Udemy
Turn what you know into an opportunity and reach millions around the world.
Learn More
Your cart is empty.
Keep shopping
Enterprise Zero Trust Architecture with OpenZiti 2.0
New
Rating: 5.0 out of 5(1 rating)
4 students

Enterprise Zero Trust Architecture with OpenZiti 2.0

Hands-on Zero Trust Network Access (ZTNA) labs: build a multi-region OpenZiti network on Azure, Docker and Kubernetes
Created byGirish Reddy M
Last updated 10/2026
English

What you'll learn

  • Build a three-region OpenZiti 2.0 controller cluster on Azure that keeps working when a controller or a whole region fails.
  • Connect sites with edge routers, including a private data center whose routers only dial out, with no inbound ports opened there.
  • Sign users in with Microsoft Entra ID and an OpenZiti one-time code, and limit each person to their apps with policies and device checks.
  • Run zero-trust tunnelers on Ubuntu, Docker and Kubernetes, and connect apps across clusters with no shared network.
  • Monitor the network with Grafana and Elasticsearch, prove backups with a restore, and upgrade 2.0.3 to 2.0.6 while traffic keeps flowing.
  • Add a second Azure region in Singapore and serve one app from both regions.

Course content

13 sections • 48 lectures • 6h 23m total length

  • Meet Your Instructor & Course Overview3:06

    Welcome to Advanced Zero Trust Architectures with OpenZiti 2.0. Learn about the instructor's background, who this course is designed for, and how the hands-on lab environment is structured.

  • OpenZiti 2.0: What It Unlocks for Advanced Architectures5:55

    An executive tour of the key architectural evolutions in OpenZiti 2.0, including HA-native RAFT control planes, JWT-based authentication, and OIDC enrollment.

  • Course Roadmap & Architectural Blueprint3:26

    Walk through the 12-module advanced syllabus, lab requirements, and role-based learning paths for security engineers and cloud architects.

  • Module 1 quiz

Requirements

  • Basic networking: IP addresses, DNS, ports and TLS certificates.
  • Some Linux command-line experience. Docker and Kubernetes basics help; free plain-words guides are linked in the course.
  • An Azure subscription for the cloud labs (pay-as-you-go; the labs show how to stop or remove machines between sessions to keep the cost down).
  • Permission to register an app in Microsoft Entra ID (ideally Owner on the Azure subscription).
  • A computer for the local labs (VMware Workstation Pro, Docker Desktop); the labs are shown on Windows.
  • No OpenZiti 1.0 experience needed.

Description

One compromised laptop on a VPN can reach everything on the network. In this hands-on Zero Trust Security course, you replace that VPN with Zero Trust Network Access (ZTNA) built on OpenZiti 2.0, the open-source zero-trust network, on real machines in Azure and on your own PC.


The story: you're the network engineer at Meridian Logistics, a fictional company. Every connection has to prove who it is, and reaches only the one app it's allowed to use.


What you build, module by module:

- Three OpenZiti controllers in three Azure regions (East US, Central US and West Europe), kept in agreement with the Raft protocol, so the network keeps working when a controller or a whole region goes down.

- Edge routers in Azure, and a private data center whose routers only dial out, so nothing there is opened to the internet.

- Sign-in through Microsoft Entra ID plus an OpenZiti one-time code (TOTP), with access rules for staff and partners and a device check.

- Tunnelers, the software that connects a device or an app to the network, on Ubuntu servers, in Docker containers and on Kubernetes, including apps that reach each other across clusters with no shared network.

- Monitoring with Grafana dashboards and alerts, and network events in Elasticsearch and Kibana.

- A backup you prove by restoring it, a list of when each certificate expires, and an upgrade from OpenZiti 2.0.3 to 2.0.6 while traffic keeps flowing.

- A capstone: a second region in Singapore that serves the same app from both regions.


By the end, you can design, build and run a zero-trust network that keeps working when a controller or a whole region fails, and upgrade it while traffic keeps flowing.


How the course works:

- 48 lectures in 13 modules. Modules 1–2 explain how OpenZiti 2.0 works; from Module 3 on, each module adds a piece to the same network, and most end with failure drills where you break things on purpose.

- Every lab was built and tested on real machines, in Azure and on a local PC.

- Lab guides and slides to download, module quizzes, and all lab files (OpenTofu, Docker Compose, Kubernetes manifests) in a public GitHub repository.

- The cloud labs are built with OpenTofu, so you can stop or remove machines between sessions; each lab guide ends with a cleanup section.


If you took the instructor's OpenZiti 1.0 course, it's a head start, but not a requirement.


This course is independent and not affiliated with or endorsed by the OpenZiti project.

Who this course is for:

  • Network and security engineers moving from VPNs to Zero Trust Network Access (ZTNA).
  • DevOps, platform and SRE engineers who connect apps on Linux, Docker and Kubernetes.
  • Solutions architects designing zero trust for multi-region and hybrid networks.
  • Anyone starting out in zero trust who wants to build it, not only read about it.

Report abuse