I think Crossplane[1] could be a candidate here. It allows cloud services to be provisioned via native CRs in your Kubernetes cluster and mount their credentials to workloads that can be scheduled to any kubernetes cluster, either provisioned through Crossplane or imported via Kubeconfig.