CAWACHLABS

A hands-on OpenZiti 2.0 course · by Girish Reddy

Enterprise Zero Trust Architecture with OpenZiti 2.0

You build a zero-trust network for a fictional company, step by step, so that each person reaches only the apps they're allowed to use, and nothing else.

By the end, you can design, build and run a zero-trust network that keeps working when a controller or a whole region fails, and upgrade it while traffic keeps flowing.

  • 13 modules · 48 lectures
  • Beginner-friendly start · advanced finish
  • On Udemy
Enroll on Udemy Explore the architecture
Watch a free YouTube lesson

What you build

The network of Meridian Logistics

Meridian Logistics is a fictional company, and you're its network engineer. Today one compromised computer on its VPN can reach everything. You replace that VPN with OpenZiti 2.0, the open-source zero-trust network, where every connection must prove who is asking and reaches only the app it's allowed to, not the whole network.

  • M03Three controllers, the machines that hold the network's list of people, apps and rules, in three Azure regions: East US, Central US and West Europe. Lose one and the network keeps working.
  • M04Routers that carry the traffic: two in Azure (East US and Central India) and a pair in a private data center with no public address. Those connect outward, so nothing there is opened to the internet.
  • M05Sign-in through Microsoft Entra ID (Microsoft's work-account sign-in), plus a one-time code from an authenticator app.
  • M06Access rules for two groups, staff and partner companies, so each reaches only its own apps.
  • M07–M09Apps on Ubuntu servers, in Docker containers and on Kubernetes clusters, with no inbound ports opened for them.
  • M10Dashboards and alerts in Grafana (a charting tool), and a searchable store of network events in Elasticsearch, with Kibana to search it.
  • M11–M12Backups you prove by restoring them, and a safe upgrade from OpenZiti 2.0.3 to 2.0.6.
  • M13A second region in Singapore, where the warehouse system answers in both regions.
The Meridian Logistics architecture diagram. Across the top, the Azure control plane: four controllers in East US, Central US, West Europe and Southeast Asia. In the middle, the public edge routers in East US and Central India, with remote identities beside them. Along the bottom, the sites: an on-premises data center, a Docker host, an Ubuntu fleet and Kubernetes. Microsoft Entra ID and the Southeast Asia region sit on the right; observability, the upgrade and day-2 operations on the left.
The whole estate on one canvas. Open the interactive architecture and click a module to see what it adds.

Before you start

Who it's for, and what you need

Who it's for

  • You plan, design or run a network, and want people to reach only the apps they need.
  • You're weighing OpenZiti, or it's already in your stack.
  • You're new to zero trust, or you're an architect or DevOps lead who needs a design that survives failures across regions.

The course is open to all levels and teaches to an advanced outcome: each idea is introduced before you use it.

What you need

  • An Azure subscription. Pay-as-you-go is enough if you remove the lab when you're not using it.
  • Permission to register an app in Microsoft Entra ID, and ideally Owner on the subscription. With Contributor only, the Kubernetes lab's README gives a workaround.
  • A computer with OpenTofu (which builds the Azure machines from text files; Terraform 1.6 or later also works), the Azure CLI and an SSH key pair. The labs are shown on Windows.
  • Ziti Desktop Edge for Windows, the app that connects your computer to the network you build.
  • VMware Workstation Pro (free for personal use) for the private data center, and Docker Desktop for the container modules.
  • kubectl, Helm and k3d for the Kubernetes module, and the Microsoft Authenticator app on your phone for sign-in.

The lectures link the install page for each tool a lab needs. Cloud costs are in the questions below.

The 13 modules

What you can do after each module

Modules 1 and 2 explain how OpenZiti 2.0 works. From Module 3 on, every module adds a piece to the same network. Open a module to see its lectures.

M01

Welcome & Course Overview

3 lectures Know what changed in OpenZiti 2.0 and how the course is laid out.
  1. L1Instructor Intro
  2. L2What's New in OpenZiti 2.0
  3. L3Course Agenda
M02

OpenZiti 2.0 Architecture Deep Dive

4 lectures Explain how the controllers elect a leader and stay in sync (Raft), and how a router checks a sign-in token on its own.
  1. L4RAFT Consensus Inside the Controller Cluster
  2. L5The Distributed Data Model & The Router Slice
  3. L6JWT Auth Internals
  4. L7End-to-End 2.0 Control Plane & Deprecation Surface
M03

Designing HA Controllers

7 lectures Build three controllers in three Azure regions with OpenTofu, then take one down and watch the network keep working.
  1. L8From Architecture to Action: The Brief
  2. L9Designing the Cluster
  3. L10Infrastructure as Code, in Brief
  4. L11Substrate Setup & Portal Demo
  5. L12Build the 3-Node Cluster
  6. L13Failure Drills
  7. L14Operability & Wrap
M04

HA Edge Routers & Link Selection at Scale

5 lectures Stand up routers in Azure and in a private data center with no public address, and see what happens when one fails.
  1. L15Connect the First Site: The Brief
  2. L16Designing the Routers & Link Selection
  3. L17Build Lab: Standing Up the Routers
  4. L18Data-Plane Failure Drills
  5. L19Operability & Wrap
M05

Identity, Enrollment & PKI

5 lectures Let people sign in with their Microsoft Entra ID work account plus a one-time code, and enroll machines with certificates at scale.
  1. L20From One Hand-Made Identity to IdP-Driven Identities: The Brief
  2. L21Design 1: External Authentication & OIDC
  3. L22Design 2: PKI & Enrollment at Scale
  4. L23Build Lab: Wire In Entra ID & Cut Over Enrollment
  5. L24Verify, Break & Wrap
M06

