Security on Wolkwacht

KubeBuddy: An Agentless Second Opinion for Kubernetes

Sun, 06 Sep 2026 00:00:00 +0200

Kubernetes is very good at reporting desired state. A Deployment can be available while its pods restart every few hours. A cluster can show green nodes while workloads have no disruption budgets, probes, resource limits, or network isolation. Dashboards show signals; they do not necessarily connect them into an operational judgment.

That is the gap KubeBuddy tries to fill. The open-source KubeDeck project is a Go-based command-line scanner that connects through an existing Kubernetes context and evaluates cluster health, workloads, security, RBAC, networking, storage, and configuration. It can add provider-specific checks for AKS and GKE and emit terminal, HTML, JSON, and CSV output. There is no controller, Helm release, or long-running agent to install in the cluster.

Secure Azure Kubernetes Service (AKS)

Thu, 13 Aug 2026 11:01:01 +0000

Azure Kubernetes Service (AKS) removes most of the undifferentiated heavy lifting of running Kubernetes, but it does not remove your responsibility for securing what runs on top of it.

Cloud Security Is a System, Not a Stack

Wed, 28 Jan 2026 08:50:22 +0000

Part 6 of the Cloud Security series

Security Fails Quietly When Nobody Owns It

Tue, 20 Jan 2026 10:40:04 +0000

Part 5 of the Cloud Security series

Identity Is the Perimeter You Forgot to Guard

Mon, 29 Dec 2025 10:05:37 +0000

Part 2 of the Cloud Security series

The First Security Conversation You Have Too Late: Hardening an Existing Azure Environment

Tue, 23 Dec 2025 15:45:32 +0000

Most cloud security stories begin in the wrong place.

Azure Kubernetes Security Demystified: From Nodes to Pods

Mon, 06 Oct 2025 09:21:22 +0000

Azure Kubernetes Security Demystified: From Nodes to Pods

Introduction

Kubernetes has become the standard for hosting containerized applications, with Azure Kubernetes Service (AKS) being one of the most popular managed options. AKS simplifies management by handling the control plane, but securing the environment remains the customer’s responsibility. The shared responsibility model requires you to focus on strengthening worker nodes, controlling cluster access, and ensuring that workloads and pods operate with the least privileges.
Security in Kubernetes involves multiple layers. The base layer is the host security of the virtual machines in the node pools. Next is the cluster layer, where identity, networking, and governance must be carefully established and maintained. At the top, securing pods and containers that run your business logic is crucial to prevent privilege escalation or unauthorized communication. This approach, known as “defense in depth,” emphasizes addressing security across various boundaries instead of relying on a single tool or configuration for full protection.

Zero Trust in the Cloud

Fri, 06 Dec 2024 08:29:37 +0000

A Simple Path to Securing Cloud Infrastructure

Confidential Computing

Mon, 20 Nov 2023 15:43:00 +0100

The implementation of confidential compute on Azure