Infrastructure
Kubernetes, Terraform, cloud and SSH, from one workflow with one audit trail.
Infrastructure changes today live across kubectl scripts, Terraform pipelines, cloud consoles and ad hoc SSH sessions. Nexus orchestrates all four from a single workflow engine, with approval steps where a change needs a human decision and a record of what actually ran.
- for Kubernetes, Terraform, cloud, SSH
- One enginefor Kubernetes, Terraform, cloud, SSH
- approval on changes that need it
- Governedapproval on changes that need it
- deploys against any cluster
- Kubernetes-agnosticdeploys against any cluster
- record of every executed action
- Auditedrecord of every executed action
The buyer problem
Infrastructure changes are spread across tools with no shared record.
A Kubernetes rollout goes through a CI pipeline. A Terraform apply runs from a laptop. A one-off cloud change happens in the console. An emergency fix goes over SSH. Each is a legitimate way to change infrastructure, and none of them share an approval process or an audit trail with the others.
When something breaks, reconstructing what changed means checking four different systems, if all four even kept a usable log.
What changes
One workflow engine covers what used to be four separate paths.
- Kubernetes changes
- Kubectl actions run as workflow steps against your cluster, Kubernetes-agnostic across distributions.
- Infrastructure as code
- Terraform plan and apply run as governed steps, with the plan output available for review before anything is applied.
- Cloud resources
- Cloud provider actions run through connectors, without a bespoke script per provider.
- Hosts without an API
- SSH actions cover servers and appliances that are not managed declaratively.
How it works mechanically
A request becomes a governed sequence of infrastructure actions.
- Kubectl
Deploy, scale and roll back workloads directly against a cluster from a workflow step.
- Terraform
Plan and apply infrastructure changes as a governed step, with the plan output available for review before apply.
- Cloud actions
Provision, modify or tear down cloud resources through connector actions rather than hand-written scripts per provider.
- SSH
Run commands directly against hosts that are not managed through an API, for the parts of the estate that still need it.
Node palette
Triggers
- Webhook
- Schedule
- Event bus
Actions
- Connector
- HTTP
- Database
Logic
- Condition
- Rules + Code
- Merge
People and AI
- Approval
- Form
- AI node
- 01Webhook triggerTrigger
- 02Connector actionIntegration
- 03Rules + CodeLogic
- 04AI classificationSovereign AI
- 05Human approvalPeople
- 06System write-backAction
Configuration
- Node
- Rules + Code
- Runtime
- Selected per task
- Inputs
- From previous nodes
- Secrets
- Vault reference
- Output
- Structured, typed
- On error
- Route to exception path
Worked example
A capacity increase runs from ticket to applied change.
Request received
A capacity increase is requested through a form or an upstream ticketing event, specifying the cluster and workload.
Plan generated
A Terraform plan step generates the proposed change to the underlying node pool, and the plan output is attached to an approval request.
Human approval
An infrastructure engineer reviews the plan and approves it, or rejects it with a comment routed back to the requester.
Applied and verified
On approval, Terraform apply and a kubectl scale step run in sequence, and a verification step confirms the workload is healthy at the new capacity.
What you get
A single audit trail across every kind of infrastructure change.
Change request
The originating request, whether opened by a person, a schedule or an upstream event.
Plan or dry run
Where applicable, the Terraform plan or equivalent preview shown to the approver before anything changes.
Approval record
Who approved the change, when, and any comment left at the point of approval.
Execution log
The kubectl, Terraform, cloud or SSH actions actually run, with output and result captured for each step.
Where it deploys
Runs inside your infrastructure, against your infrastructure.
Runtime
Kubernetes-agnostic
Deploys against clusters on-premises, in a private cloud, in a sovereign cloud, or air-gapped, without depending on a specific distribution.
Security
Credentials stay vaulted
Cluster tokens, cloud credentials and SSH keys are held in vault-managed secrets, referenced by workflow steps rather than embedded in scripts.
Access
Access follows RBAC
Who can trigger, approve or view infrastructure workflows follows your SSO, MFA and RBAC configuration.
Architecture session
Bring Kubernetes, Terraform, cloud and SSH under one governed workflow.
We will map your current change paths and show how they consolidate into one workflow engine with a single audit trail.