Skip to main content
On a GPU cluster with Together-managed OpenID Connect (OIDC), project collaborators run kubectl and SSH with their own Together accounts. Their access follows the project roles you already manage in Together. There’s no identity provider to set up and no shared credential to hand out.
To use your organization’s own identity provider (Google, Okta, Auth0, Entra ID) instead, see Set up OIDC authentication.

​
Check whether your cluster uses Together-managed OIDC

Open the cluster in the Together AI console. A cluster with Together-managed OIDC shows:
  • An OIDC Issuer of the form https://dex.<LOCATION>.cloud.together.ai/t-<CLUSTER_ID>.
  • An OIDC Kubeconfig row whose Quick setup installs kubelogin.

​
How it works

Each cluster gets its own sign-in service at its issuer URL. When you run kubectl, the kubelogin plugin opens your browser to that service, which sends you to the Together sign-in page. Only collaborators on the cluster’s project can sign in. After you sign in, the service issues a signed ID token that carries your email address and your project role, and kubelogin caches the token under $HOME/.kube/cache/oidc-login/. The cluster’s Kubernetes API server uses your email address as your Kubernetes username and your project role as a group. Kubernetes role-based access control (RBAC) then decides what you can do, starting from the default bindings.

​
Default access

When the cluster first becomes ready, it gets one RBAC binding per project role: These bindings are named ums-oidc-admin and ums-oidc-member. Together creates them only once and doesn’t overwrite later changes, so a cluster admin can edit them or grant more access with new bindings.
Editors can run kubectl get pods --all-namespaces, but kubectl get nodes returns 403 Forbidden, because the view role doesn’t include nodes.

​
Connect with kubectl

1

Install kubelogin

Install int128/kubelogin, which provides the kubectl oidc-login plugin:
2

Save the OIDC kubeconfig

In the console, open the cluster and select View next to OIDC Kubeconfig. Copy the kubeconfig and save it to $HOME/.kube/oidc-config.yaml:
On Linux, replace pbpaste with xclip -selection clipboard -o, or select Download instead of View and save the file to the same path.If you don’t see the OIDC Kubeconfig row, ask a project admin to share theirs. The OIDC kubeconfig contains no credentials, so it’s safe to share with anyone in the project.
3

Verify access

Run a kubectl command with the OIDC kubeconfig:
Your browser opens the Together sign-in page. After you sign in, the command runs as your email address. Later commands reuse the cached token until it expires.

​
Grant more access

To grant access beyond the defaults, create standard RBAC bindings with the admin kubeconfig, or with an OIDC kubeconfig signed in as a project admin. For example, to let one editor manage workloads in a namespace, bind their email address:
To give every editor in the project the same access, bind their project role group instead:

​
Revoke access

To revoke a collaborator’s access to the cluster:
  1. Remove them from the cluster’s project in Settings > Project > Collaborators. They can no longer sign in to the cluster, but a token they already have keeps their project role’s access until it expires, up to 24 hours after sign-in.
  2. Delete any RBAC bindings that name their email address. This immediately removes the access those bindings granted.

​
SSH with your Together account

On clusters that support OIDC SSH, the same Together sign-in gives you SSH access without an SSH key. The Together CLI’s tg clusters ssh command signs you in through the cluster’s issuer and gets a short-lived SSH certificate for your email address from the cluster’s certificate authority. After you’re removed from the cluster’s project, you can’t get a new certificate, but one you already have works until it expires. See Connect over SSH for the commands.

​
Troubleshooting

​
403 Forbidden

You signed in, but your role doesn’t allow the request. Editors can’t list nodes or read Secrets by default. Run kubectl auth whoami with the OIDC kubeconfig to check which username and groups the cluster sees, then ask a cluster admin to grant more access if you need it.

​
Sign-in fails in the browser

The Together sign-in page only admits collaborators on the cluster’s project. Check that the Together account you signed in with is a collaborator on that project.

​
The browser doesn’t open

Check that kubelogin is installed and on your PATH:

​
Access didn’t change after a role update

Your token carries the project role you had when you signed in, so a role change takes effect at your next sign-in. Clear the cached token so the next command signs in again: