- Nubus is your central IAM – cloud-native in your cluster, delivered as a Kubernetes deployment via an umbrella Helm chart.
- Declarative, scalable, and without dependency on a specific cloud provider.
- Deploy on-premises, in a private cloud, public cloud, or hybrid environment.
Deployment · Cloud-Native IAM
Nubus on Kubernetes
The Challenges
IAM Should Run Cloud-Native – Without Creating New Dependencies.
Organizations that rely on Kubernetes want consistent operational patterns: declarative deployments, GitOps, horizontal scaling, and self-healing. An identity system that does not follow these patterns becomes an operational exception, while IAM from a single provider’s cloud becomes a risk to digital sovereignty.
01
IAM as a Foreign Element in the Cluster
Traditional IAM systems cannot be cleanly deployed, scaled, or updated declaratively. They break with the operational processes that have long been established for all other workloads.
02
Dependency on the Cloud Provider
Managed identity services tie identity data and operations to a single platform. Switching becomes expensive, and digital sovereignty is lost.
03
Manual Scaling and Resilience
High availability, load peaks, and updates without downtime require a great deal of manual work in monolithic setups making them error-prone and difficult to audit.
The Solution
Nubus as a Native
Kubernetes Deployment.
Nubus is Univention’s open source IAM platform – here as a fully containerized deployment. All components run as pods in the cluster and are uniformly configured, versioned, and deployed via a single umbrella Helm chart. You integrate Nubus into your existing cloud-native processes instead of creating an exception to them.
Deployed Declaratively
A single umbrella Helm chart bundles services, configures them consistently, and starts them in the correct order. GitOps-ready and reproducible.
Based on Open Standards
Single Sign-on (OIDC, SAML), LDAP, UDM REST API, and SCIM. The same interfaces as with every Nubus deployment option.
Scales With the Cluster
From individual applications to millions of identities, across multiple nodes.
Cloud-Neutral
Runs on any conformant cluster, on-premises or with a provider of your choice. No vendor lock-in; your identity data remains under your control.
Looking for the simpler deployment option? Nubus is also available as a virtual machine (UCS).
Compare deployment options
VM or Kubernetes?
The Right Deployment Option for Your Infrastructure.
| Criterion | Virtual Machine (UCS) | Kubernetes |
|---|---|---|
| Getting Started & Operations | Quick to set up, familiar administration | Cluster and Helm expertise required |
| Scaling | Vertical and horizontal, manual | Horizontal, automatically across nodes |
| High Availability | UCS capabilities and data center resources | Self-healing & redundancy through the cluster |
| Updates | UCS update management | Declaratively via Helm |
| Ideal für | Established on-premises environments | Cloud-native environments, GitOps, openDesk-like platforms |
Identical functionality: Portal, SSO, MFA, self-services, and open standards are the same for both deployment options.
The Benefits
Run Cloud-Native. Stay Sovereign.
-
Resilient Operations
If a node fails, the cluster automatically redistributes the affected pods, keeping your login service available. Self-healing instead of overnight emergency work.
-
Updates Without Downtime
New versions are rolled out in a controlled manner via Helm and can be rolled back if problems occur. No maintenance window for central authentication.
-
Scales With Demand
Load peaks, for example, at the beginning of a school year or fiscal year, are handled by the cluster through horizontal scaling, without manual intervention.
-
Digital Sovereignty
100% open source, deployable on your own or European infrastructure. No dependency on a single cloud provider, important for GDPR, BSI IT-Grundschutz, and NIS2.
Architecture & How It Works
How Nubus Runs in the Cluster.
Within the cluster, Nubus consists of cooperating services (pods) that together form the central IAM:
- Keycloak: Authentication and Single Sign-on (OIDC, SAML).
- LDAP / UDM: The central directory for identities, groups, and roles.
- APIs: Provisioning and automation via REST and SCIM.
- Portal & Self-Services: Central access for users and administrators.
Deployment: Umbrella Helm Chart
A Helm chart is the declarative blueprint for a Kubernetes application. The Nubus umbrella chart bundles all components, configures them consistently through centralized values, and starts them in the correct order – reproducible and GitOps-ready.
Clear responsibilities in operations.
Roles & Responsibilities
Kubernetes clearly separates cluster operations, application deployment, and application administration, so each role knows exactly what it is responsible for:
Kubernetes Administrators
Responsible for the cluster: nodes, networking, storage, load balancers, and access rights.
Technical Operators
Often part of DevOps teams, deploy and scale Nubus via the Kubernetes API and Helm and monitor its status.
System administrators
Manage the application itself, users, groups, and roles, via the web interface. No Kubernetes knowledge is required for this.
Reference
Kubernetes-Native and Proven in Production
Nubus is the central IAM for the sovereign workplace platform openDesk – in a distributed Kubernetes environment, 100% open source and compliant with BSI IT-Grundschutz.
ZenDiS / openDesk
Digital sovereignty for public administration
-
100 %Open Source
-
BSICompliant
-
K8sNative
1. Requirements
- Integration of various open source components into a unified platform
- Central IAM for distributed Kubernetes environments
- SSO & compliance with BSI IT-Grundschutz
2. Solution
- Nubus as a central identity platform
- Single Sign-on
- Standardized interfaces and integrations
- Self-service and password management
3. Benefits
- Digital sovereignty through open source
- Extensible and interchangeable modules
- Reduced administrative effort through automation
Centralized IAM, Operated Cloud-Native - From Schools to Data Centers.
Nubus on Kubernetes brings your Identity & Access Management into your cloud-native environment: sovereign, scalable, and based on open standards. From local testing to a production cluster.
