So...for ops teams, remove VPNs, bastions, open IB FW ports, complex ACLs. One inbound firewall rule: deny-all.
Abstracted...Paramiko / Ansible solution shows developers how to embed secure networking into our apps, as code, via OpenZiti open source platform.
Disclosure: founder of a company which sells SaaS on top of the open source. So a massive fan but happy to answer questions as objectively as I can.