Welcome to Wolkwacht

Every distributed application gathers various plumbing components. One service requires retries and timeouts, another needs a message broker client, and a third must store some state, retrieve secrets, or discover other services. Over time, each team ends up with a unique set of client libraries, connection handling methods, telemetry, and failure behaviors. Dapr, the Distributed Application Runtime, provides a uniform API for the underlying infrastructure. Your application communicates with a local Dapr process via HTTP or gRPC. Dapr then interacts with services, the state store, the broker, the secret store, or other components on your application’s behalf. While the application retains control of its business logic, Dapr offers reusable capabilities for building distributed applications. ...

The real question is not whether to use the Azure Key Vault provider for the Secrets Store CSI Driver or the External Secrets Operator (ESO). Instead, it’s whether your workload should access secret data as mounted files or via native Kubernetes Secret objects. That choice influences application design, rotation, incident handling, RBAC, observability, Helm compatibility, and GitOps. In short: CSI offers a more secure default for applications that consume files; ESO provides a more practical platform default when Kubernetes-native compatibility is a priority. This decision involves both GitOps and security considerations. ...

Kubernetes is very good at reporting desired state. A Deployment can be available while its pods restart every few hours. A cluster can show green nodes while workloads have no disruption budgets, probes, resource limits, or network isolation. Dashboards show signals; they do not necessarily connect them into an operational judgment. That is the gap KubeBuddy tries to fill. The open-source KubeDeck project is a Go-based command-line scanner that connects through an existing Kubernetes context and evaluates cluster health, workloads, security, RBAC, networking, storage, and configuration. It can add provider-specific checks for AKS and GKE and emit terminal, HTML, JSON, and CSV output. There is no controller, Helm release, or long-running agent to install in the cluster. ...

Kubernetes has become so familiar that many teams don’t choose to adopt it anymore; they just start using it. When a new internal API appears, someone sets up an AKS cluster, and within weeks, the team manages node pools, upgrade channels, ingress, identity, policies, observability, and a backlog of Helm charts. None of these decisions are incorrect, but the issue is that the workload might never have required a Kubernetes platform in the first place. ...

Azure Kubernetes Service (AKS) removes most of the undifferentiated heavy lifting of running Kubernetes, but it does not remove your responsibility for securing what runs on top of it. Every week, new clusters go into production with permissive RBAC, public API servers, root-privileged containers, and no plan to stay current with CVEs. None of that is an AKS problem; it is an operating-model problem. This practical, opinionated guide walks through securing an AKS cluster from start to finish: identity, network, workload, supply chain, runtime security, and the often-overlooked process of maintaining security over time. ...

A cloud architect’s field notes on apple/container v1.2.0, for the devops engineers and application specialists who have to make the “what runs on our Macs” decision. A year ago I published Running Containers the Apple Way: A First Look into Apple Container on macOS. At the time, container was a WWDC 2025 curiosity: a Swift CLI with no stability guarantees and a limited list of things it could actually do. I was cautiously optimistic and noted, in effect, “watch this space.” ...

Introduction: Cost Is an Outcome of Scheduling Decisions Your AKS bill is calculated before Azure sends an invoice. Kubernetes translates pod specifications into resource requirements, including resource requests, affinity rules, topology constraints, DaemonSet overhead, and scaling limits, all of which impact the efficiency of pod placement on nodes. This post’s main point is clear: durable optimization involves enhancing the entire chain, from workload demand to pod replicas, schedulable capacity, VM allocation, and cost attribution. Reducing node count without understanding this chain does not save money; it simply shifts costs into latency, evictions, throttling, and extended recovery periods. ...

Running AI Workloads on Azure Kubernetes Service: From Platform Control to Model Serving Most teams begin their AI journey by using a managed model API. This approach works initially but can become problematic when costs become unpredictable at scale, data sovereignty or compliance issues prevent sending data to third-party endpoints, or the team needs a fine-tuned model or a custom inference runtime. At this stage, the focus shifts from simply consuming AI to actively operating it. ...

Optimizing Azure Container Apps Costs: Scaling to Zero, Workload Profiles, and FinOps Azure Container Apps enables teams to deploy APIs, background processors, scheduled jobs, and event-driven services without directly managing Kubernetes infrastructure. However, this convenience does not automatically ensure cost optimization. Container Apps costs depend on application behavior: the number of replicas, their active duration, the workload profile hosting them, and the telemetry or network traffic they produce. An efficient setup for an unpredictable queue worker might be wasteful for a constantly busy API, and vice versa. ...

Part 1 introduced AppNet, while Part 2 demonstrated its use in zero-trust and multi-cluster patterns. This concluding section explores a shared AI gateway, the operational signals derived from the mesh, and the architectural tradeoffs that influence whether AppNet should be integrated into your platform. Series navigation Part 1: What AppNet is and how to get started Part 2: Zero-trust and multi-cluster patterns Part 3: AI gateway, observability and production fit Example three: a shared AI gateway that rate-limits by application AI Gateway with Per-Application Token Rate Limiting] ...