always use cluster mode panels in analysis engine dashboard - Eliminate 'Disabled' cluster name checks in sample data Related to: #7688

- Simplified API request logic in valid-configuration.ts to improve readability. - Updated wz-fetch.js and query-config.js to consistently use /manager endpoints for configuration requests. - Changed logs path in logs.js from /cluster/local/logs to /manager/logs for uniformity.

- Updated the validateAfterSent function to dynamically construct the API endpoint based on the node parameter. - Simplified the API request call for validation to enhance code clarity and maintainability.

- Renamed checkClusterIsEnabledAndRunning to getClusterStatus for clarity. - Updated loading message in ClusterOverview component to reflect loading state. - Removed unused clusterReq import in configuration-switch.js and statistics-overview.js. - Streamlined API request formatting in status-handler.js for improved readability. - Simplified cluster information update logic in WzConfigurationSwitch component.

- Eliminated the isCluster state and related logic from WzReloadClusterManagerCallout component. - Removed unused clusterReq import from multiple files, streamlining the codebase. - Updated checkDaemons function to remove the isCluster parameter, simplifying its implementation. - Ensured consistent handling of cluster status checks across the application.

… imports - Removed the unused saveFileManager function from wz-fetch.js to simplify the codebase. - Updated WzEditConfiguration component to always use cluster-related logic, reflecting the default cluster mode. - Enhanced clarity in the cluster configuration title and messages throughout the component. - Added comments to clarify that cluster is always enabled and running in version 5.0+.

- Updated the logic to ensure that the selected node is properly set, defaulting to the first available node if a master node is not found. - Added error handling to return a clear message when no cluster nodes are available. - Improved user feedback by displaying a warning toast if no cluster node is selected during log export. - Streamlined the API request structure for fetching cluster nodes and exporting logs.

…uration components - Updated WzEditConfiguration and WzRefreshClusterInfoButton components to ensure clusterNodeSelected is always available before saving configurations. - Enhanced error handling by throwing an error when no cluster node is selected. - Streamlined the logic for selecting the master node, defaulting to the first available node if necessary. - Removed outdated comments and improved code clarity for better maintainability.

…nents - Eliminated the cluster status retrieval logic from various components, reflecting that the cluster is always enabled and running in version 5.0+. - Updated the DashboardCT and ClusterOverview components to remove unnecessary props and simplify their structure. - Cleaned up the WzStatusOverview component by removing outdated cluster status checks and related error handling. - Streamlined API requests in manage-hosts.ts to align with the new cluster behavior.

Copilot

Pull Request Overview

This PR implements "Cluster by Default" functionality for Wazuh Dashboard v5.0+, making cluster mode mandatory for all Wazuh installations. The changes eliminate the distinction between cluster and manager modes by removing conditional logic that switches between cluster and manager endpoints, updating filters to always use cluster.name, and simplifying UI components to assume cluster mode is always enabled.

Removed all cluster status checks and conditional logic between cluster/manager modes
Updated all filters and API endpoints to consistently use cluster paths
Simplified UI components by removing cluster-disabled states and manager mode handling

Reviewed Changes

Copilot reviewed 32 out of 32 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
plugins/wazuh-core/server/services/manage-hosts.ts	Removed cluster status check, always assumes cluster enabled
plugins/main/server/controllers/wazuh-api.ts	Simplified daemon validation to always check clusterd
plugins/main/public/utils/filter-handler.js	Updated to always use cluster.name field
plugins/main/public/react-services/query-config.js	Code formatting improvements
plugins/main/public/controllers/overview/components/last-alerts-stat/	Updated to always use cluster fields
plugins/main/public/controllers/management/components/management/status/	Removed cluster status checks, simplified to cluster-only mode
plugins/main/public/controllers/management/components/management/configuration/	Updated all configuration handling to use cluster endpoints
plugins/main/public/components/management/cluster/cluster-overview.tsx	Removed cluster status checking, always shows cluster dashboard
plugins/main/public/components/overview/vulnerabilities/	Updated module checks to use cluster endpoints
plugins/main/public/components/endpoints-summary/register-agent/	Removed cluster status checks, always use cluster mode
plugins/main/public/components/common/	Updated filters and utilities to always use cluster.name
plugins/main/public/components/add-modules-data/sample-data.tsx	Updated sample data generation to use cluster info
docker/imposter/wazuh-config.yml	Removed cluster status endpoint
CHANGELOG.md	Added entry documenting cluster by default changes

