Bramble — a virtual programmable network for platform teams

Reach VMs and containers over SSH

~ % ssh maya@edge-prod-eu-02 Welcome to Tundra 24.04.1 LTS (GNU/Linux 6.8.0-41-generic) System information as of Tue Mar 11 09:42:18 UTC 2025 Usage of /: 6.3% of 24GB Users logged in: 9 Memory usage: 21% Private address: 100.87.12.4 Swap usage: 0% Private address: 10.24.0.9 Processes: 118 Private address: 10.116.0.3 3 updates can be applied immediately. maya@edge-prod-eu-02 ~ %

Stop babysitting key material

Instead of copying private keys around a fleet, let Bramble mint and rotate short-lived credentials while checking each identity against the directory you already run.

Close the ports you forgot

Two machines negotiate an encrypted path directly, so nothing needs a public listener. Default-deny the edge and let the tunnel do the introductions.

Session replay in three clicks

Record shell sessions for auditors, or scrub back through Thursday night’s incident and watch exactly which command took the cluster down.

Stitch Kubernetes clusters together

// cluster operator access rules
"tagOwners": {
 "tag:k8s-operator": [],
 "tag:k8s": ["tag:k8s-operator"],
},
"acls": [
 {
   "action": "accept",
   "src": ["tag:k8s-readers"],
   "dst": ["tag:k8s-operator:443"],
 }
]

maya@bramblenet:/$
helm repo add bramble https://pkgs.bramble.dev/charts
helm upgrade \
  --install \
  bramble-operator \
  bramble/bramble-operator \
  --namespace=bramble \
  --create-namespace \
  --set-string oauth.clientId=<bk7f21CNTRL> \
  --set-string oauth.clientSecret=<bkey-client-bk7f21-c48ad9> \
  --wait
maya@bramblenet:/$ 

Maya Devin Priya

Policy

Aster cluster

</> api-serverServiceService

Cirrus cluster

</> api-serverServiceService

On-prem cluster

</> api-serverServiceService

Bridge the cluster network gap

Our operator wires clusters into the rest of your estate: log pipelines, build runners, internal APIs, and the managed databases that live one VPC over.

Any environment, tool, or team

Open dev, staging, and production to the people who need them. Directory group sync means support and data folks get scoped access without a ticket queue.

Keep control planes off the internet

Attach a cluster and you can drop its public API endpoint entirely. A few lines of config later, operators still debug from wherever they happen to be.

Wire up CI / CD pipelines

Engineer

~ % ssh maya@build-runner-047

maya@build-runner-047 ~ %

Build runner

Bramble
tunnel

Private VPC

Debug over SSH

The fastest way to unstick a red build

Drop into the job runner itself rather than guessing from log tails. Credentials are minted per session and expire on their own, so nobody has to share a key to debug a pipeline.

Continuous, meet connectivity

Hosted or self-run, a job can reach the internal service or seed database it needs — across accounts, regions, and the on-prem rack nobody has migrated yet.

A network of upsides

Edge site Public cloud Private cloud Laptop

One network across every kind of infrastructure

Attach anything with an IP stack and Bramble treats it as a peer: bare metal in a colo, a spot instance that lives ten minutes, a laptop on hotel wi‑fi. Topology stops being your problem.

Shell users and keys, finally simplified

Use our drop-in shell layer to grant access to any Linux host. Identities are checked against the directory you already run, and access lives in one reviewable policy file.

Loambuild Strata Cobbler

infra {
 required_providers {
   bramble = {
     source  = "bramble/bramble"
     version = "~> 0.21" // latest 0.21.4
   }
 }
}

provider "bramble" {
 oauth_client_id     = "..."
 oauth_client_secret = "bkey-client-..."
 api_key  = "bkey-api-..."
 base_url = "https://api.eu.bramble.dev"
}

Rollout

HostHostHost

Network config that ships with your code

Bramble slots into a GitOps workflow through the infrastructure-as-code tools you already use. Access policy and deployment land in the same review, and roll back the same way.

Enforced access at every endpoint

Install once per machine and every hop is authenticated and encrypted end to end. Narrow it further with rules that read on user identity, source device, and your own tags.

Maya

All staff Engineering Platform

Quillo Halcyon Chat Fernbank SCM Datastore Prod cluster

Get these capabilities and more with Bramble

Bramble Shell

A drop-in replacement that manages and records shell access to any Linux host, with no key distribution to maintain.

Cluster operator

Route traffic to and from Kubernetes clusters while services and the control plane stay off the public internet.

Subnet routers

Reach whole VPCs and appliances that will never run an agent, by relaying through one host that already can.

IaC integrations

Deploy into cloud and on-prem environments with the provider you already declare — Loambuild, Strata, or Cobbler.

GitOps for policy

Edit and roll back the JSON policy file straight from your source host — every change reviewed like application code.

Bramble Share

Hand a prototype, demo, or internal app to someone else on the network without exposing it to the rest of the world.

End-to-end encryption

Every session is encrypted between the two endpoints using the Filament protocol — nothing is decrypted in transit.

Bring your own directory

Keep single sign-on and multi-factor where they already live; Bramble authenticates against your existing provider.

Log streaming

Ship network-flow and configuration-audit events straight into the analytics platform your security team watches.

Pricing that scales down as well as up

Personal

For individuals connecting their own devices, at no cost.

$0per active user / month

Start free

Team

For small teams that want a secure network running the same afternoon.

$7per active user / month

Start free

Business

For growing teams that need service-level routing and identity-aware controls.

$19per active user / month

Start free

Enterprise

For organisations with posture management, compliance programmes, and named support.

Custom

Contact sales

Bramble, a virtual privateprogrammable network

Reach VMs and containers over SSH

Stop babysitting key material

Close the ports you forgot

Session replay in three clicks

Stitch Kubernetes clusters together

Bridge the cluster network gap

Any environment, tool, or team

Keep control planes off the internet

Watch our walkthrough on cluster-to-cluster networking

Wire up CI / CD pipelines

The fastest way to unstick a red build

Continuous, meet connectivity

A network of upsides

One network across every kind of infrastructure

Shell users and keys, finally simplified

Network config that ships with your code

Enforced access at every endpoint

Get these capabilities and more with Bramble

Bramble Shell

Cluster operator

Subnet routers

IaC integrations

GitOps for policy

Bramble Share

End-to-end encryption

Bring your own directory

Log streaming

Pricing that scales down as well as up

Personal

Team

Business

Enterprise

Bramble, a virtual private
programmable network