Policies & Services

4 lectures Write access rules so staff and partner companies each reach only their own apps, with a device check on top.
  1. L25From a Minimal Model to Production Access: The Brief
  2. L26Design: Policies, Services & Posture
  3. L27Build Lab: The Production Model
  4. L28Verify, Break & Wrap
M07

Tunneler Architecture — Ubuntu/Linux at Scale

3 lectures Connect a fleet of Ubuntu servers that enroll themselves the first time they start.
  1. L29From Hand-Made Endpoints to a Fleet: The Brief
  2. L30Build Lab: Stand Up & Auto-Enroll an Ubuntu Fleet
  3. L31Verify, Break & Wrap
M08

Tunneler Architecture — Docker Patterns

3 lectures Connect apps that run in Docker containers, without opening an inbound port.
  1. L32From a Host Fleet to Containers: The Brief
  2. L33Build Lab: Host the Portal on ziti-host & Sidecar the Client
  3. L34Verify, Break & Wrap
M09

Tunneler Architecture — Kubernetes

4 lectures Connect apps on Kubernetes, in Azure (AKS) and on a small local cluster, and reach one cluster from the other with no shared network between them.
  1. L35The Brief: From Containers to Clusters
  2. L36Kubernetes & the Manifests We Deploy
  3. L37Build Lab: AKS Patterns & the Cross-Cluster Finale
  4. L38Verify, Break & Wrap: The Track Retrospective
M10

Observability — Metrics, Events & SLO Design

3 lectures Write down what "healthy" means first, then watch the network on Grafana dashboards, search its events in Elasticsearch, and get alerts.
  1. L39The Brief & SLO Design
  2. L40Design: Metrics & Events
  3. L41Build Lab: Wire the Observability Plane
M11

Day-2 Operations — Backup & Restore

2 lectures Back up the controllers, prove the backup by restoring it on a spare machine, and know when each certificate expires.
  1. L42Backup & Restore: Brief & Design
  2. L43The Backup & Restore Lab
M12

The Upgrade — 2.0.3 → 2.0.6

2 lectures Upgrade the running network one machine at a time, after a test copy, and write the runbook (the written step-by-step for next time) from what you did.
  1. L44The Upgrade: Brief & Design
  2. L45The Upgrade Lab
M13

The Capstone — A Second Region

3 lectures Add a second region in Singapore by reusing what you built, with the warehouse system answering in both regions.
  1. L46Use Case & Design
  2. L47The APAC Build
  3. L48Thank You & Feedback

What's included

  • 48video lectures in 13 modules
  • PDFlab guides and slides to download
  • GitHubthe lab files, public and free to read
  • Webthe interactive architecture, module by module

The labs

The lab files are public on GitHub

Every lab was built and tested on real machines, in Azure and on a local PC. The repository holds the files the labs run: OpenTofu files that build the Azure machines, Docker Compose files that start the containers, and Kubernetes files. There is a folder for each module that has lab files (Modules 3, 4 and 6 to 13). No secrets live in it: you create every key and enrollment on your own machines.

Open the labs on GitHub
  • Code and settings files (everything you run except OpenZiti's own Compose files): MIT licence (free to use and change).
  • Lab text, PDFs and diagrams: CC BY-NC-ND 4.0 (free to share with credit, not to sell or change).
  • OpenZiti's own Compose files, included unchanged: Apache License 2.0.
  • The CawachLabs name and logo are covered by neither licence.

Prep reading

Short guides for the tools the course uses

Free, plain-words guides on cawachlabs.com. Each explains one tool before the module that relies on it.

Questions

Common questions

Do I need the OpenZiti 1.0 course first?

No. If you took the instructor's OpenZiti 1.0 course on Udemy, it's a head start, not a requirement. This course stands on its own and introduces each idea before you use it.

What will the cloud resources cost?

The labs run in your own Azure subscription, so Azure bills you for what you leave running. The course's own estimates:

  • The three controller machines: about $50–80 a month if they run day and night.
  • The Ubuntu fleet in Module 7: about $2 a day running, and about $0.50 a day deallocated (stopped in the Azure portal), at East US list prices.
  • The Kubernetes cluster in Module 9: about $2 a day while it exists, at East US list prices.
  • Other modules add paid resources the course doesn't estimate: two public routers (Module 4), a larger machine for the monitoring tools (Module 10), a short-lived test machine (Modules 11 and 12), and five machines in Singapore that the Module 13 lab builds and then removes.

These are estimates, and your bill depends on your region and how long things run. The Azure machines are built with OpenTofu. Between sessions, stop (deallocate) the virtual machines or destroy them. The Module 9 guide has you destroy the Kubernetes cluster between sessions, and after you rebuild it you set its apps up again. Each lab guide ends with a cleanup section that says what to do.

Which OpenZiti version does the course use?

The labs pin OpenZiti 2.0.3. In Module 12 you upgrade the running network to 2.0.6.

Is this course affiliated with OpenZiti?

No. CawachLabs is independent. The course and its labs are not affiliated with or endorsed by the OpenZiti project. OpenZiti is open-source software, and the course teaches it.

Where are the lab files?

On GitHub, at cawachlabs/oz2-zero-trust-labs, in a folder for each module that has lab files (Modules 3, 4 and 6 to 13). The lab lectures link to their module's folder.

Can I see the architecture before I enroll?

Yes. The interactive architecture shows the whole network and a detail page for each module from 3 to 13.

Build the network yourself

If you run networks, security or platforms, or you're starting out in zero trust, this is the hands-on path to zero trust with OpenZiti 2.0.

Enroll on Udemy Explore the architecture

Written, engineered and recorded by Girish Reddy, who also made the OpenZiti 1.0 course on Udemy.