Awesome GitHub RepositoriesZero Trust Networking

Istio is a service mesh infrastructure that provides a centralized control plane to manage, secure, and observe communication between distributed microservices. It functions as a policy-driven network traffic controller, enabling developers to route, balance, and secure service-to-service traffic without requiring modifications to application code. The system enforces zero-trust security by utilizing mutual transport layer authentication to verify cryptographic identities for every network request. The project distinguishes itself through a sidecar-less proxy architecture, which offloads netw

NetBird is a zero-trust networking platform that builds secure, encrypted peer-to-peer overlay networks using the WireGuard protocol. It functions as a software-defined perimeter, connecting distributed infrastructure across cloud environments and physical locations while hiding network resources from the public internet. By integrating with external identity providers, the platform enforces granular access control and identity-based segmentation for every user and device. The platform distinguishes itself through extensive automation and programmatic management capabilities. It provides a ce

This project is a comprehensive API security audit checklist and vulnerability audit framework. It provides a structured guide of security countermeasures for designing, testing, and deploying secure APIs across various protocols. The framework includes specialized guides for securing OAuth 2.0 authorization flows, implementing zero trust networking for service-to-service communication, and protecting GraphQL endpoints from resource exhaustion and information leakage. It also provides standards for integrating static analysis, dynamic scanning, and secret detection into CI/CD delivery pipelin

Nebula is a scalable, decentralized overlay networking tool designed to create secure, encrypted peer-to-peer connections between distributed hosts. By utilizing a certificate-based identity authority, it enables the construction of private communication fabrics across disparate physical infrastructures, such as multiple cloud providers or on-premises data centers, without requiring central authentication servers. The project distinguishes itself through a zero-trust architecture that enforces granular, policy-driven firewall filtering based on certificate-derived group memberships. It facili

ZeroTierOne is a software-defined networking engine that creates virtual local area networks by emulating Ethernet switches across distributed devices. It functions as a peer-to-peer platform, establishing encrypted tunnels directly between endpoints to bypass the need for centralized gateways or hub-and-spoke architectures. The system distinguishes itself through a decentralized approach to network discovery and identity management. By utilizing a distributed hash table and public key infrastructure, it authenticates devices and maps virtual addresses to physical endpoints without relying on

OpenNHP is a software-defined perimeter controller designed to secure network infrastructure by rendering services invisible to the public internet. It functions as a zero-trust network access gateway, ensuring that network resources remain hidden from unauthorized discovery and automated scanning tools until a client successfully verifies their identity. The system enforces security through a combination of cryptographic identity verification and dynamic firewall orchestration. By requiring a cryptographically signed packet to initiate a connection, the platform keeps all network ports in a

Netmaker is a platform for automating and managing virtual mesh networks built on WireGuard. It functions as a centralized control plane that orchestrates encrypted, peer-to-peer tunnels across distributed infrastructure, including cloud environments, on-premise data centers, and containerized clusters. By automating the configuration of routing tables and access policies, the system enables secure, private connectivity between diverse devices and services without requiring manual network administration. The platform distinguishes itself through its focus on zero-trust network access and soft

This project is a service mesh platform designed to manage, secure, and observe service-to-service communication within Kubernetes clusters. It functions as a control plane that orchestrates transparent sidecar proxies, which intercept and manage network traffic to provide reliable connectivity for microservices. By automating the injection of these proxies, the platform ensures that infrastructure-level policies are applied consistently across all workloads without requiring manual configuration changes. The platform distinguishes itself through its focus on zero-trust security and cross-clu

Firezone is a zero trust network access platform that uses WireGuard to provide identity-based connectivity to internal network resources. It functions as a virtual private network that synchronizes authentication and user groups via OpenID Connect providers. The system implements a group-based access control engine to enforce least privilege by restricting network resources to specific user groups. It utilizes holepunching and relay protocols for NAT traversal to establish encrypted tunnels through firewalls without requiring inbound ports. The platform includes a control plane for managing

go-ibax is a blockchain protocol platform and decentralized application infrastructure used to deploy networks with custom governance and token economics. It provides a foundation for building decentralized applications through a framework that integrates identity management and on-chain data storage. The project features a multilingual virtual machine capable of executing smart contracts written in Go, Rust, and Solidity. It implements a sharded blockchain network to increase throughput and a privacy layer utilizing zero-knowledge proofs and homomorphic encryption to anonymize transaction da

This is a Golang client library for interacting with a cloud native distributed messaging system. It provides the necessary tools for Go applications to exchange messages using publish-subscribe and request-reply patterns, as well as specialized clients for managing persistent streams and distributed storage. The library includes a JetStream client for durable message streaming and replay, a Key-Value store client for managing distributed state with versioning and watchers, and an Object Store client for the storage and retrieval of large binary files via chunked delivery. The implementation

Security-101 is a vendor-agnostic, foundational cybersecurity learning curriculum organized into modular, framework-aligned modules. It is designed to build core knowledge across multiple security domains without tying content to specific products or platforms, making it suitable for both beginners and professionals seeking a structured introduction to the field. The curriculum is built around established security frameworks, including the MITRE ATT&CK framework for standardized threat analysis and the NIST Cybersecurity Framework for incident response workflows. It covers a broad range of do

