Notifications
Clear all
Topic starter
19/08/2026 4:07 pm
TL;DR: Kubernetes deployments can break monitoring continuity when pod identity changes, so Wazuh recommends sidecar and included patterns that preserve agent registration, hostname, and log continuity across reschedules, according to Wazuh. The core issue is not container orchestration itself but whether persistent workload identity survives the lifecycle of an ephemeral pod.
NHIMG editorial — based on content published by Wazuh: Deploying Wazuh agents in Kubernetes using sidecar and included patterns
Questions worth separating out
Q: How should security teams preserve workload identity in Kubernetes monitoring setups?
A: Use persistent storage for registration state, stable naming through StatefulSets, and a deployment model that keeps the agent recognisable after pod recreation.
Q: What breaks when a monitoring agent loses its identity after pod rescheduling?
A: Event correlation fragments, host records reset, and security teams lose continuity across restarts even though the application has not materially changed.
Q: How do sidecar and included deployment patterns differ for Kubernetes agents?
A: Sidecar deployment keeps the agent and application in separate containers with shared access to data, while included deployment bundles both into one image.
Practitioner guidance
- Preserve agent registration outside the pod lifecycle Store registration keys, hostname state, and other identity-bearing files on persistent volumes so a recreated pod is still recognised as the same monitored workload.
- Prefer StatefulSets for identity-sensitive monitoring agents Use StatefulSets when the security tool needs stable naming and predictable reattachment after rescheduling, especially in ephemeral Kubernetes clusters.
- Separate agent lifecycle from application release cycles Deploy the agent as a sidecar when you need independent monitoring continuity without rebuilding the application image for every security change.
What's in the full article
Wazuh's full blog post covers the operational deployment details this analysis intentionally leaves for the source:
- The exact Kubernetes manifests for sidecar and included deployment patterns, including StatefulSet and persistent volume configuration.
- The step-by-step Longhorn and K3s setup used to make the lab environment work in practice.
- The full init-container logic for preserving agent files, permissions, and registration state across pod recreation.
- The complete pod recreation test results showing how the Wazuh manager re-associates the same agent identity after rescheduling.
👉 Read Wazuh's guide to persistent Wazuh agent deployments in Kubernetes →
Wazuh agent persistence in Kubernetes: which deployment pattern fits?
Explore further
19/08/2026 4:41 pm
Persistent workload identity is the real control objective here, not pod permanence. Kubernetes pods are intentionally disposable, so identity must survive outside the pod lifecycle if monitoring is to remain trustworthy. The article shows that persistence belongs to the agent's registration state, not to the pod object itself. For practitioners, the key question is whether the monitoring identity can outlive ordinary cluster churn without being reissued as a new entity.
A few things that frame the scale:
- 88.5% of organisations acknowledge that their non-human IAM practices lag behind or are merely on par with their human identity and access management efforts, according to the 2024 Non-Human Identity Security Report.
- Only 19.6% of security professionals express strong confidence in their organisation's ability to securely manage non-human workload identities, which helps explain why Kubernetes monitoring identities remain fragile.
A question worth separating out:
Q: Why do NHI controls matter for container monitoring agents?
A: Because the agent is a non-human identity whose credentials, registration state, and lifecycle determine whether the monitoring record remains trustworthy. Without NHI governance, ephemeral containers can turn one workload into many apparent identities, which weakens visibility and response.
👉 Read our full editorial: Kubernetes Wazuh agent identity persistence in ephemeral workloads
