Welcome to Wolkwacht

Most cloud security stories begin in the wrong place. This article launches a series on cloud security, focusing on real Azure environments rather than idealized designs. It examines platforms that have been operational for years, where identities developed naturally, workloads were deployed quickly, and security measures were gradually implemented. The series aims not to present new tools or frameworks but to analyze how security evolves in practice, identify where genuine risks arise, and highlight the most effective improvements when working with existing systems. ...

The Unseen Work of a Cloud Architect: A Story About Building Azure the Hard (and Right) Way The story of implementing an Azure cloud environment rarely starts with technology. It begins with a seemingly simple conversation: someone in the business has a goal, a team has a new initiative, or an executive has read an article promising faster innovation, better resilience, or lower operational costs. The request sounds straightforward: “We want to move to Azure.” But it’s never that simple. Not because Azure is inherently complex, though it can be, but because cloud architecture is more about managing people, expectations, culture, pressure, and an ever-changing regulatory landscape. ...

Operating AKS from your workstation: Inside Microsoft’s New AKS Desktop There has long been a peculiar duality in managing Azure Kubernetes Service. The Azure portal offers abundant information but often feels disconnected from the cluster’s core functions. Meanwhile, Kubernetes is accessible through kubectl, YAML files, and dashboards like Headlamp. One exists within the Azure control plane, and the other entirely within the Kubernetes API. Operators frequently switch between these two realms multiple times daily, yet they never quite close the gap. ...

Beyond the Cloud: Running Kubernetes with Talos: Comparing Talos, k3s, AKS, and EKS “If Kubernetes is the engine, Talos is the chassis built specifically for it.” Introduction: Rethinking the Kubernetes Operating System When Kubernetes first appeared, it was celebrated as the “Linux of the cloud.” But beneath every Kubernetes cluster, there’s always a traditional operating system like Ubuntu, CentOS, Flatcar, or another Linux distribution. These weren’t originally built specifically for the orchestration layer that overlays them. This historical setup has quietly influenced how we manage, patch, and secure our clusters. Even as control planes have shifted to managed services such as Azure Kubernetes Service (AKS) and Amazon Elastic Kubernetes Service (EKS), the nodes themselves still rely on an operating system that wasn’t initially designed for immutability or declarative control. ...

Exploring the concept behind Azure’s next-generation ingress platform When Ingress Becomes Strategic There’s a moment in every Kubernetes journey when ingress stops being just a configuration detail and becomes an architectural constraint. You start with a small cluster, maybe one or two microservices, and the standard NGINX ingress controller does exactly what you expect: simple routes, basic certificates, nothing fancy. Then the platform expands. You integrate workloads across multiple regions, extend environments with Azure Container Apps, and add a service mesh, and suddenly that “temporary ingress setup” becomes a bottleneck. ...

Fleet, Arc, sovereign clouds, and the edge-first world of 2030 This article is the last part of the Azure Kubernetes Chronicles: Multi-Cluster Edition. Read the series introduction here. Examining today’s multi-cluster landscape, it is tempting to focus solely on the pain points: identity fragmentation, policy drift, networking complexity, and monitoring silos. But the story does not end there. Kubernetes itself has evolved from a single-cluster dream to a multi-cluster necessity, and the governance ecosystem around it is growing just as quickly. To understand where things are headed, we have to look beyond today’s tools and into the future that is already taking shape. ...

Azure Kubernetes Service (AKS) has long been the leading platform for containerized workloads on Microsoft Azure. While AKS offers scalability and resilience, managing it day-to-day still involves switching between various tools: Azure CLI, kubectl, ARM templates, and portal dashboards. This is where the Microsoft AKS-MCP Server, part of the Model Context Protocol (MCP) ecosystem, makes a difference. By providing a structured, secure interface for agents and tools to perform Azure and Kubernetes actions, AKS-MCP changes how engineers interact with clusters. ...

Azure Kubernetes Chronicles 11: Governing the Chaos Unifying identity, policy, networking, and observability across clouds and edge This article is part of the Azure Kubernetes Chronicles: Multi-Cluster Edition. Read the series introduction here. Governance pain points By the time enterprises have stretched Kubernetes across Azure, AWS, and the edge, the real problem is no longer the technology itself. It is governance. What began as a strategy to increase resilience and satisfy compliance quickly turns into a patchwork of identity systems, policy frameworks, networking models, and monitoring stacks. The result is fragmentation. Platform teams are left trying to stitch together three or more worlds, often with tools that were never designed to coexist. ...

Azure Kubernetes Chronicles 10: Kubernetes at the Edge with k3s From Raspberry Pi retail stores to 5G towers — the hidden force reshaping enterprise IT This article is part of the Azure Kubernetes Chronicles: Multi-Cluster Edition. Read the series introduction here. When most people think of Kubernetes, they imagine large clusters humming inside hyperscale cloud regions, backed by the weight of Azure, AWS, or Google. However, the future of Kubernetes is increasingly not limited to vast data centers, but also extends to much smaller, more distributed locations, such as retail stores, factory floors, hospital wards, or 5G towers. At the core of this movement is k3s, a lightweight Kubernetes distribution that is small enough to run on a Raspberry Pi but robust enough to support enterprise workloads. ...

Running Containers the Apple Way: A First Look into Apple Container on macOS For years, running containers on macOS has involved compromises. Docker Desktop used HyperKit to virtualize Linux, which was simple to use but resource-intensive. Alternatives like Rancher Desktop and OrbStack improved on this by being lighter, faster, and more developer-friendly, yet they all depended on the same core approach: emulating or virtualizing Linux within macOS. Apple has now entered this space with a native solution: Apple Container, an OCI-compliant container runtime explicitly designed for Apple Silicon and macOS 15/16 and later. It is not simply a re-skin of Docker or a clone of Lima or Colima. Instead, it represents Apple’s unique approach to how containers should operate on macOS, using the Virtualization and Network frameworks that power iOS simulators and macOS sandboxing. ...