GitOps Security Architecture with Zero Trust: Identity-Driven Control Planes for Cloud-Native Deployments

The rapid adoption of GitOps has redefined continuous deployment in cloud-native environments, yet prevailing GitOps implementations often rely on implicit trust relationships that conflict with modern Zero Trust security principles. This paper introduces an identity-driven Zero Trust architecture for GitOps-managed Kubernetes deployments, where every deployment action is continuously authenticated, authorized, and validated through explicit identity and policy enforcement. By integrating federated identity, workload-level authentication, and policy-as-code into the GitOps control plane, the proposed approach transforms deployment pipelines into verifiable security enforcement points rather than privileged automation channels. The architecture is validated in a production-scale cloud environment and demonstrates measurable improvements in deployment integrity, policy compliance, and unauthorized access prevention, while preserving the operational efficiency that makes GitOps effective. This work establishes a practical foundation for embedding Zero Trust directly into cloud deployment architectures, advancing secure-by-design principles for modern financial and enterprise cloud platforms.