Insights
Field notes
Write-ups of Azure problems we've hit, security advisories worth acting on, and what we've learned running KrakenKey and Atomatize.
Reinstating Admin-on-Behalf-Of Access on an Azure Subscription
AOBO access does not transfer with an Azure subscription. Restore the partner's foreign-group RBAC assignment, then choose the right scope and access model.
Azure Bastion's AKS Tunneling Goes GA: The Jump Box Becomes Optional
Azure Bastion can now tunnel directly to a private AKS cluster's API server, no jump box required. Here's what the GA release changes and where it still falls short.
CVE-2026-42880: Argo CD's ServerSideDiff Endpoint Leaks Kubernetes Secrets to Read-Only Users
A critical (CVSS 9.6) missing-masking flaw in Argo CD lets any authenticated user extract plaintext Kubernetes Secret values. Patches are out; here's what AKS operators need to know before they get to it.
No ILB, No MultiSubnetFailover: Setting Up an Azure SQL AG Listener for Legacy Clients
How we configured a SQL Server Availability Group listener in Azure without an Internal Load Balancer for a client whose legacy application couldn't use MultiSubnetFailover=True -- and the SQL port binding issue that caught us off guard.
Why we deliver AWS through a partner
Most cloud consultancies claim broad in-house capability across every major cloud. Cloudwalker IT doesn't: AWS engagements are delivered jointly with 010 Consulting. Why we set it up that way, and when it isn't the right model.
Platform Engineering in 2026: Why Your DevOps Team Is Building a Product
DevOps promised developer autonomy but delivered cognitive overload. Platform engineering fixes the model. Here is what a practical adoption path looks like.
TLS Certificates Drop to 200 Days on March 15
CA/B Forum Ballot SC-081 cuts maximum TLS certificate lifetime to 200 days starting March 15, 2026, with further reductions ahead. We break down the operational impact and the case for automation.
Where Azure Bills Actually Leak
Before right-sizing and commitments, look for the spend nobody is using: unattached disks and IPs, log ingestion, licences you already own, and AKS clusters sized off requests. Queries included.
Taking an LLM Feature to Production on Azure
The demo took a week. Production takes network isolation, quota planning, token accounting, an evaluation set and a plan for model retirements. A checklist for Azure OpenAI workloads.
Zero Trust on Azure Starts in Entra ID
Most zero trust programmes start with network segmentation. On Azure, the controls that matter most live in Entra ID: emergency accounts, Conditional Access, PIM and workload identities. An order of work that holds up.