← All modules — full architecture

Meridian Logistics — OpenZiti 2.0 architecture

High-level design — click any component to drill into its low-level design
Module 09: Tunnelers — Kubernetes (charts, multi-cluster) · verified against OpenZiti v2.0.3 (field build 2026-09-29)
Read the guide: Kubernetes
M09 · Tunnelers — K8s
✕ Close
Tunneler / chart Edge router (M04) Controller (M03) enrollment dial-out (fabric) overlay path policy
OTT enroll Bind · Dial by Ziti name dials out dials out Control plane (M03) ctrl1 · ctrl2 · ctrl3 — mints the OTTs the chart repo ziti-host 1.4.0 · image 1.19.1 ziti-edge-tunnel 1.5.0 · image 1.19.1 model after M09 +wms · +telemetry yard Dial unchanged identity: three paths, one trap --set-file zitiEnrollToken → PVC ✓ existingSecretName → renewal ✗ AKS — Azure East US tofu aks-meridian-lab-eus-01 · snet-aks-eus-01 WMS + ziti-host meridian-wms · #wms-hosts dispatch + sidecar NET_ADMIN · DNS triplet node-proxy DaemonSet + CoreDNS forward er-pub-01/02 #er-pub · edge :3022 k3d — the yard site K3s stand-in meridian-yard-edge · lab Docker host telemetry + ziti-host #telemetry-hosts · Bind the chooser · 9 shapes it's always CoreDNS track ✓ hosts → containers → clusters
Tip: click the chart repo, the identity contract, either cluster, any workload, the model, the public edge, the M03 control plane, or a concept chip.
From the course Enterprise Zero Trust Architecture with OpenZiti 2.0 · cawachlabs.com · Guides Meridian Logistics is a fictional company. © 2026 CawachLabs · by Girish Reddy. All rights reserved. Not affiliated with or endorsed by the OpenZiti project. Icons adapted from Lucide (ISC, parts MIT).
TrademarksMicrosoft, Azure and Microsoft Entra are trademarks of the Microsoft group of companies. Docker is a trademark or registered trademark of Docker, Inc. in the United States and/or other countries. Kubernetes, Helm and SPIFFE are registered trademarks of The Linux Foundation in the United States and/or other countries. OpenTofu is a registered trademark of LF Projects, LLC. Ubuntu is a registered trademark of Canonical Ltd. Linux is the registered trademark of Linus Torvalds in the U.S. and other countries. Elasticsearch and Kibana are trademarks of Elasticsearch B.V., registered in the U.S. and in other countries. Grafana is a trademark of Raintank, Inc. dba Grafana Labs. Other names belong to their owners. CawachLabs is independent and not affiliated with or endorsed by these companies.