---
title: "How to Carry User Identity Across Federated Kubernetes and AI Platforms"
description: "Federated data and AI platforms let users move among portals, datasets, notebooks, and assistants across clusters, but single sign-on alone does not carry trusted identity across control-plane and data-plane boundaries. The post presents a central identity gateway that owns platform sessions through OIDC, a shared session store, stateless data-plane gateways, and an identity-validation API. Regional gateways validate sessions through /gateway/userinfo, enforce local policy, and inject standardized identity headers instead of forwarding raw tokens or independently managing refresh and logout. This separates session ownership from request enforcement, supports consistent logout, and lets assistants pass delegated user identity to backend tools without broad service credentials. At NVIDIA, the approach reduced repeated login events by 55% across internal developer platforms spanning Kubernetes clusters in AWS and OCI, while establishing a foundation for unified platform shells and AI assistants."
---

# How to Carry User Identity Across Federated Kubernetes and AI Platforms

[NVIDIA](https://yomu.fyi/company/nvidia-developer-blog) · Elizabeth Goodman · Sep 3, 2026

**Type:** Explainer

## Summary

Federated data and AI platforms let users move among portals, datasets, notebooks, and assistants across clusters, but single sign-on alone does not carry trusted identity across control-plane and data-plane boundaries. The post presents a central identity gateway that owns platform sessions through OIDC, a shared session store, stateless data-plane gateways, and an identity-validation API. Regional gateways validate sessions through /gateway/userinfo, enforce local policy, and inject standardized identity headers instead of forwarding raw tokens or independently managing refresh and logout. This separates session ownership from request enforcement, supports consistent logout, and lets assistants pass delegated user identity to backend tools without broad service credentials. At NVIDIA, the approach reduced repeated login events by 55% across internal developer platforms spanning Kubernetes clusters in AWS and OCI, while establishing a foundation for unified platform shells and AI assistants.

## Context

Users and services in federated data and AI platforms move across regional clusters, cloud accounts, on-premises environments, and specialized execution planes. Conventional SSO authenticates users at the entry point but does not automatically provide trusted, consistent identity context to workloads running in those data planes. Distributed session ownership can also cause repeated logins, inconsistent logout and claims, duplicated authentication logic, and increased identity-provider load.

## Approach / What changed

A central identity gateway handles OIDC login, owns platform session state in a shared store such as Redis, and provides an identity-validation endpoint such as /gateway/userinfo. Regional gateways retain local access enforcement, validate sessions through the central service, and inject standardized identity headers into downstream requests. The design separates session ownership from request enforcement and can be migrated incrementally across gateways and services.

## Takeaways

- The central gateway owns session creation, refresh, validation, and logout, while the regional gateways continue enforcing per-cluster policies.
- Regional gateways call /gateway/userinfo for trusted identity claims and pass standardized identity headers to downstream applications instead of requiring each application to implement identity-provider logic.
- The pattern reduced repeated login events by 55% across NVIDIA internal developer platforms spanning Kubernetes clusters in AWS and OCI.

**Tags:** [Authentication](https://yomu.fyi/topic/authentication), [Kubernetes](https://yomu.fyi/topic/kubernetes), [OIDC](https://yomu.fyi/topic/oidc), [Redis](https://yomu.fyi/topic/redis)

- Source: [NVIDIA](https://developer.nvidia.com/blog/how-to-carry-user-identity-across-federated-kubernetes-and-ai-platforms)
- Source URL: https://developer.nvidia.com/blog/how-to-carry-user-identity-across-federated-kubernetes-and-ai-platforms
- Ingested by Yomu: 2026-09-04T00:00:58.400Z

[Read original post](https://developer.nvidia.com/blog/how-to-carry-user-identity-across-federated-kubernetes-and-ai-platforms)