Airlock Agents

Airlock agents are Airlock instances configured to proxy traffic to infrastructure resources: servers, databases, Kubernetes clusters, Windows desktops, and web applications.

Architecture overview

Services

Each Airlock process can run one or more services. A service is enabled in the instance configuration file.

Agent pools

Agents typically run in the same private networks as the resources they proxy. They should be the only clients with direct access to a resource without Airlock.

Agents establish reverse SSH tunnels to the Proxy Service. The Proxy Service is reachable from the internet over HTTPS, and agents do not need open ports or a public address.

The Proxy Service uses reverse tunnels to forward traffic over supported protocols to an available agent. The agent enforces RBAC rules and forwards traffic to the resources.

Connecting agents

Initial enrollment into the cluster

Agents need to establish trust with the Auth Service. Several enrollment methods are available to automate this in your environment — see join-token enrollment.

On first startup, the Airlock process reads its configuration and determines which services are enabled. Each service independently connects to the Auth Service, which checks for a join token for that service. On success, the Auth Service issues credentials signed for that specific service.

Adding a new service to an existing agent

Agent credentials are signed for specific services. To run new services, repeat the enrollment procedure:

1. Generate a new join token for all agent services, including the new ones.
2. Update the token in the configuration (airlock.join_params or airlock.auth_token).
3. Remove the agent state directory (default /var/lib/airlock, field airlock.data_dir).
4. Restart the agent.

It is recommended to deploy agents via infrastructure as code and update the service configuration in the IaC project followed by a redeploy.

Registering infrastructure

Two ways to register resources through agents:

• Static — specify the resource in the agent configuration file.
• Dynamic — apply a configuration resource (YAML via airctl) so that Airlock manages proxying.

Detailed instructions by resource type:

• SSH node — Linux servers
• OpenSSH — legacy servers with OpenSSH
• Kubernetes agent — Kubernetes clusters
• Windows RDP — Windows desktops
• Databases — PostgreSQL, MySQL, OpenSearch
• Web applications — HTTP/HTTPS applications

Guides in this section