bootswithdefer bootswithdefer

Trust-Based Access at ASU

A unified strategy for Zero Trust network architecture in higher education — enabling academic openness while securing research, administrative, and teaching environments through evidence-based access decisions.

Why This Matters

Universities are uniquely difficult to secure. ASU operates thousands of applications across research, academic, and administrative domains with a transient population of 150k+ students (Fall 2024 enrollment: 152,812) plus faculty and staff, BYOD everywhere, and a cultural expectation of openness. Traditional perimeter security fails here because:

Cloudflare One Client (formerly WARP) with Cloudflare WAN (formerly Magic WAN) Support Guide

07/23/2026 NOTE: This document is a work in progress requiring input & review from both ASU and Cloudflare.

OpenSearch MCP Server with Per-User Auth

Status: draft

Product: Logging Lake (LOGL) Product key: logl Family: ELI5 (eli5)

Objective

Project Proposal — Centralized MCP Gateway Pilot

Executive Summary

This proposal describes a controlled pilot for centralized Model Context Protocol (MCP) access at ASU, aligned with the enterprise MCP strategy's phased roadmap. The pilot deploys a managed MCP gateway on AWS, authenticated via Cloudflare Access, serving ~100 developers with two MCP servers (AWS Documentation and GitHub) and group-based per-tool access control. It validates the centralized hosting model the strategy recommends before broader enterprise adoption.

Background

MCP is an open protocol that connects AI applications to enterprise tools, data sources, and workflows through structured interfaces. Rather than giving AI models direct, unmanaged access to enterprise systems, MCP creates a controlled integration layer with defined capabilities and boundaries.

	apiVersion: apps/v1
	kind: Deployment
	metadata:
	name: {{ include "mychart.fullname" . }}
	labels:
	{{- include "mychart.labels" . \| nindent 4 }}
	spec:
	{{- if not .Values.autoscaling.enabled }}
	replicas: {{ .Values.replicaCount }}
	{{- end }}

	stage('pure-groovy-vault') {
	agent none
	environment {
	VAULT_TOKEN_GEN_CRED = credentials('jenkins-vault-approle')
	}
	steps {
	script {
	println("Vault: Authenticate as Jenkins")
	def body = """{"role_id": "${VAULT_TOKEN_GEN_CRED_USR}", "secret_id": "${VAULT_TOKEN_GEN_CRED_PSW}"}"""
	def url = 'https://vault-url/v1/auth/approle/login'

	### Keybase proof

	I hereby claim:

	* I am bootswithdefer on github.
	* I am bootswithdefer (https://keybase.io/bootswithdefer) on keybase.
	* I have a public key ASB_Vd54NMv_7Y3ygxh418fph4ZdJLQgPSsb8LnMdKRL_go

	To claim this, I am signing this object:

	### Keybase proof

	I hereby claim:

	* I am bootswithdefer on github.
	* I am jdefer (https://keybase.io/jdefer) on keybase.
	* I have a public key ASCOYqD3hmgd4qdkLPQS0qK4manRuZ5PP73cDEFkNEOGJgo

	To claim this, I am signing this object:

	https://p.datadoghq.com/sb/c947af88a-d6ff30bc88fb85b7b702673c460b1ba3
	https://p.datadoghq.com/sb/c947af88a-8c8a2a677b8ebc24e7d6a277b5b5ceac

	var script = document.createElement('script');

	script.src = "https://media.geeksforgeeks.org/wp-content/uploads/20190704153043/main.js";

	document.head.appendChild(script)