Company: INFITX
Headquarters: Ebene, Mauritius
Industry: Inclusive Financial Services Technology and Operations
Solution Architect: David Fry
Challenges:
Key Results:
Technologies Used: Kubernetes, AWS, Crossplane, Helm, Istio, Zitadel, NetBird Kubernetes Operator, NetBird API, NetBird Crossplane Provider
When you're managing dozens of Kubernetes clusters across on-premises data centres and the cloud, private networking quickly becomes one of the hardest problems to scale.
That was the reality facing the Mojaloop platform team at INFITX.
They needed to give Kubernetes clusters secure, private access to internal services like Vault, databases, monitoring, and object storage, while also allowing operators to securely connect into those clusters.
Everything had to be:
And all this with a total lack of VPN tickets, manual bootstrapping and cloud-specific networking hacks.
Private networking was already partially automated, but not in a scalable way.
Before
After
Before
After
As clusters began spinning up multiple times per day, these limitations became impossible to ignore.
Networking needed to scale the same way Kubernetes does: declaratively, automatically, and repeatably.
At the centre of the design is a Control Center cluster.
Each Control Center:
Every environment cluster:
Istio ServiceEntries and waypoints are used to route specific workloads through NetBird, enabling fine-grained service-level egress control.
The result is a secure, identity-based private mesh spanning:
All without exposing sensitive infrastructure publicly.
Figure: NetBird provides a shared, identity-based private network connecting control planes, Kubernetes clusters, operators, and private services across on-prem and AWS.
The most powerful outcome of this design is that networking is provisioned the same way as infrastructure.
David Fry, the architect behind the implementation, built a NetBird Crossplane provider that allows the platform to automatically create and manage:
When a new environment cluster is created:
No manual steps, environment-specific logic or networking tickets.
Figure: Infrastructure automation powered by Kubernetes, Crossplane, and NetBird - from declarative custom resources to zero-touch mesh enrollment.
Today, the platform operates at meaningful scale:
Despite this scale:
“Ops effort is almost zero due to automation.”
Networking is no longer a bottleneck, it’s simply part of cluster provisioning.
One of the most significant (and unexpected) benefits came from identity.
The original plan was to use GitLab as an identity provider. But after working with NetBird’s self-hosted deployment and its Zitadel integration, the team adopted Zitadel as their IdP/IdM solution.
That shift:
What began as a networking initiative evolved into a broader identity and access transformation.
The hardest part of the journey was converting early “getting started” scripts into a fully Kubernetes-native, declarative model.
This required:
That effort, led by David Fry, not only enabled zero-touch networking but also produced the open-source NetBird Crossplane provider - a contribution now available to the broader community.
Figure: From distribution-specific scripts and node installs to declarative, Kubernetes-native, identity-based networking.
By combining NetBird’s identity-based mesh networking with Kubernetes Operators and Crossplane automation, INFITX transformed private networking from a scaling risk into a platform strength.
Networking is now:
Private access is no longer a special case - it becomes a part of the platform.
NetBird enabled the Mojaloop team at INFITX to treat private networking as code.
What was once a brittle, script-driven process is now a policy-driven, identity-based system that scales naturally with their Kubernetes environments.
As the number of clusters and environments continues to grow, the networking model grows with it, without increasing operational overhead.
Zero-touch networking isn’t an aspiration anymore, it’s the default!
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。