Skip to content
SkiMasque
Sign InGet Started

From identity to network access.

SkiMasque turns an authenticated identity into a short-lived, policy-controlled network session.

  1. WORKLOAD
    control plane
  2. IDENTITY
    control plane
  3. AUTHENTICATE
    control plane
  4. AUTHORIZE
    active
  5. SESSION ACTIVE
    active
  6. GATEWAY
    active
  7. PRIVATE NETWORK
A workload presents an identity, is authenticated and authorized, receives a session, and reaches the private network through the gateway.

Follow a deployment from request to expiry

In this example, a GitHub Actions job needs temporary access to one private database. Play the walkthrough to follow the decision and the resulting traffic path, or read each step at your own pace.

Simulated example · Playback compresses a 20-minute session into a few seconds. It does not open a connection or show live activity.

Read the six steps below to follow the session from request to expiry.

  1. Request access

    GitHub Actionsacme/widget

    A GitHub Actions job in acme/widget asks to run terraform against db.prod:5432.

  2. Verify identity

    Identitydeploy-production

    SkiMasque verifies the job's OIDC identity, including its repository and workflow claims.

  3. Check policy

    Policy ACCESS GRANTED

    A matching allow rule permits this identity and application to reach the requested destination. Without a matching allow rule, the request is denied.

  4. Open a session

    Session20 minutes ACTIVE

    An authorized request receives a session limited to db.prod:5432 for 20 minutes in this example.

  5. Connect through the gateway

    1. Gatewayus-west
      trafficactive
    2. Databasedb.prod:5432
    The gateway forwards the session's traffic to db.prod:5432.

    The workload's traffic passes through the us-west gateway to the private database. The control plane makes the access decision; the gateway carries the traffic.

  6. Session expires

    Session EXPIRED

    When the session expires or ends, its access closes. A later connection needs a new authorized session.

Step 1 — Identify

A workload requests access to a destination. SkiMasque identifies who is asking and which application needs the connection.

Example
repository: acme/widget
workflow: deploy-production
ref: main
application: terraform

Step 2 — Authenticate

SkiMasque verifies the presented identity using the configured identity source.

For GitHub Actions, workload identity/OIDC establishes which repository and workflow is making the request. Authentication establishes the identity; policy determines its access.

Step 3 — Authorize

SkiMasque evaluates the identity, application, and requested destination against policy.

Policy
WHO
acme/widget

WHAT
terraform

WHERE
db.prod:5432

A matching allow rule grants the requested access within its limits. With no matching allow rule, the request is denied before a session is opened.

Step 4 — Establish a session

If authorized, SkiMasque creates a short-lived session for the permitted destination. The 20-minute duration and bandwidth below are illustrative policy limits.

Example
SESSION
Status: Active
Destination: db.prod:5432
Duration: 20m
Bandwidth: 100 Mbps
Gateway: us-west

Step 5 — Connect

The control plane authorizes the session. Traffic flows through the SkiMasque gateway to the permitted service in the customer's network.

Control plane
  • sessions and policycontrol plane
    Gateway
    • active
      Database
    • active
      Internal API
    • active
      Kubernetes API
    Services behind YOUR NETWORK.
The control plane tells the gateway which sessions are allowed; the gateway forwards traffic only to the private services in your network.

Step 6 — Expire

Each new tunnel requires a valid credential and another policy decision. Exec closes its local tunnels on exit. Agent sessions additionally close active tunnels at expiry or when the gateway receives revocation. CI/developer credential expiry does not cut existing tunnels, and policy max_duration is currently metadata.

  1. REQUEST
    identitycontrol plane
  2. AUTHENTICATE
    policycontrol plane
  3. AUTHORIZE
    active
  4. CONNECT
    active
  5. ACTIVE ACTIVE
    potential
  6. EXPIRE EXPIRED
An access request is authenticated and authorized before connecting. Agent sessions close tunnels at expiry; other credentials gate new tunnels, while client cleanup closes local connections.

No manual VPN disconnect.

No standing session.