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

plugins/main/public/controllers/management/components/management/mg-logs/logs.js

...lers/management/components/management/configuration/edit-configuration/edit-configuration.js

plugins/main/public/components/management/cluster/dashboard/dashboard.tsx

…n WzEditConfiguration - Removed unnecessary props from the DashboardCT component for improved clarity. - Updated WzEditConfiguration to gracefully handle missing clusterNodeSelected, providing user feedback through a toast notification instead of throwing an error. - Enhanced overall code readability and maintainability by cleaning up comments and structure.

…ions - Eliminated cluster status actions from security actions and policies, reflecting the new cluster behavior. - Updated user permission requirements across various components to use 'cluster:read' instead of 'cluster:status' and 'manager:read'. - Streamlined code by removing unnecessary checks and ensuring consistent permission handling throughout the application.

- Eliminated redundant dashboard panel definitions to streamline the code and improve maintainability.

…ule checks - Eliminated unnecessary 'cluster:read' permission with wildcard resource from both ModuleEnabledCheck and status overview components to enhance clarity and maintainability in user permission requirements.

…ation - Changed the resource for 'cluster:read' permission from wildcard to 'node:id:*' in both ClusterOverview and configuration-switch components to enhance security and specificity in user authorization checks.

…itor - Removed the check for missing clusterNodeSelected during save operation to streamline the saving process. - Updated the save button's disabled state to include the condition for clusterNodeSelected, improving user feedback and preventing save attempts without a selected node.

… handling - Simplified the permissions logic for the configuration edit button by using a single resource for 'cluster:update_config'. - Removed the conditional rendering of the cluster node selection component to enhance clarity in the UI. - Cleaned up the mapStateToProps by removing the unused 'clusterNodeSelected' state, improving maintainability.

- Streamlined the URL construction logic by removing unnecessary conditions, enhancing clarity and maintainability in the configuration fetching process.

- Updated the error handling logic in the Wazuh API to streamline the ping process by removing the isCluster parameter. - Eliminated the checkDaemons function from both the public and server controllers, enhancing code clarity and maintainability.

- Eliminated the isClusterMode parameter from DashboardStatistics and DashboardTabsPanels components to simplify the code. - Updated related functions to reflect the removal of the parameter, enhancing maintainability and clarity in the dashboard analysis engine.

- Eliminated the updateClusterEnabled action from statusActions and its usage in the WzStatusOverview component, as cluster mode is always enabled in version 5.0 and above. - This change simplifies the code and enhances maintainability by removing unnecessary complexity related to cluster status management.

- Streamlined the URL construction logic in the queryConfig function by removing unnecessary conditions related to the agentId and node parameters. - This change enhances code clarity and maintainability in the configuration fetching process.

- Revised the documentation for the filter creation function to specify that it is for cluster queries, removing the mention of manager queries for better accuracy. - Removed the isCluster parameter from the documentation, as it is no longer relevant in version 5.0 and above, enhancing clarity and maintainability.

…mponents - Simplified the logic for selecting the master node in both the WzEditConfiguration and WzRefreshClusterInfoButton components by directly finding the master node in the affected items array. - Removed the intermediate variable for masterNode to enhance code clarity and maintainability.

…on logic - Eliminated the status property from the cluster_info object in the Wazuh API and related components, as cluster mode is always enabled in version 5.0 and above. - Updated the API connection logic to directly use the cluster name, enhancing clarity and maintainability.