This project is a library of declarative configuration patterns and templates for implementing network policies within Kubernetes clusters. It provides a collection of reference guides and ready-to-use snippets designed to establish pod isolation and zero-trust traffic rules. The project focuses on implementing a default-deny security posture, where all network traffic is blocked until explicitly authorized through a whitelist. It provides specific templates for restricting lateral movement and securing microservice boundaries using label-based selectors and port-specific filtering. Its capa

该项目是一个集成框架，用于在 Spring Boot 应用中引导 Apache Dubbo 远程过程调用（RPC）服务。它作为一个微服务通信框架，通过自动化配置实现 RPC 服务、服务发现和分布式治理。 该项目的独特之处在于提供了一个跨语言 RPC 桥接，允许使用不同语言编写的服务通过 gRPC 和 Protobuf 等标准进行通信。它还支持使用 Triple 协议将后端微服务暴露为 REST 端点，以便从 Web 浏览器和第三方客户端直接访问。 该框架涵盖了广泛的功能，包括用于流量路由和限流的分布式服务治理、集中式配置管理，以及用于请求追踪和健康监控的微服务可观测性。它还支持多种传输层以及 Redis 和 Memcached 的存储集成。 该项目提供 Starter 和配置，以自动化 Spring Boot 环境中 RPC 基础设施的引导。

Ockam 是一个零信任网络框架，旨在通过基于身份的网络覆盖层来保护分布式应用之间的数据传输。它提供了建立双向认证和端到端加密连接所需的基础原语，从而消除了对传统网络层安全性的依赖。 该项目的特点是使用基于属性的访问控制和可验证凭证来大规模管理信任。它实现了加密身份轮换以保持身份连续性，并与硬件支持的密钥管理系统集成，从而将私钥安全地存储在安全隔离区或云密钥管理服务中。 该平台涵盖了广泛的功能，包括多跳二进制路由和基于中继的网络桥接，以连接不同的网络。它可以将传统的 TCP 或 Kafka 流量封装在安全隧道中，使私有服务能够在不暴露监听端口的情况下进行通信。此外，它还采用有状态的 Actor 模型，在分布式节点间异步处理消息。 部署方面，它支持通过基础设施即代码 (IaC) 模板在云环境中配置安全节点和网关。

Emissary 是一个 Kubernetes API 网关，用于管理传入的外部流量并将其路由到内部微服务。它利用 Envoy 代理作为底层数据平面来处理高性能流量路由和协议转换，并配有一个将 Kubernetes 自定义资源和注解转换为代理配置的控制平面。 该项目为 gRPC 基础设施提供了专门支持，包括 HTTP/2 路由和用于基于浏览器的客户端的 gRPC-Web 协议桥接。它通过双向 TLS 加密实现零信任安全，并将身份验证委托给外部身份验证服务。 流量管理功能包括用于金丝雀部署和渐进式交付的加权轮询负载均衡，以及七层负载均衡和会话亲和性。该系统还通过跨集群流量桥接支持多集群网络，并与外部限流服务集成以限制请求量。 可观测性通过诊断界面、分布式追踪集成以及将性能指标导出到 Prometheus 和 StatsD 等外部工具来处理。

zrok is a zero trust networking service that provides a secure overlay mesh to expose local services and files through firewalls and NAT without the need for manual port forwarding. It functions as a zero trust network manager, orchestrating identities, policies, and routers to establish secure connectivity between applications and users. The project distinguishes itself through the use of identity-based routing and hardened HTTP frontends that integrate with external identity providers. These capabilities allow for the creation of identity-aware proxies and secure reverse proxies that authen

Kuma 是一个多区域服务网格，用于编排容器和虚拟机之间的第 4 层和第 7 层网络流量。它利用集中的控制平面来管理基于 Envoy 的数据平面，从而在多个云、集群和本地环境中提供统一的网络覆盖。 该项目通过基于身份的访问控制和双向 TLS 加密实现零信任网络安全，自动配置证书以验证服务身份。它支持多网格管理，允许单个控制平面协调多个独立或隔离的服务网格，以降低操作复杂性。 功能包括用于金丝雀和蓝绿部署的动态流量路由，以及用于监控网络性能和系统健康状况的集中式服务可观测性。该系统还通过故障注入和自动重试机制提供弹性测试。 数据平面通过自动代理注入和基于模板的引导程序建立，无需更改应用程序源代码即可拦截网络流量。

Ziti is a zero-trust network overlay and identity-based mesh network. It provides a software-defined perimeter that replaces traditional IP-based routing and VPNs by mapping network services to cryptographically verified identities, effectively cloaking applications from the public internet. The project distinguishes itself through an outbound-only connection model that eliminates open listening ports and a Zero Trust SDK that allows developers to embed encryption and identity-based access control directly into application source code. It also provides transparent tunneling proxies to extend

Octelium is a zero-trust network access platform and identity-aware proxy designed to secure private HTTP, SSH, and SQL resources. It functions as a secure gateway that validates human and workload identities using OIDC, SAML, and FIDO2 passkeys before granting access to internal applications and SaaS APIs. The system is distinguished by its secretless access broker, which injects credentials—such as API keys, passwords, and AWS Sigv4 signatures—at the gateway level so users can access databases and cloud resources without managing secrets. It further specializes in AI gateway administration,