and initiatives to make devs/ops/systems use vpn, bastion, static permitted IPs, etc. are often DOA due to their impacts on automation and speed. a foss alter

and initiatives to make devs/ops/systems use vpn, bastion, static permitted IPs, etc. are often DOA due to their impacts on automation and speed. a foss alternative is kubeztl - it takes kubectl off the networks - no public IP at all - but w/o users needing agents: https://github.com/openziti-test-kitchen/kubeztl/tree/main https://github.com/openziti-test-kitchen/kubeztl/tree/main disclosure: i am a maintainer and the software overlay in the middle (helps enforce outbound-only, pre-authorized connects only) needs to be managed (self-hosted foss or hosted saas), so there are still trade-offs.