Common use case
Connect CI/CD jobs to private resources
Give each build or deployment job the private connectivity its runner can support, without publishing the destination.
Short answer
Use supervised wzctl for one TCP endpoint on an ephemeral runner. Use the full client on a trusted privileged runner that needs direct private DNS and routes.
The problem
Pipelines may need a database, deployment API, or Kubernetes control plane. Public endpoints and broad peering expose more infrastructure than a single job requires.
Choose and scope the connection model
Match the connection model to the runner. wzctl works with tools that accept a local port. The full client requires privileges to create WireGuard, routes, and split DNS.
- 1Deploy a publisher that can reach the required deployment endpoint.
- 2For wzctl, select the publisher ID, exact target IP, TCP port, TTL, and local port.
- 3Inject the API key securely, start wzctl under supervision, and wait for 127.0.0.1 to accept connections.
- 4Run the job, stop wzctl during cleanup, and rotate destination credentials independently.
Example access flow
Process
Ephemeral deployment job with wzctl
Local endpoint
127.0.0.1:16443Access-pass target
10.0.4.15:6443 (/32)Authorization boundary
One TCP deployment endpoint until the pass expires
When this pattern fits
- An ephemeral job needs one SSH, HTTPS, database, or Kubernetes TCP endpoint.
- The deployment tool can use a port on 127.0.0.1.
- The runner can protect an API key and supervise a companion process.
- A trusted privileged runner is available when direct DNS and routes are necessary.
Security boundary and limitations
- wzctl provides one TCP path, not private DNS or general routes. Separate destinations require separate passes.
- A full-client runner receives its groups' authorized publisher CIDRs unless effective restricted rules narrow that access.
- Repository permissions, workload identity, destination credentials, and deployment authorization remain separate controls.
Frequently asked questions
Should CI use wzctl daemon mode?+
Treat wzctl as a foreground companion under runner supervision. The daemon option records a PID but does not fork or detach.
Can a self-hosted runner use the full client?+
Yes, when the runner is trusted and can create WireGuard interfaces, routes, and DNS configuration.
Does WireZTNA authorize the deployment?+
No. It provides reachability. The destination platform must still authenticate the job and authorize the requested operation.