Preparing the Kubernetes Lab for Wazuh

Validate the Kubernetes lab before deploying Wazuh: nodes, storage, namespaces, resources, DNS, and baseline troubleshooting commands.

Kubernetes SOC Field Lab · Practical Security Operations

Domain alignment

Lab objective

Validate that your Kubernetes lab is healthy enough to deploy a stateful security monitoring platform. Wazuh is heavier than a simple nginx lesson, so do not skip preflight checks.

Step 1: Confirm cluster access

kubectl config current-context
kubectl cluster-info
kubectl get nodes
kubectl get pods -A

Step 2: Check storage support

kubectl get storageclass
kubectl get pv
kubectl get pvc -A

Step 3: Check available resources

kubectl top nodes
kubectl top pods -A

Step 4: Create lab namespaces

kubectl create namespace wazuh
kubectl create namespace soc-lab
kubectl create namespace soc-observer

Step 5: Label namespaces for clarity

kubectl label namespace wazuh stealthitgroup.com/lab-role=soc-platform
kubectl label namespace soc-lab stealthitgroup.com/lab-role=monitored-workloads
kubectl label namespace soc-observer stealthitgroup.com/lab-role=tooling

Step 6: Baseline deployment test

kubectl -n soc-lab create deployment soc-demo-web --image=nginx:latest
kubectl -n soc-lab expose deployment soc-demo-web --port=80
kubectl -n soc-lab get all
kubectl -n soc-lab delete service soc-demo-web
kubectl -n soc-lab delete deployment soc-demo-web

Troubleshooting preflight failures

• If kubectl cannot connect, fix context or cluster availability before continuing.
• If nodes are not Ready, do not deploy Wazuh yet.
• If storage classes are missing, resolve storage before deploying stateful components.
• If system pods are failing, troubleshoot the cluster first.

Check your understanding

Use these questions to check whether the lab and analyst concepts are clear before moving forward.

1. Why run preflight checks before deploying Wazuh?
2. What command confirms the current cluster context?
3. What does kubectl get nodes validate?
4. Why does storage matter?
5. What namespace hosts Wazuh?
6. What namespace hosts demo workloads?
7. Why label namespaces?
8. What should you do if nodes are NotReady?
9. What should you check if PVCs stay Pending?
10. Why should you not deploy Wazuh into a broken cluster?