NVIDIA 中央身份网关模式：跨联邦 Kubernetes 与 AI 平台传播用户身份
原标题：How to Carry User Identity Across Federated Kubernetes and AI Platforms
AI 摘要
NVIDIA 技术博客介绍了一种在联邦式 Kubernetes 和 AI 平台中跨数据平面传播用户身份的中央身份网关模式。该模式通过集中式会话管理、标准 OIDC 和共享会话存储，解决了分布式会话所有权带来的重复登录、注销不一致和令牌刷新不协调等问题。NVIDIA 内部实施后，跨 AWS 和 OCI 的 Kubernetes 集群的重复登录事件减少了 55%，并为统一平台外壳和 AI 助手提供了可复用基础。
正文节选
Modern AI platforms are no longer a single application behind one login screen. A user may start in a central portal, open a governed dataset, launch a notebook where that data resides, and invoke an assistant that calls services in another cluster. The workflow feels unified, but identity crosses control-plane and data-plane boundaries at every step. That is where conventional single sign-on (SSO) stops being enough. SSO proves the user at the front door. Platform teams who manage a federated d