Security

Kubernetes is very good at reporting desired state. A Deployment can be available while its pods restart every few hours. A cluster can show green nodes while workloads have no disruption budgets, probes, resource limits, or network isolation. Dashboards show signals; they do not necessarily connect them into an operational judgment. That is the gap KubeBuddy tries to fill. The open-source KubeDeck project is a Go-based command-line scanner that connects through an existing Kubernetes context and evaluates cluster health, workloads, security, RBAC, networking, storage, and configuration. It can add provider-specific checks for AKS and GKE and emit terminal, HTML, JSON, and CSV output. There is no controller, Helm release, or long-running agent to install in the cluster. ...

Azure Kubernetes Service (AKS) removes most of the undifferentiated heavy lifting of running Kubernetes, but it does not remove your responsibility for securing what runs on top of it. Every week, new clusters go into production with permissive RBAC, public API servers, root-privileged containers, and no plan to stay current with CVEs. None of that is an AKS problem; it is an operating-model problem. This practical, opinionated guide walks through securing an AKS cluster from start to finish: identity, network, workload, supply chain, runtime security, and the often-overlooked process of maintaining security over time. ...

Cloud Security Is a System, Not a Stack Part 6 of the Cloud Security series This article concludes a series about cloud security in existing Azure environments. In the earlier parts, we explored how meaningful security improvements often start small, why identity defines the real perimeter, how logging without intent creates blindness, how architecture determines blast radius, and why security quietly fails when ownership is unclear. Individually, these topics are familiar. Together, they reveal something more important: cloud security does not work as a collection of controls. It only works as a system. ...

Security Fails Quietly When Nobody Owns It Part 5 of the Cloud Security series This article is the fifth part in a series about cloud security within existing Azure environments. Previously, we discussed how foundational changes build momentum, why identity forms your true perimeter, how logging without purpose results in blind spots, and how architecture influences the scope of failure. This section moves away from technical details and addresses a more challenging topic: ownership. Most cloud security issues arise not from absent controls but from unclear responsibilities. ...

Identity Is the Perimeter You Forgot to Guard Part 2 of the Cloud Security series Cloud security often fails not due to advanced attacks, but because of unnoticed access and unrevoked privileges. This is the second part of a series on cloud security in real-world Azure environments, which evolve over time under pressure and good intentions. The first part discussed how small, fundamental improvements can significantly improve security. In this segment, we focus on identity, as it is the critical factor determining success or failure in cloud security. ...

Most cloud security stories begin in the wrong place. This article launches a series on cloud security, focusing on real Azure environments rather than idealized designs. It examines platforms that have been operational for years, where identities developed naturally, workloads were deployed quickly, and security measures were gradually implemented. The series aims not to present new tools or frameworks but to analyze how security evolves in practice, identify where genuine risks arise, and highlight the most effective improvements when working with existing systems. ...

Azure Kubernetes Security Demystified: From Nodes to Pods Introduction Kubernetes has become the standard for hosting containerized applications, with Azure Kubernetes Service (AKS) being one of the most popular managed options. AKS simplifies management by handling the control plane, but securing the environment remains the customer’s responsibility. The shared responsibility model requires you to focus on strengthening worker nodes, controlling cluster access, and ensuring that workloads and pods operate with the least privileges. Security in Kubernetes involves multiple layers. The base layer is the host security of the virtual machines in the node pools. Next is the cluster layer, where identity, networking, and governance must be carefully established and maintained. At the top, securing pods and containers that run your business logic is crucial to prevent privilege escalation or unauthorized communication. This approach, known as “defense in depth,” emphasizes addressing security across various boundaries instead of relying on a single tool or configuration for full protection. ...

Zero Trust in the Cloud A Simple Path to Securing Cloud Infrastructure Created by Microsoft Designer Introduction In the world of cybersecurity, traditional network perimeter security models are no longer sufficient to protect against increasingly sophisticated threats. As cloud adoption continues to grow, ensuring robust security measures for both data and resources is critical. Enter Zero Trust — a security framework that shifts the paradigm from implicit trust to “never trust, always verify.” In this blog post, we will explore what Zero Trust is, the pros and cons of this security approach, and how to implement Zero Trust in both Microsoft Azure (Azure) and Amazon Web Services (AWS) environments. ...

Introduction In the rapidly changing cloud landscape, security and privacy are key concerns for businesses and individuals alike. Confidential Compute turns out to be a possible solution, ensuring sensitive data remains private and secure even in shared computing environments. In this blog post, I want to explain the concept of Confidential Compute in general and explore the specifics of how Azure has implemented confidential compute and how this can help with cloud sovereignty. ...