The release of the OpenZiti 1.0 toolkit has been announced, enabling the integration of frameworks for distributed networking and service access in an isolated network environment within applications. OpenZiti allows the deployment of application-specific overlay networks that operate over the regular internet and utilize mesh routing, where each network point connects through neighboring points. The project code is written in Go and is released under the Apache 2.0 license. Wrappers are provided for C, Go, Python, Swift, Java, Node.js, and C# (.NET), along with tools for integration with Android platform applications.
The OpenZiti system is originally designed for building networks that ensure traffic protection and isolation when operating in insecure environments, where nodes may be compromised (Zero Trust architecture). The technology can be used to establish communication with applications instead of VPN. The network operates through the use of a controller process that manages network configuration, authentication, and service settings, as well as nodes permitted to act as routers, forming a mesh network and transmitting transit traffic through themselves. Services can be added for load balancing and ensuring fault tolerance.
Access to the overlay network is implemented using specialized edge clients, allowing connections from the external network to the overlay network created with OpenZiti. It is possible to create tunnels and proxies that enable traffic to flow from the regular network to the overlay and vice versa, allowing external network interaction with applications running in the overlay network and accessing existing applications that do not have built-in support for the overlay network.
Accessing the network and retrieving data from servers DNS can only be used after mandatory authorization and authentication — without the necessary permissions, the client will not be able to determine the availability of the service and connect to it. All traffic is protected using mTLS (mutual authentication, where both the client and server authenticate each other) and end-to-end encryption (ChaCha20-Poly1305), meaning that compromising network nodes will not allow viewing application traffic. The encryption employs functions from the libsodium library.
Among the popular applications using OpenZiti are the Zrok data-sharing platform and the browZer ecosystem for deploying websites in an overlay network. In addition to creating distributed network applications, OpenZiti is also suitable for building private networks to provide access to closed APIs, websites, or databases, hiding Kubernetes-based infrastructures in the overlay network, and remotely managing external systems and devices without configuring firewalls or using VPNs.
The release of OpenZiti 1.0 ensures API stability for routers and controllers (API stability for clients was guaranteed earlier). Starting with this release, backward compatibility will be supported in the API and command-line interface, and if features need to be removed, a process of transitioning them to deprecated status will be implemented, with actual removal occurring only with significant version changes. The new version also includes additional testing simulating various network component failures (chaos testing), allowing for validation of the network's resilience in case of irregular situations and its ability to return to normal operation after faulty components are restored.
Source: opennet.ru
