How to Carry User Identity Across Federated Kubernetes and AI Platforms | NVIDIA Technical Blog

Introduced a central identity gateway pattern for propagating user identity across federated Kubernetes and AI platforms. This pattern separates session ownership from request enforcement, allowing regional gateways to validate user identity through a shared session store instead of managing independent OIDC flows. This approach reduced repeated login events by 55% across internal developer platforms spanning Kubernetes clusters in AWS and OCI, while enabling unified platform shells and AI assistants with delegated user identity. The architecture uses standard OpenID Connect, a minimal /gateway/userinfo validation endpoint, stateless regional gateways, and a shared Redis-backed session store with explicit TTLs. Centralized session ownership coordinates token refresh and logout platform-wide, reduces upstream identity-provider load to scale with active users rather than user-tool combinations, and standardizes identity headers for downstream services. Security guardrails include mutual TLS or workload identity between gateways, stripping inbound identity headers before injecting trusted ones, and defining explicit failure behavior for session-store unavailability.