coreweave_cks_cluster (Resource)

​

Example usage

resource "coreweave_networking_vpc" "default" {
  name = "default"
  zone = "US-EAST-04A"

  host_prefixes = [
    {
      name     = "primary"
      type     = "PRIMARY"
      prefixes = ["10.16.192.0/18"]
    },
  ]

  vpc_prefixes = [
    {
      name  = "pod cidr"
      value = "10.0.0.0/13"
    },
    {
      name  = "service cidr"
      value = "10.16.0.0/22"
    },
    {
      name  = "internal lb cidr"
      value = "10.32.4.0/22"
    },
  ]
}

resource "coreweave_cks_cluster" "default" {
  name                   = "default"
  version                = "v1.35"
  zone                   = "US-EAST-04A"
  vpc_id                 = coreweave_networking_vpc.default.id
  public                 = false
  pod_cidr_name          = "pod cidr"
  service_cidr_name      = "service cidr"
  internal_lb_cidr_names = ["internal lb cidr"]
  audit_policy           = filebase64("${path.module}/audit-policy.yaml")
  kubelet                = jsonencode({ maxPods = 256 })

  # Direct public access to the Kubernetes API server, independent of `public`.
  # This feature requires contacting CoreWeave support to enable it for your organization.
  # Once enabled, uncomment this block and replace these documentation prefixes with your client source networks.
  # kube_api_access = {
  #   public = {
  #     allow_cidrs = ["203.0.113.0/24", "2001:db8::/32"]
  #     deny_cidrs  = ["203.0.113.128/25"]
  #   }
  # }

  oidc = {
    ca              = filebase64("${path.module}/example-ca.crt")
    client_id       = "kbyuFDidLLm280LIwVFiazOqjO3ty8KH"
    groups_claim    = "read-only"
    groups_prefix   = "cw"
    issuer_url      = "https://samples.auth0.com/"
    required_claim  = ""
    signing_algs    = ["SIGNING_ALGORITHM_RS256"]
    username_claim  = "user_id"
    username_prefix = "cw"
  }
  authn_webhook = {
    ca     = filebase64("${path.module}/example-ca.crt")
    server = "https://samples.auth0.com/"
  }
  authz_webhook = {
    ca     = filebase64("${path.module}/example-ca.crt")
    server = "https://samples.auth0.com/"
  }
}

# Null until the endpoint and CA are reported.
output "kube_api_endpoint" {
  value = try(coreweave_cks_cluster.default.kube_api_access_status.public.endpoint, null)
}

output "kube_api_ca_pem" {
  value = try(base64decode(coreweave_cks_cluster.default.kube_api_access_status.ca_data), null)
}

​

Schema

​

Required

• internal_lb_cidr_names (List of String) The names of the vpc prefixes to use as internal load balancer CIDR ranges. Internal load balancers are reachable within the VPC but not accessible from the internet. The prefixes must exist in the cluster’s VPC. This field is append-only.
• name (String) The name of the cluster. Must not be longer than 30 characters.
• pod_cidr_name (String) The name of the vpc prefix to use as the pod CIDR range. The prefix must exist in the cluster’s VPC.
• service_cidr_name (String) The name of the vpc prefix to use as the service CIDR range. The prefix must exist in the cluster’s VPC.
• version (String) The version of Kubernetes to run on the cluster, in minor version format (e.g. ‘v1.35’). Patch versions are automatically applied by CKS as they are released.
• vpc_id (String) The ID of the VPC in which the cluster is located. Must be a VPC in the same Availability Zone as the cluster.
• zone (String) The Availability Zone in which the cluster is located.

