Private resources
Map a hostname agents dial to a host inside your network — no VPN, no bastion.
WhereConsoleCLITerraform
Introduced Jun 5, 2026
How it works
A hostname, mapped inward.
Internal Postgres or a staging API becomes reachable at a name agents dial — no VPN, no bastion, nothing flattened.
Outbound only.
Traffic reaches the target through a tunneler you run, connecting out over the platform's private network.
Granted per principal.
An agent, a person, an app, or a group — never "everyone on the network". "What can reach our staging database" is a list, not an investigation.
Rotates like everything else.
The tunneler's credentials rotate like any other resource.
See it on your own cluster.
Thirty minutes, your infrastructure, your stack. Or skip the call — it is one Helm release onto a cluster you already run.