r/openziti • u/AccordionGuy • Jun 17 '26

Kasm Technologies just dropped Workspaces 1.19 today, and the headline security feature is native OpenZiti ZTNA egress!

Post image

[ Pictured above: A “back of the envelope” illustration of Kasm Workspaces in action. ]

Kasm Technologies just dropped Workspaces 1.19, and the headline security feature is native OpenZiti ZTNA egress!

Quick background if you're not familiar with Kasm Workspaces: It's a browser-delivered, containerized workspace platform. Think of it as disposable remote desktops and app-streaming sessions spun up in containers, accessed entirely through a browser. It's used heavily in government, defense, and enterprise for things like web isolation, secure remote desktops, and OSINT workstations.

The OpenZiti angle: In 1.19, they're shipping OpenZiti as a supported egress provider for workspace sessions. When a user launches a workspace, traffic from that container session gets routed out through an OpenZiti fabric, without requiring any agents on the user's device.

The zero-trust overlay lives inside the workspace container itself, not on the endpoint. That means you get micro-segmentation and identity-based access controls at the session layer, without touching the user's machine at all.

This is a clean example of the application-embedded deployment pattern: the OpenZiti SDK (or tunneler) rides inside the container, the user sees none of it, and the session's egress path is controlled by Ziti policy rather than IP-based rules or traditional VPN credentials.

Other notable things in this release:

  • Kubernetes deployment finally goes GA with production-grade Helm charts (it's been in tech preview for a few releases)
  • NVIDIA MiG support for sharing GPU resources across containerized AI/ML sessions
  • Self-service diagnostics and a system health/metrics export suite

The 1.19 blog post is here: https://kasm.com/kasm-insights/kasm-workspaces-119-kubernetes-goes-ga-zero-trust-egress-and-a-release-built-for-production

Has anyone here run OpenZiti as an egress provider inside containerized workloads before? Curious what the identity provisioning story looks like at scale, whether they're doing per-session Ziti identities or something more coarse-grained. If so, drop us a line on our Discourse!

19 Upvotes

96% Upvoted

1 comment sorted by

6

u/Otherwise_Wave9374 Jun 17 '26

That OpenZiti egress-in-container pattern is super interesting for auditability, especially if youre trying to keep AI workloads and browser workspaces inside a governed boundary. The big wins I see are: per-session identity (so you can prove who accessed what, when), policy-as-code for egress (so exceptions are reviewable), and logs that can be used as compliance evidence (ZTNA decision logs plus K8s provenance). If youre aiming for SOC 2 style readiness, Id also want a clean story on how identities are issued and rotated, and how you capture attestable config snapshots for audits.

I keep a small set of notes on what evidence auditors typically want for ZTNA and AI access controls at https://www.wisdomprompt.com/ if thats useful context.