Airlock is a secure and convenient way to access and protect your infrastructure.
The Airlock Access platform provides least-privilege access based on cryptographic identity and the Zero Trust model, with built-in policy management and auditing.
Use Cases
Organizations use Airlock to:
- Eliminate fragmented access systems: a single platform for role-based access control, auditing, and connectivity across all infrastructure — from servers to Kubernetes clusters and databases.
- Adopt Zero Trust with compromise-resistant credentials: authenticate infrastructure access using short-lived certificates verified at every endpoint.
- Meet security compliance requirements: centralized auditing, session recording, and flexible access policy management.
Platform Capabilities
Airlock Access provides Zero Trust connectivity across all infrastructure. Users access servers, databases, Kubernetes clusters, and other resources through a secure proxy, even when resources are behind a firewall.
All infrastructure resources are part of a unified catalog with a shared role-based access control (RBAC) system. Connections use short-lived certificates that Airlock components verify cryptographically.
Access Requests are a built-in platform capability: users can request temporary privilege elevation to roles or specific resources, and designated reviewers approve or reject requests through the web interface or CLI. See the user guide for details.
Airlock Identity (optional module) extends access management capabilities:
- Access Lists: regular auditing and control of role membership.
- Device Trust: require authentication from a registered device.
- Session and identity locking: immediately stop activity from compromised users.
Architecture
A minimal Airlock cluster consists of Auth Service (authentication service) and Proxy Service (proxy service). Airlock agents running on servers or in Kubernetes proxy access to infrastructure resources.
Users authenticate through Proxy Service using short-lived certificates. Certificates contain Airlock user attributes, enabling agents to enforce RBAC policies.
Core Components
| Component | Purpose |
|---|---|
| Auth Service | User, role, configuration, and certificate authority management |
| Proxy Service | User entry point: web interface, SSH, Kubernetes, databases |
| SSH Service | Server access via SSH with auditing and session recording |
| Kubernetes Service | Proxy access to the Kubernetes API |
| Database Service | Proxy access to PostgreSQL, MySQL, and other databases |
| Application Service | Proxy HTTP/TCP traffic to internal applications |
| Desktop Service | Access to Windows desktops via RDP |
See the System Components and Architecture sections for details.
Client Utilities
| Utility | Purpose |
|---|---|
airsh | User client: cluster login, SSH, Kubernetes, databases |
airctl | Admin tool: user, role, and resource management |
airlock | Server and agent: Auth Service, Proxy Service, access services |