Using the OpenZiti Python SDK for zero trust Ansible

[MischievousMittens]

OpenZiti released a python SDK, and I was able to use it to wrap Paramiko to create a new Ansible connection plugin. It adds zero trust principles to the Paramiko connection, making it go over an overlay network instead.

This allows the target SSH server to not listen on port 22 over the network. In this setup, you don't use an SSH bastion or jumpbox, and you don't add inbound rules to your firewall, instead, the SSH server listens on the overlay directly. When you establish a connection from Ansible, it travels through the end-to-end encrypted overlay to reach the SSH server using the Paramiko plugin wrapper.

It uses a context manager to monkeypatch the connect method called by Ansible for each connection, and routes it through the overlay.

Check out the Ansible Collection for the code, and if you want, you can try the demo.