I remember my first look at OpenZiti now. Here's some feedback:

My first impression of OpenZiti was: Nebula but at the application level.

It took a fair bit of looking around for me to see the proxy component. I'm still not exactly sure how to get a test, but it looks like the getting started steps are:

  - Build a network.
  - Figure out the identities and services.
  - Set up a proxy.
  - Test out this proxy.
  - Eventually migrate services from proxy to SDK.

There's a lot of stuff going on here I really need to wrap my mind around before I can even see how it would fit into my network.

Nebula on the other hand is an easier mapping for what I already have in my brain: It's a mesh VPN with a CA and built in firewall rules based on certificate roles.

OpenZiti looks very interesting now, but it honestly took me an hour to get to that point.