… components - Eliminated comments indicating that cluster mode is always enabled in version 5.0 and above from multiple files, enhancing code clarity and maintainability. - Updated documentation and comments to reflect the current state of the code without unnecessary repetition.

felipegonzalezmv · 2025-09-11T16:09:49Z

Remove the comments related to: Always check clusterd in v5.0+

Done in c823d77

- Enabled cluster mode by default for all Wazuh installations, including single-node deployments, and updated RBAC permissions to use `cluster:*` actions. - Removed all logic related to manager mode, streamlining the application and enhancing maintainability. [#7688](#7688)

- Added a new function to check the status of daemons using cluster endpoints, enhancing the monitoring capabilities of the Wazuh API. - Updated the Wazuh API controller to return the daemons status in response to requests, improving the overall functionality and reliability of the system. - Adjusted the ping logic to incorporate the new daemons status check, ensuring that the system accurately reflects the readiness of the Wazuh services.

Machi3mfl · 2025-09-12T15:31:17Z

Test

Filter Verification:
- Navigate to any dashboard (Overview, Agents, Security Events, etc.)
- Verify all filters use cluster.name field instead of manager.name
- Check that implicit filters (compliance, vulnerabilities) are applied correctly
- Confirm search queries include cluster context automatically

Screen.Recording.2025-09-12.at.12.00.20.PM.mov

UI Components Testing:
- Verify cluster-disabled.js component no longer appears
- Check statistics overview always assumes cluster mode
- Test module configuration works with cluster nodes
- Verify vulnerability detection uses cluster endpoints only
- Confirm cluster overview loads without conditional checks
- Test configuration editing always uses cluster paths

RBAC & Permissions Testing:
- Verify manager:read, manager:update_config, manager:restart permissions removed
- Confirm cluster:status permission no longer referenced
- Test cluster:read, cluster:update_config, cluster:restart permissions work
- Check user authorization prompts use correct cluster permissions

Machi3mfl

@felipegonzalezmv, We need to update 2 snapshots that are failing in the workflow.

- Replaced instances of 'Cluster status' with 'Cluster name' in the test cases to align with recent updates in the cluster configuration. - Updated snapshot files to reflect the new structure and values, ensuring accurate testing of the cluster settings component.

…:wazuh/wazuh-dashboard-plugins into enhancement/7688-cluster-mode-by-default

felipegonzalezmv · 2025-09-12T19:18:45Z

@felipegonzalezmv, We need to update 2 snapshots that are failing in the workflow.

solve in this commit 0012b6e

github-actions · 2025-09-12T19:19:26Z

Wazuh Core plugin code coverage (Jest) test	%	values
Statements	46.28%	( 392 / 847 )
Branches	44.01%	( 169 / 384 )
Functions	40.68%	( 118 / 290 )
Lines	46.42%	( 389 / 838 )

github-actions · 2025-09-12T19:19:47Z

Wazuh Check Updates plugin code coverage (Jest) test	%	values
Statements	78.72%	( 185 / 235 )
Branches	62.72%	( 69 / 110 )
Functions	61.7%	( 29 / 47 )
Lines	78.72%	( 185 / 235 )

github-actions · 2025-09-12T19:23:17Z

Main plugin code coverage (Jest) test	%	values
Statements	16.59%	( 4965 / 29922 )
Branches	10.86%	( 2041 / 18781 )
Functions	17.8%	( 1306 / 7335 )
Lines	16.84%	( 4853 / 28813 )

felipegonzalezmv added 2 commits September 3, 2025 10:26

felipegonzalezmv linked an issue Sep 3, 2025 that may be closed by this pull request

Cluster mode by default #7688

Open

10 tasks

felipegonzalezmv requested a review from Copilot September 3, 2025 18:10

This comment was marked as outdated.

Sign in to view

felipegonzalezmv added 6 commits September 3, 2025 14:10

refactor: format API request calls in validation functions

97caa20

- Standardize the formatting of API request calls in valid-configuration.ts and valid-configuration.js to improve readability and maintainability. - Ensure consistent use of line breaks and indentation for better code clarity.

refactor: simplify cluster status checks in Wazuh API controller

5c88829

- Remove unnecessary conditional checks for cluster status in the WazuhApiCtrl class.

update: changelog

0fadf79

refactor: improve readability of logs.js by standardizing API request…

dc78860

… formatting - Simplified the structure of the API request call to fetch cluster nodes. - Enhanced the formatting of the return object for clarity and consistency.

feat: update remaining cluster conditional logic for cluster by default

e693ee6

- Remove cluster/manager conditional in sample data generation - Always use cluster mode panels in analysis engine dashboard - Eliminate 'Disabled' cluster name checks in sample data Related to: #7688

felipegonzalezmv requested a review from Copilot September 3, 2025 20:02

This comment was marked as outdated.

