Manage API Access Tokens and Kubeconfig Files
Create and manage API Access Tokens and their associated Kubeconfigs
CKS API Access Tokens are used to authenticate users and to grant access to resources such as Clusters and VPCs.
Prerequisites
This guide assumes that you have an active CoreWeave account.
Create a new API Access Token
API Access Tokens must be created in the CoreWeave Cloud Console. To create a new Access Token, complete the following steps:
-
Click the Tokens button in the Cloud Console navigation, and then click the Create Token button in upper-right corner.
-
In the Create API Token dialog, configure the token values by filling in the following fields, and then click Create:
Field Description Name The name of the token. Expiration The length of time for which the Token is valid. Note A description for future reference. -
Pick one of the following options:
Option Description Token Secret Copy and store the token secret for use cases like scraping logs, metrics, and setting up your own self-hosted Grafana, or to add the token secret to an existing kubeconfig
.Kubeconfig Create and download a kubeconfig
for a specific cluster to interact with the cluster using commands likekubectl
. Note that a Kubeconfig can access multiple Clusters by switching contexts.WarningThese sensitive values are never shown again after closing the modal. Be sure to record them in a secure location.
Use the Kubeconfig File
To use the Kubeconfig file, you must have the kubectl
command-line tool installed. If you don't have kubectl
installed, follow the instructions in the Kubernetes documentation.
To use the Kubeconfig file, either:
- copy it to the default location for Kubeconfig files, typically
~/.kube/config
; - specify the file location with the
KUBECONFIG
environment variable; or, - use the
--kubeconfig
flag withkubectl
.
See the Kubernetes documentation for more information.
When the Kubeconfig is in place, you can use kubectl
to interact with the CKS clusters. To test the configuration, run:
$kubectl config view
The output should resemble the following:
apiVersion: v1kind: Configclusters:- cluster:server: https://<id>.k8s.<zone>.coreweave.comname: my-clustercontexts:- context:cluster: my-clusternamespace: defaultuser: cwtoken-<TOKEN-ID>name: my-cluster-tokenusers:- name: cwtoken-<TOKEN-ID>-test-tokenuser:token: <TOKEN-SECRET>
Best practices for Kubeconfig security
The Kubeconfig contains API Access Tokens, which should be treated with the same care as passwords or private SSH keys.
- Make sure only the file owner can read and write the Kubeconfig file. For example, on Linux or macOS, use
chmod 600
to set the appropriate permissions. - Avoid storing the Kubeconfig in version control systems.
- Use separate Kubeconfigs for different users and applications, instead of sharing a single Kubeconfig among multiple users or apps.
- Regularly rotate Kubeconfig files, and revoke access for users or applications that no longer need it to reduce the risk of credential leakage.
Learn more about Kubeconfig files in the official Kubernetes documentation.
Manage Access Tokens
You can view or delete Access Tokens on the Access Tokens dashboard. The secret values are never shown again after creation, so be sure to record them in a secure location.
Users have different levels of access to CKS clusters. Permissions are designated by the organization administrators. For more information on how permissions are set for users and groups, see User Permissions.