Skip to main content
Version: Developer

kziti operations for OpenZiti on Kasm Workspaces

kziti is the command-line tool that deploys and operates an OpenZiti environment for Kasm Workspaces. Day-2 operations cover the ongoing administration that keeps that environment running after the initial deployment. This section orients administrators to those operations and links to the procedure for each task.

OpenZiti provides managed egress and zero-trust connectivity for Kasm Workspaces. Sessions reach external services through identity-bound routers rather than through broad network access. Administrators grant access to specific named services rather than to network ranges. As a result, the deployment keeps connectivity aligned with zero-trust principles instead of exposing the private network.

Before you begin​

These operations assume a working deployment and an existing egress integration. Confirm the following prerequisites:

The kziti architecture page explains the mental model behind these tasks. Read that page first if the relationships between controllers, routers, identities, and policies are unfamiliar. The architecture context makes each operation easier to follow.

Operations in this section​

Each page below documents a single day-2 task. Select the task that matches your goal:

  • Configure kziti profiles connects kziti to a controller and manages named profiles for multiple environments.
  • Manage networks creates, lists, and deletes the private networks that group services together, and provisions the private routers that host those services.
  • Publish services defines the services that Kasm sessions and external clients dial through OpenZiti, and groups them into service sets.
  • Grant access gives a Kasm user, workspace, or external identity access to a network, service set, or individual service.
  • Add an HA controller joins a controller to the Raft cluster to support high availability.
  • Remove an HA controller cleanly removes a controller from the Raft cluster.
  • Recover from quorum loss restores a high-availability cluster after a controller goes down without being cleanly removed.
  • Tear down a deployment uninstalls kziti from a host, with or without removing persistent data.
  • kziti CLI reference provides the auto-generated reference for every command, subcommand, argument, and flag.

When to use raw OpenZiti instead​

kziti covers the operational shape described in the kziti architecture page. Some inspections fall outside the kziti command surface, including raw policy bodies, controller diagnostics, and ZAC visualization. For those tasks, the OpenZiti CLI and project tooling remain available. kziti does not hide them from you. See the kziti architecture page for the boundary between the kziti scope and the raw OpenZiti domain.