OpenZiti 1.0, a toolkit for integrating distributed networking and service access into applications in isolated network environments, has been released. OpenZiti enables the deployment of an application-specific overlay network running on top of the regular internet and using mesh routing, where each network point communicates through its neighbors. The project's code is written in Go and is distributed under the Apache 2.0 license. Bindings are provided for C, Go, Python, Swift, Java, Node.js, and C# (.NET), as well as tooling for integration with applications for the platform. Android.
The OpenZiti system is designed from the ground up to build networks that guarantee traffic security and isolation in unprotected environments where nodes can be compromised (Zero Trust architecture). The technology can be used to establish connections with applications instead of VPNNetwork operation is ensured through the use of a controller process, which manages network configuration, authentication, and service configuration, as well as nodes authorized to act as routers that form the mash-network and forward transit traffic. Services can be added for load balancing and fault tolerance.
Access to the overlay network is realized using special edge clients that allow access from an external network to an overlay network built using OpenZiti. It is possible to create tunnels and proxies that allow you to forward traffic from the regular network to the overlay network and vice versa, in order to interact from the external network with applications running on the overlay network and access existing applications that do not have built-in support for the overlay network.
Accessing the network and receiving data from servers DNS access is only possible after mandatory authorization and authenticationβwithout authorization, the client will not be able to detect the service's presence or connect to it. All traffic is protected using mTLS (mutual authentication, in which the client and server authenticate each other) and end-to-end encryption (ChaCha20-Poly1305), meaning that compromising network nodes will prevent application traffic from being viewed. Libsodium library functions are used for encryption.
Popular applications that use OpenZiti include the Zrok data sharing platform and the browZer ecosystem for deploying sites on an overlay network. In addition to creating distributed network applications, OpenZiti is also suitable for building private networks to organize access to private APIs, sites or databases, hide Kubernetes-based infrastructures in an overlay network, and remotely manage external systems and devices without setting up firewalls or using VPNs.
The OpenZiti 1.0 release ensures API stability for routers and controllers (API stability was guaranteed for clients in the past). Starting with this release, the API and CLI will be backwards compatible, and if features need to be removed, a process will be followed to first deprecate them and only actually remove them if there is a significant version number change. The new version also includes additional testing with the simulation of various failures of network components (chaos testing), which allows us to verify the stability of the network in the event of emergency situations and the ability to return to normal operation after the faulty components resume operation.
Source: opennet.ru
