Federated cloud access for every Kubernetes cluster — with zero stored secrets.
Cloud Identity Mesh is a control plane for short-lived cloud credentials across AKS, EKS, GKE, Gardener, bare metal, and CI/CD. Policies map Kubernetes identities and pipelines to cloud principals so you never ship static keys.
Azure Workload Identity, AWS IRSA, GCP Workload Identity Federation, Gardener, and on-prem OIDC.
Every issuance logged with subject, cloud principal, policy decision, and TTL.
GitHub Actions, GitLab, and Azure DevOps exchange OIDC tokens for cloud credentials — no secrets in repo, no shared keys.
AKS
EKS
GKE
Gardener
Bare MetalHow Cloud Identity Mesh works
Cloud Identity Mesh is a control plane that brokers OIDC trust, enforces policy, and issues short-lived credentials from your cloud providers. The same flow powers clusters and pipelines.
- 1Define identity policies once
Map namespaces, service accounts, and CI subjects to cloud roles through a single policy layer.
- 2Request short-lived credentials
Workloads and pipelines call the mesh, which evaluates policy and assembles a claim for the cloud provider.
- 3Cloud provider issues tokens
Cloud Identity Mesh federates to Azure, AWS, and GCP to obtain first-party tokens. You never touch raw keys.
- 4Audit and trace every issuance
Decisions and lifetimes are logged for SIEM export, satisfying compliance teams.
- • Eliminate static secrets from clusters and pipelines.
- • Normalize identity across AKS, EKS, GKE, Gardener, and on-prem.
- • Give security teams a central policy + audit surface.
Cloud Identity Mesh integrates with your CI/CD tooling and platform stack. Nopsa Ventures offers implementation and advisory services to roll this out safely at scale.
Federated Cloud Credentials across AWS, GCP, Azure, Gardener, On-prem
One control plane, different provider mechanics.
Toggle to see what changes.
Mesh establishes OIDC trust per cluster, maps service accounts to IAM roles, and mints short-lived STS credentials.
- IRSA trust bound to cluster OIDC issuer
- Policies map k8s namespace + SA → IAM role ARN
- No access keys stored in pods or pipelines
Outcome: short-lived, auditable tokens issued by your cloud provider, enforced by Cloud Identity Mesh policy.
What you get in the first 30 days
A concrete path to secretless workloads and CI, paced over the first month.
Hook cluster OIDC issuers, baseline policies, and CI trust with least-privileged roles.
Roll first workloads secretless; add audit export to your SIEM; test break-glass flow.
Enable pipelines with ephemeral creds; expand to priority namespaces; bake in learnings and guardrails.
Policy-as-code that maps Kubernetes and CI identities to cloud roles
Express constraints on namespace, service account, workload labels, CI issuer, repository, branch, and time-of-day. Attach default TTLs and scopes per environment.
- • env == prod
- • repo == org/service
- • subject in ns/payments
- • cloud principal: role/payments-api
- • scopes: s3:GetObject, kms:Decrypt
- • ttl: 45 minutes
Every issuance logged with subject, principal, decision, and TTL
Export to your SIEM or data platform; align with SOC2, ISO27001, NIST 800-63, and cloud provider audit requirements.
Built for platform, security, and DevOps teams
Bake identity into cluster onboarding and GitOps. Standardize how teams request cloud access.
- • Golden paths for namespaces and SAs
- • GitOps-friendly configs
- • Zero manual key rotation
Policy-as-code for who can assume what, with audit trails that map cloud principals back to workloads.
- • Full issuance logs
- • Scoped, time-bound credentials
- • Alignment with SOC2 / ISO expectations
Ship without secrets in CI. Safer rollouts with cloud-native tokens that expire automatically.
- • GitHub/GitLab/Azure DevOps federation
- • Per-deploy credentials
- • Reduced blast radius
Use cases
Replace environment secrets with short-lived tokens issued at runtime for cloud APIs and vaults.
GitHub, GitLab, and Azure DevOps obtain ephemeral credentials per pipeline run—no stored cloud keys.
One policy layer for AKS, EKS, GKE, Gardener, and on-prem. Consistent mapping to cloud principals.
Trusted patterns from regulated environments
Replaced service account keys on GKE; audit feed piped to SIEM; rollout in 10 days.
AKS workloads moved to managed identities; token lifetimes capped at 45m; zero stored keys.
GitHub Actions federated to AWS/GCP for multi-cloud deploys; per-branch policies enforced.
Bare-metal + Gardener clusters share one policy layer; audit mapped workloads to cloud roles.
Built by Nopsa Ventures
Nopsa Ventures is a consulting and engineering partner focused on secrets management, federated credentials, managed cloud identities, and platform security. Cloud Identity Mesh captures battle-tested patterns we apply in client engagements and makes them available as a reusable framework.
Planning a new Kubernetes platform or modernizing access for an existing estate? We can help you roll out Cloud Identity Mesh safely and with guardrails.
Learn more about Nopsa VenturesWant to see Cloud Identity Mesh in action and discuss how it could fit into your platform? Schedule a live session with the Nopsa Ventures team.