Apps Are the New Edge and Are Everywhere: Mobile, Edge and Cloud

### Overview In this Open Source Summit North America session, Srilakshmi Sarva, Head of Products at NetFoundry, presents how modern application architectures—spanning mobile, edge platforms, and multi-cloud—are redefining the network edge. As enterprise workflows increasingly shift out of traditional data centers and into distributed environments driven by 5G, IoT, and AI/ML inference, conventional networking models such as VPNs and static APNs prove too brittle, complex, and insecure. The presentation introduces Project Ziti (OpenZiti), an open-source zero-trust networking platform that enables developers to embed programmable, authenticated-before-connected network security directly into applications and edge devices.

### Key Topics - **Evolution of Edge and Cloud Computing**: Applications have shifted from centralized mainframes to distributed client-server, microservices, and containerized architectures. With Gartner predicting 50% of enterprise data staying outside data centers or clouds by 2022, AI/ML inference workflows are moving to the edge (near data sources/sensors) while model training remains in the cloud. - **Open-Source Zero-Trust Architecture (Project Ziti)**: Project Ziti separates concerns into two primary modules: the **Fabric** and the **Edge**. The Fabric acts as a programmable long-haul mesh delivering routing, dynamic circuit management, and transport optimizations (such as QUIC and TCP-to-UDP proxies). The Edge layer sits atop the Fabric via internal Fabric APIs, providing application SDKs, enrollment mechanisms, dynamic policy management, and last-mile tunnelers. - **App-Embedded Connectivity vs. Perimeter Security**: Instead of exposing listening ports or relying on network perimeter IP-based ACLs, Ziti keeps assets completely dark to the public internet. Connectivity requires an "authenticate before connect" mutual TLS (mTLS) model. - **Greenfield and Brownfield Support**: Greenfield applications can natively embed networking and cryptographic identity via SDKs in C, C#, Java, Go, Kotlin, Cordova, and Electron. Pre-existing brownfield environments can leverage sidecar proxies (e.g., in Kubernetes), Docker containers, or pre-built desktop/OS tunnelers.

### Technical Details - **Trust Bootstrapping and PKI**: Project Ziti features a built-in certificate authority (CA) within the Ziti Controller to automate public/private key infrastructure and certificate lifecycle management (including continuous periodic certificate rotation). Bootstrapping begins when an administrator provisions an identity, generating a JSON Web Token (JWT). The enrolling client parses the JWT, retrieves the controller's certificate, validates the signature against the well-known CA, and submits a Certificate Signing Request (CSR) to obtain signed identity certificates. During Q&A, Sarva notes the use of RFC 7030 (Enrollment over Secure Transport) for handling secure enrollment and end-to-end encryption. - **Routing and Policy Controls**: Ziti identifies services and endpoints by name rather than IP addresses. Extensible policy configurations enable dynamic auto-enrollment, geo-fencing (restricting specific routers or controllers based on geography), and rapid device revocation/isolation based on policy triggers. - **Demonstrations**: Two live use cases were showcased: (1) A mobile point-of-sale (mPOS) Java application where `tcpConnect` was replaced with `ziti_init` in 5–10 lines of code, completing OTP validation and purchases across an mTLS zero-trust overlay; (2) A Windows demonstration led by Jeremy Teller, illustrating how a pre-built C# tunneler allowed a clean Windows sandbox to access a dark web service (`hello.ziti:8080`) that otherwise returns 404 to unauthenticated clients.

### Takeaways - Networking and security should be baked into software design rather than added as an afterthought or managed via hardware VPNs and manual PKI. - End-to-end mTLS and continuous authorization eliminate lateral network movement, ensuring each application operates inside its own isolated overlay across hybrid and edge deployments.