Documentation Index
Fetch the complete documentation index at: https://docs.coreweave.com/llms.txt
Use this file to discover all available pages before exploring further.
Deploy a production-ready CoreWeave environment with Terraform using a modular repository that provisions a VPC, CKS cluster, node pools, and DFS storage in two phases. Phase 1 creates the networking and cluster. Phase 2 adds node pools and DFS volumes after the cluster is running and you have kubeconfig. Object Storage is an optional add-on you can include at any point.
What this deploys
The reference architecture uses a single Terraform root with separate modules for each resource. A two-phase apply is required because node pools and DFS volumes are Kubernetes manifests that need a running cluster and kubeconfig.
Phase 1 - Networking and cluster
| Resource | Description |
|---|
| VPC | CoreWeave VPC with host prefixes and named CIDR prefixes for CKS (pod, service, internal LB). |
| CKS cluster | CoreWeave Kubernetes Service cluster in the VPC. Supports OIDC configuration for external IdPs. |
Phase 2 - Node pools and storage
| Resource | Description |
|---|
| NodePool(s) | One or more CKS node pools (Kubernetes manifest). Requires kubeconfig from Phase 1. |
| DFS PVC(s) | One or more Distributed File Storage PVCs (shared-vast, ReadWriteMany). Requires kubeconfig from Phase 1. |
Optional add-on - Object Storage
| Resource | Description |
|---|
| Object Storage org access policy | Organization-wide access policy for AI Object Storage. At least one must exist before creating buckets. |
| Object Storage bucket | CoreWeave AI Object Storage (S3-compatible) bucket. |
| Object Storage bucket policy | Per-bucket S3-compatible access policy for fine-grained control. |
Prerequisites
IAM roles
Your CoreWeave user or API token must have the appropriate IAM roles for each phase. The following table lists the minimum required roles.
| Phase | Required IAM role |
|---|
| Phase 1 (VPC + CKS cluster) | CKS Admin - create, update, and delete clusters and VPC resources. |
| Phase 2 (NodePool / DFS) | CKS Admin + kubeconfig for the cluster. |
| Object Storage add-on (optional) | Object Storage Admin - create/delete buckets, manage organization access policies. |
| OIDC WIF setup (optional) | IAM Admin - configure identity integrations including Workload Identity Federation. |
Repository structure
The reference architecture repository organizes all resources as modules. The root main.tf wires them together.
.
├── README.md
├── .gitignore
├── .terraform.lock.hcl # Committed for reproducible provider versions
├── terraform.tfvars.example # Copy to terraform.tfvars and fill in your values
├── providers.tf # CoreWeave + Kubernetes providers, token variable
├── main.tf # Calls all modules (network, cks, object_storage, nodepool, dfs)
├── variables.tf # Root variables (passed into modules)
├── outputs.tf # Outputs from each module
└── modules/
├── network/ # VPC (coreweave_networking_vpc)
│ ├── main.tf
│ ├── variables.tf
│ ├── outputs.tf
│ └── versions.tf
├── cks/ # CKS cluster (coreweave_cks_cluster)
│ ├── main.tf
│ ├── variables.tf
│ ├── outputs.tf
│ └── versions.tf
├── object_storage/ # Optional AI Object Storage bucket + policies
│ ├── main.tf # Bucket, org access policy, bucket policy
│ ├── variables.tf
│ ├── outputs.tf
│ └── versions.tf
├── nodepool/ # CKS NodePool (kubernetes_manifest, Phase 2)
│ ├── main.tf
│ ├── variables.tf
│ ├── outputs.tf
│ └── versions.tf
└── dfs/ # DFS PVC (shared-vast, kubernetes_manifest, Phase 2)
├── main.tf
├── variables.tf
├── outputs.tf
└── versions.tf
terraform.tfvars is not committed. Create it from terraform.tfvars.example.- State files (
*.tfstate) are not committed. Use a remote backend for production environments.
Outputs
After apply, Terraform outputs include:
| Output | Source | Description |
|---|
vpc_id | module.network | Created VPC ID. |
cks_cluster_id | module.cks | CKS cluster ID. |
cks_cluster_name | module.cks | CKS cluster name. |
cks_api_server_endpoint | module.cks | Kubernetes API server endpoint. |
cks_status | module.cks | Current cluster status. |
cks_service_account_oidc_issuer_url | module.cks | OIDC issuer URL for CKS service account tokens (use for WIF). |
nodepools | module.nodepool | Map of created NodePool names. |
dfs_pvcs | module.dfs | Map of created DFS PVCs. |
| Output | Source | Description |
|---|
object_storage_bucket_name | module.object_storage | Bucket name, if created. |
object_storage_org_access_policy_names | module.object_storage | Map of created org access policy names. |
object_storage_bucket_policy_json | module.object_storage | Bucket policy JSON, if applied. |
