Hi again, I have some questions regarding deployment of ziti routers / tunnels in a kuberenetes environment. Currently have followed guides to deploy ztii router and tunnel using openziti helmcharts. The tunnels run as deamonsets on every node. Each node currently has a public external IP in orde…

I think at the end of the day there are some important truths: ALL OpenZiti components need to be able to make a connection to the OpenZiti controller, if you want access to services from "anywhere", the controller should be deployed with a public ip on the internet. ALL OpenZiti overlay networks …

Sorry for the cross post with this thread . linking if somones interested in the future. ALL other OpenZiti equipment can be deployed in private address space, with private ips and with DENY ALL INBOUND firewall rules. controller "in the public" at least one router in the same address space of …

[image] yemaney: And somehow intercept/route traffic from the private subnet 2 through the router/tunnel in public subnet 2. This sounds to me like you're looking for these? The first one has a link to a YouTube video where @rcsoleng walks through the steps... it sounds like what you're after…

[image] yemaney: Perhaps this is a case for using some sort of proxy to control traffic from private nodes to go through public node so that it can join the ziti network through the tunnel/router running there. Any clue if such a pattern like this make sense? Has there been such a pattern like t…

The problem of deploying ZET on one node and trying to intercept traffic from another node by that ZET is difficult without configuring static routes outside of the nodes to route traffic between nodes. ZET uses tun interface to intercept packets that are forwarded to it by routing rules, so it is …

Do worker nodes in the private subnet have outbound internet? You're looking for a way to "tether" the private node to the public node?

2 Scenarios. Keep private nodes subnet private (e.g. AWS k8s) but need a replacement for Nat gateway via a ziti network (tunnel/router) to connect to a say DataBase in another ziti network (e.g. GCP) - Scenario 1 and Connect to a public internet url (Scenario 2)

Thank you for clarifying you're referring to EC2 public and private subnets, and the private subnet has a route to the internet via a NAT gateway. Your EKS worker nodes occupy an EC2 private subnet, and you want pods scheduled on those nodes to be able to reach a remote service via Ziti, e.g., a da…

[image] yemaney: Is something like this possible with ziti? Yes. Here's a sketch, though you might want something slightly different. network 3 - ziti controller and router are securely reachable via the internet from networks 1 and 2 network 1 - running a ziti tunneler to host a ziti servi…

@qrkourier to confirm: in the above : Nat gateway is not used for data transfer? One key purpose is to avoid the data processing/data transfer charges of using Nat gateway. If Nat gateway is used for translation only but the actual data comes via different mechanism...that is ideal (Different mechan…

Deploy Ziti tunnel in public node and other apps in private nodes

Ziti Overlay

bazooka720 January 24, 2025, 12:01am 5

Dns routing inside Kubernetes with Edge tunneler daemonset - #4 by ss_vinoth22 Curious if this is very closely related ? @ss_vinoth22

Topic		Replies	Views
What would openziti arch for this look like Ziti Overlay	89	551	June 17, 2024
Securing Kubernetes with OpenZiti General Questions	11	576	September 4, 2022
TCP-Proxying services into Openziti without DNS Intercept? Ziti Overlay	14	1170	February 3, 2023
Zitify Homelab Kubernetes Cluster Ziti Overlay	8	725	May 31, 2023
Securing a bunch of Machines General Questions	13	1167	June 21, 2022

Deploy Ziti tunnel in public node and other apps in private nodes

Related topics