Kubernetes
Private cluster access without a bastion
One agent runs inside the cluster as a routing device. Engineers and CI reach services and the API by name. Identity decides, not an address.
Free plan · No card · One agent in the cluster counts as one device
The problem
A private cluster usually grows a bastion
Lock the API down and someone builds a way back in.
A bastion in front of the API
One more box to patch, one more set of SSH keys, and an allow-list that goes stale.
One agent inside the cluster
The cluster joins the same network as the people using it. No hop, so no jump host.
A public endpoint for CI
The API sits on a public address so the pipeline can reach it. Scanners find it first.
Outbound only, CI included
The runner joins with a reusable enrollment key that has Temporary devices on, so its record goes once it stops connecting. Nothing in the path has a public address.
How it works
Run one agent, write one rule
No change to the cluster's networking, and no ingress for admin access.
Run one agent inside
One container runs the agent, with a persistent volume for its identity, enrolled with an enrollment key. It dials out, so no inbound port opens.
Read moreReach it by name
The API server and each service are named resources, not a pod CIDR. They resolve by name inside the network; no port-forward held open in a terminal.
Read moreWrite one rule per group
Engineering to the API on 6443. The CI runners' group to one service, one port. Nothing else is reachable.
Read moreWhat you get
Access decided by identity, not network position
An API server off the internet
Reach the API over the private network, then close the public endpoint. A rule names the group.
Read moreExternal workloads become internal
A CI runner in another cloud reaches a service directly, encrypted end to end.
Read moreAutomation with its own identity
Runners join with an enrollment key. When a pipeline also changes SXAccess itself, it calls the SXAccess API with its own service account, and the activity log shows that name. Revoke just that token.
Read moreTry it on one cluster first
Run one agent in the cluster, add your laptop, write one rule. Remove the agent to back it all out.
Free plan · No card · Service accounts included