Sign in to view

felipegonzalezmv requested a review from Copilot September 4, 2025 14:09

refactor: streamline validation endpoint logic in wz-fetch.js

d082365

- Updated the validateAfterSent function to dynamically construct the API endpoint based on the node parameter. - Simplified the API request call for validation to enhance code clarity and maintainability.

This comment was marked as outdated.

Sign in to view

felipegonzalezmv added 4 commits September 4, 2025 13:44

felipegonzalezmv requested a review from Copilot September 4, 2025 19:51

This comment was marked as outdated.

Sign in to view

felipegonzalezmv added 2 commits September 5, 2025 08:00

felipegonzalezmv requested a review from Copilot September 5, 2025 19:01

Copilot AI reviewed Sep 5, 2025

View reviewed changes

asteriscos assigned felipegonzalezmv Sep 8, 2025

felipegonzalezmv added 15 commits September 10, 2025 09:45

refactor: remove unused 'status' prop from OverviewCards component

d01fad7

refactor: remove unused dashboard panels from analysis engine

2757797

- Eliminated redundant dashboard panel definitions to streamline the code and improve maintainability.

refactor: simplify URL construction in getCurrentConfig function

f7eccbb

- Streamlined the URL construction logic by removing unnecessary conditions, enhancing clarity and maintainability in the configuration fetching process.

Machi3mfl self-requested a review September 12, 2025 12:13

gonzaarancibia self-requested a review September 12, 2025 14:29

Merge branch 'main' into enhancement/7688-cluster-mode-by-default

0e7f32f

Machi3mfl requested changes Sep 12, 2025

View reviewed changes

felipegonzalezmv added 2 commits September 12, 2025 14:15

Merge branch 'enhancement/7688-cluster-mode-by-default' of github.com…

4dca606

…:wazuh/wazuh-dashboard-plugins into enhancement/7688-cluster-mode-by-default

felipegonzalezmv requested a review from Machi3mfl September 12, 2025 19:17

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Cluster mode by default #7701

Cluster mode by default #7701

Uh oh!

felipegonzalezmv commented Sep 3, 2025 •

edited

Loading

Uh oh!

This comment was marked as outdated.

Uh oh!

This comment was marked as outdated.

Uh oh!

This comment was marked as outdated.

Uh oh!

This comment was marked as outdated.

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

felipegonzalezmv commented Sep 11, 2025

Uh oh!

Machi3mfl commented Sep 12, 2025

Uh oh!

Machi3mfl left a comment

Uh oh!

felipegonzalezmv commented Sep 12, 2025

Uh oh!

github-actions bot commented Sep 12, 2025

Uh oh!

github-actions bot commented Sep 12, 2025

Uh oh!

github-actions bot commented Sep 12, 2025

Uh oh!

Uh oh!

Cluster mode by default #7701

Are you sure you want to change the base?

Cluster mode by default #7701

Uh oh!

Conversation

felipegonzalezmv commented Sep 3, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Issues Resolved

Evidence

Test

Endpoint Testing Results

Check List

Uh oh!

This comment was marked as outdated.

Uh oh!

This comment was marked as outdated.

Uh oh!

This comment was marked as outdated.

Uh oh!

This comment was marked as outdated.

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

felipegonzalezmv commented Sep 11, 2025

Uh oh!

Machi3mfl commented Sep 12, 2025

Test

Uh oh!

Machi3mfl left a comment

Choose a reason for hiding this comment

Uh oh!

felipegonzalezmv commented Sep 12, 2025

Uh oh!

github-actions bot commented Sep 12, 2025

Uh oh!

github-actions bot commented Sep 12, 2025

Uh oh!

github-actions bot commented Sep 12, 2025

Uh oh!

Uh oh!

felipegonzalezmv commented Sep 3, 2025 •

edited

Loading