Overview

Deckhouse Airlock is a secure, centralised platform for infrastructure access based on the Zero Trust model.

Deckhouse Airlock lets you:

unify access management, audit, and connectivity across all infrastructure — from servers to Kubernetes clusters and databases;
authenticate infrastructure access using short-lived certificates verified on each endpoint;
meet security requirements through centralised audit logging, session recording, and flexible access policy management;
provide access to resources behind firewalls without deploying a VPN;
request and approve temporary privilege escalation through the built-in Access Requests mechanism.

Key features

Feature	Result
Zero Trust infrastructure access: unified resource catalogue, access through a secure proxy, least-privilege principle.	Centralised access management for servers, Kubernetes clusters, databases, applications, and Windows desktops without exposing static credentials to users.
Short-lived certificate-based authentication: X.509 and OpenSSH certificates issued on user login or service registration, mutual TLS and SSH authentication.	Cryptographically verified identity for users and services with automatic credential expiry and full action traceability.
Role-based access control (RBAC): roles with allow/deny rules, resource labels, role templates, and access conditions.	Granular control over access rights to infrastructure resources and Airlock cluster administration functions, with deny-by-default.
Access Requests: request temporary privilege escalation to roles or individual resources, with approval by designated reviewers.	Controlled temporary privilege elevation with requests, approvals, and denials recorded in the audit log.

Utility	Purpose
`airsh`	User client: log in to the cluster, SSH, Kubernetes, databases
`airctl`	Administrator tool: manage users, roles, resources
`airlock`	Server and agent: Auth Service, Proxy Service, access services

Functional description — product overview, architecture, and components
Installation and configuration — server deployment, agents, authentication, and access policies
User guide — working with airsh and the web interface
Reference — airsh and airctl command reference