Welcome to Wolkwacht

Optimizing Azure Container Apps Costs: Scaling to Zero, Workload Profiles, and FinOps Azure Container Apps enables teams to deploy APIs, background processors, scheduled jobs, and event-driven services without directly managing Kubernetes infrastructure. However, this convenience does not automatically ensure cost optimization. Container Apps costs depend on application behavior: the number of replicas, their active duration, the workload profile hosting them, and the telemetry or network traffic they produce. An efficient setup for an unpredictable queue worker might be wasteful for a constantly busy API, and vice versa. ...

Part 1 introduced AppNet, while Part 2 demonstrated its use in zero-trust and multi-cluster patterns. This concluding section explores a shared AI gateway, the operational signals derived from the mesh, and the architectural tradeoffs that influence whether AppNet should be integrated into your platform. Series navigation Part 1: What AppNet is and how to get started Part 2: Zero-trust and multi-cluster patterns Part 3: AI gateway, observability and production fit Example three: a shared AI gateway that rate-limits by application AI Gateway with Per-Application Token Rate Limiting] ...

In Part 1, we discussed the AppNet architecture, setup process, and waypoint model. This second part shifts focus from mechanics to platform patterns: it covers enforcing service-to-service authorization for a payments platform, and then using AppNet across AKS clusters for active-active regional architectures. Series navigation Part 1: What AppNet is and how to get started Part 2: Zero-trust and multi-cluster patterns Part 3: AI gateway, observability and production fit Example one: Zero-trust authorization for a payments platform Zero-Trust Authorization — Payments Namespace ...

Azure Kubernetes Application Network, Part 1: What AppNet Is and How to Get Started The space between ‘we have ingress’ and ‘we run a full service mesh with sidecars on every pod’ has always been a challenging middle ground. Platform teams want encrypted east-west traffic, identity-based authorization, and good observability, but aim to avoid the CPU, memory, startup delay, and on-call burden associated with a sidecar on each workload. Security architects look for a zero-trust framework they can verify during audits, not just visual diagrams. Application developers need routing, retries, and traffic shifting without needing to understand Envoy’s internals. Meanwhile, platform engineers prefer these features as first-class Azure resources rather than managing complex Helm charts that require constant oversight. ...

When Your Cluster Isn’t Sufficient: Introducing Virtual Pools in AKS There’s a moment in every Kubernetes journey when the cluster begins to feel… heavy. Not broken, not misconfigured, but stretched in ways that weren’t obvious at first. You scale node pools, adjust autoscaling thresholds, maybe even add spot nodes. Yet, some workloads still don’t quite fit. They either need to scale instantly beyond your node capacity or represent spiky, unpredictable demand that makes your carefully tuned AKS cluster feel rigid. ...

GitOps on Azure Kubernetes Service: Building a Production-Ready Platform with Flux Kubernetes platforms seldom fail due to the technology itself; instead, failures are usually caused by operational issues. Between the initial successful ‘kubectl apply’ and the deployment of the twentieth production cluster, platform teams realize a harsh reality: Kubernetes isn’t hard to run, but maintaining consistent operations is very challenging. Configuration drifts occur. Hotfixes are often applied directly, skipping pipelines. Infrastructure ends up as a patchwork of Git repositories, YAML files, CI/CD pipelines, and manual tweaks performed from someone’s laptop at midnight. ...

When Kubernetes Lies: Seeing the Truth Inside AKS with Inspektor Gadget Cloud platforms are built on abstractions. We tell developers that services talk to services. We tell security teams that network policies enforce isolation. We tell architects that identity is the new perimeter and that zero trust ensures nothing moves unless explicitly allowed. In Azure Kubernetes Service, these abstractions become even more powerful. Managed control planes, private clusters, Cilium networking, workload identity, Azure Firewall, private endpoints, and policy enforcement create the feeling of a highly controlled, highly predictable platform. ...

Cloud Security Is a System, Not a Stack Part 6 of the Cloud Security series This article concludes a series about cloud security in existing Azure environments. In the earlier parts, we explored how meaningful security improvements often start small, why identity defines the real perimeter, how logging without intent creates blindness, how architecture determines blast radius, and why security quietly fails when ownership is unclear. Individually, these topics are familiar. Together, they reveal something more important: cloud security does not work as a collection of controls. It only works as a system. ...

Security Fails Quietly When Nobody Owns It Part 5 of the Cloud Security series This article is the fifth part in a series about cloud security within existing Azure environments. Previously, we discussed how foundational changes build momentum, why identity forms your true perimeter, how logging without purpose results in blind spots, and how architecture influences the scope of failure. This section moves away from technical details and addresses a more challenging topic: ownership. Most cloud security issues arise not from absent controls but from unclear responsibilities. ...

Architecture Decides the Blast Radius Part 4 of the Cloud Security series This article is the fourth part of a series on cloud security in real-world Azure environments. Earlier, we explored how foundational improvements can create momentum, highlighted why identity is the most vital security control in the cloud, and explained how aimless logging can lead to visibility without comprehension. In this part, we move from signals and access to a more structural topic: architecture. Because some security controls will inevitably fail, the platform’s architecture determines whether such failures are contained or lead to disaster. ...