Welcome to Wolkwacht

In Part 1, we discussed the AppNet architecture, setup process, and waypoint model. This second part shifts focus from mechanics to platform patterns: it covers enforcing service-to-service authorization for a payments platform, and then using AppNet across AKS clusters for active-active regional architectures. Series navigation Part 1: What AppNet is and how to get started Part 2: Zero-trust and multi-cluster patterns Part 3: AI gateway, observability and production fit Example one: Zero-trust authorization for a payments platform Zero-Trust Authorization — Payments Namespace ...

Azure Kubernetes Application Network, Part 1: What AppNet Is and How to Get Started The space between ‘we have ingress’ and ‘we run a full service mesh with sidecars on every pod’ has always been a challenging middle ground. Platform teams want encrypted east-west traffic, identity-based authorization, and good observability, but aim to avoid the CPU, memory, startup delay, and on-call burden associated with a sidecar on each workload. Security architects look for a zero-trust framework they can verify during audits, not just visual diagrams. Application developers need routing, retries, and traffic shifting without needing to understand Envoy’s internals. Meanwhile, platform engineers prefer these features as first-class Azure resources rather than managing complex Helm charts that require constant oversight. ...

When Your Cluster Isn’t Sufficient: Introducing Virtual Pools in AKS There’s a moment in every Kubernetes journey when the cluster begins to feel… heavy. Not broken, not misconfigured, but stretched in ways that weren’t obvious at first. You scale node pools, adjust autoscaling thresholds, maybe even add spot nodes. Yet, some workloads still don’t quite fit. They either need to scale instantly beyond your node capacity or represent spiky, unpredictable demand that makes your carefully tuned AKS cluster feel rigid. ...

GitOps on Azure Kubernetes Service: Building a Production-Ready Platform with Flux Kubernetes platforms seldom fail due to the technology itself; instead, failures are usually caused by operational issues. Between the initial successful ‘kubectl apply’ and the deployment of the twentieth production cluster, platform teams realize a harsh reality: Kubernetes isn’t hard to run, but maintaining consistent operations is very challenging. Configuration drifts occur. Hotfixes are often applied directly, skipping pipelines. Infrastructure ends up as a patchwork of Git repositories, YAML files, CI/CD pipelines, and manual tweaks performed from someone’s laptop at midnight. ...

When Kubernetes Lies: Seeing the Truth Inside AKS with Inspektor Gadget Cloud platforms are built on abstractions. We tell developers that services talk to services. We tell security teams that network policies enforce isolation. We tell architects that identity is the new perimeter and that zero trust ensures nothing moves unless explicitly allowed. In Azure Kubernetes Service, these abstractions become even more powerful. Managed control planes, private clusters, Cilium networking, workload identity, Azure Firewall, private endpoints, and policy enforcement create the feeling of a highly controlled, highly predictable platform. ...

Cloud Security Is a System, Not a Stack Part 6 of the Cloud Security series This article concludes a series about cloud security in existing Azure environments. In the earlier parts, we explored how meaningful security improvements often start small, why identity defines the real perimeter, how logging without intent creates blindness, how architecture determines blast radius, and why security quietly fails when ownership is unclear. Individually, these topics are familiar. Together, they reveal something more important: cloud security does not work as a collection of controls. It only works as a system. ...

Security Fails Quietly When Nobody Owns It Part 5 of the Cloud Security series This article is the fifth part in a series about cloud security within existing Azure environments. Previously, we discussed how foundational changes build momentum, why identity forms your true perimeter, how logging without purpose results in blind spots, and how architecture influences the scope of failure. This section moves away from technical details and addresses a more challenging topic: ownership. Most cloud security issues arise not from absent controls but from unclear responsibilities. ...

Architecture Decides the Blast Radius Part 4 of the Cloud Security series This article is the fourth part of a series on cloud security in real-world Azure environments. Earlier, we explored how foundational improvements can create momentum, highlighted why identity is the most vital security control in the cloud, and explained how aimless logging can lead to visibility without comprehension. In this part, we move from signals and access to a more structural topic: architecture. Because some security controls will inevitably fail, the platform’s architecture determines whether such failures are contained or lead to disaster. ...

You Are Logging Everything — And Seeing Almost Nothing Part 3 of the Cloud Security series This article is the third part in a series on cloud security, based on real Azure environments rather than idealized models. The first part emphasized establishing momentum through basic improvements. The second highlighted how identity is the most underestimated yet powerful security control in the cloud. This section shifts focus to telemetry, which most platforms already possess in large quantities: logs, metrics, alerts, and signals are ubiquitous in Azure. Despite this abundance, many organizations remain largely unaware of significant security risks. ...

Identity Is the Perimeter You Forgot to Guard Part 2 of the Cloud Security series Cloud security often fails not due to advanced attacks, but because of unnoticed access and unrevoked privileges. This is the second part of a series on cloud security in real-world Azure environments, which evolve over time under pressure and good intentions. The first part discussed how small, fundamental improvements can significantly improve security. In this segment, we focus on identity, as it is the critical factor determining success or failure in cloud security. ...