Cloud Security on Wolkwacht

Secrets Management Showdown: Azure Key Vault CSI Driver vs. External Secrets Operator

Wed, 09 Sep 2026 00:00:00 +0000

The real question is not whether to use the Azure Key Vault provider for the Secrets Store CSI Driver or the External Secrets Operator (ESO). Instead, it’s whether your workload should access secret data as mounted files or via native Kubernetes Secret objects.

That choice influences application design, rotation, incident handling, RBAC, observability, Helm compatibility, and GitOps. In short: CSI offers a more secure default for applications that consume files; ESO provides a more practical platform default when Kubernetes-native compatibility is a priority. This decision involves both GitOps and security considerations.

KubeBuddy: An Agentless Second Opinion for Kubernetes

Sun, 06 Sep 2026 00:00:00 +0200

Kubernetes is very good at reporting desired state. A Deployment can be available while its pods restart every few hours. A cluster can show green nodes while workloads have no disruption budgets, probes, resource limits, or network isolation. Dashboards show signals; they do not necessarily connect them into an operational judgment.

That is the gap KubeBuddy tries to fill. The open-source KubeDeck project is a Go-based command-line scanner that connects through an existing Kubernetes context and evaluates cluster health, workloads, security, RBAC, networking, storage, and configuration. It can add provider-specific checks for AKS and GKE and emit terminal, HTML, JSON, and CSV output. There is no controller, Helm release, or long-running agent to install in the cluster.

Secure Azure Kubernetes Service (AKS)

Thu, 13 Aug 2026 11:01:01 +0000

Azure Kubernetes Service (AKS) removes most of the undifferentiated heavy lifting of running Kubernetes, but it does not remove your responsibility for securing what runs on top of it.

Azure Kubernetes Application Network, Part 2: Zero-Trust and Multi-Cluster Patterns

Sun, 07 Jun 2026 15:18:29 +0000

In Part 1, we discussed the AppNet architecture, setup process, and waypoint model. This second part shifts focus from mechanics to…

When Kubernetes Lies:

Thu, 19 Feb 2026 07:29:00 +0000

Truth inside AKS with Inspektor Gadget

Cloud Security Is a System, Not a Stack

Wed, 28 Jan 2026 08:50:22 +0000

Part 6 of the Cloud Security series

Security Fails Quietly When Nobody Owns It

Tue, 20 Jan 2026 10:40:04 +0000

Part 5 of the Cloud Security series

Architecture Decides the Blast Radius

Tue, 13 Jan 2026 08:42:36 +0000

Part 4 of the Cloud Security series

You Are Logging Everything — And Seeing Almost Nothing

Tue, 06 Jan 2026 13:41:29 +0000

Part 3 of the Cloud Security series

Identity Is the Perimeter You Forgot to Guard

Mon, 29 Dec 2025 10:05:37 +0000

Part 2 of the Cloud Security series

The First Security Conversation You Have Too Late: Hardening an Existing Azure Environment

Tue, 23 Dec 2025 15:45:32 +0000

Most cloud security stories begin in the wrong place.

Azure Kubernetes Security Demystified: From Nodes to Pods

Mon, 06 Oct 2025 09:21:22 +0000

Azure Kubernetes Security Demystified: From Nodes to Pods

Introduction

Kubernetes has become the standard for hosting containerized applications, with Azure Kubernetes Service (AKS) being one of the most popular managed options. AKS simplifies management by handling the control plane, but securing the environment remains the customer’s responsibility. The shared responsibility model requires you to focus on strengthening worker nodes, controlling cluster access, and ensuring that workloads and pods operate with the least privileges.
Security in Kubernetes involves multiple layers. The base layer is the host security of the virtual machines in the node pools. Next is the cluster layer, where identity, networking, and governance must be carefully established and maintained. At the top, securing pods and containers that run your business logic is crucial to prevent privilege escalation or unauthorized communication. This approach, known as “defense in depth,” emphasizes addressing security across various boundaries instead of relying on a single tool or configuration for full protection.

Zero Trust in the Cloud

Fri, 06 Dec 2024 08:29:37 +0000

A Simple Path to Securing Cloud Infrastructure

Confidential Computing

Mon, 20 Nov 2023 15:43:00 +0100

The implementation of confidential compute on Azure