​

Optional

• additional_server_sans (Set of String) Additional Subject Alternative Names (SANs) to include in the Kubernetes API server TLS certificate. Maximum 10 entries.
• audit_policy (String) Audit policy for the cluster. Must be provided as a base64-encoded JSON/YAML string.
• authn_webhook (Attributes) Authentication webhook configuration for the cluster. (see below for nested schema)
• authz_webhook (Attributes) Authorization webhook configuration for the cluster. (see below for nested schema)
• internal_lb_cidr_names_v6 (List of String) IPv6 Internal Load Balancer CIDR names. If any IPv6 field is set, then ALL IPv6 fields must be set.
• kube_api_access (Attributes) Access configuration for the cluster’s Kubernetes API server, independent of public. Before you set this attribute, contact CoreWeave support to enable this feature for your organization. When this attribute is omitted, the next apply clears any access configured outside Terraform. Changes, including clears, cannot be applied in the same update as a Kubernetes version change. (see below for nested schema)
• kubelet (String) Selective overrides applied to every cluster Node’s kubelet configuration, as a JSON object (e.g. jsonencode({ maxPods = 256 })). A Node reboot is required for changes to take effect, and unknown options are stored but ignored by CKS. See the Kubernetes kubelet configuration reference for supported options.
• node_port_range (Attributes) Kubernetes Service NodePort range. NodePort range can be expanded in existing clusters but not shrunk. Updating the NodePort range to a smaller range will require a replacement of the cluster. (see below for nested schema)
• oidc (Attributes) OpenID Connect (OIDC) configuration for authentication to the api-server. (see below for nested schema)
• pod_cidr_name_v6 (String) IPv6 Pod CIDR name. If any IPv6 field is set, then ALL IPv6 fields must be set.
• public (Boolean) Whether the cluster’s Kubernetes API server is reachable through CoreWeave’s public ingress, which supports CoreWeave-managed authentication. This setting is independent of kube_api_access.
• service_cidr_name_v6 (String) IPv6 Service CIDR name. If any IPv6 field is set, then ALL IPv6 fields must be set.
• shared_storage_cluster_id (String) The cluster_id of the cluster to share storage with. Must be enabled by CoreWeave support. Contact CoreWeave support if you are interested in this feature.
• tailscale (Attributes) Tailscale configuration for the cluster. Enables cluster access via a Tailscale VPN. (see below for nested schema)

​

Read-Only

• api_server_endpoint (String) The endpoint for the cluster’s api-server.
• id (String) The unique identifier of the cluster.
• kube_api_access_status (Attributes) Observed state of Kubernetes API access, known after apply and updated on refresh. Values may lag a configuration change until the API observes it. They are unknown during any in-place update plan, so providers configured from them receive unknown values during that plan. (see below for nested schema)
• service_account_oidc_issuer_url (String) The URL of the OIDC issuer for the cluster’s service account tokens. This value corresponds to the --service-account-issuer flag on the kube-apiserver.
• status (String) The current status of the cluster.

​

Nested Schema for authn_webhook

• server (String) The URL of the webhook server.

• ca (String) The CA certificate for the webhook server. Must be a base64-encoded PEM-encoded certificate.

​

Nested Schema for authz_webhook

• server (String) The URL of the webhook server.

• ca (String) The CA certificate for the webhook server. Must be a base64-encoded PEM-encoded certificate.

​

Nested Schema for kube_api_access

• public (Attributes) Direct public access to the Kubernetes API server. A present public object, including {}, enables access. Omitting it or setting it to null disables access. CoreWeave-managed authentication isn’t currently supported on this endpoint. Kubernetes authentication and authorization still apply. (see below for nested schema)

​

Nested Schema for kube_api_access.public

• allow_cidrs (Set of String) Source network prefixes allowed to reach the endpoint. An empty set allows all sources, subject to deny_cidrs. A non-empty set denies every other source, so 0.0.0.0/0 alone allows only IPv4 sources and ::/0 alone allows only IPv6 sources. At most 1024 entries. Each must be an IPv4 or IPv6 network address with no host bits set, such as 203.0.113.0/24.
• deny_cidrs (Set of String) Source network prefixes denied access to the endpoint. Entries take precedence over allow_cidrs. At most 1024 entries. Each must be an IPv4 or IPv6 network address with no host bits set, such as 203.0.113.0/24.

​

Nested Schema for node_port_range

• end (Number)
• start (Number)

​

Nested Schema for oidc

• client_id (String) The client ID for the OIDC client.
• issuer_url (String) The URL of the OIDC issuer.

• admin_group_binding (String) The OIDC group that is bound to the cluster-admin role for bootstrap access to the cluster.
• ca (String) The CA certificate for the OIDC issuer. Must be a base64-encoded PEM-encoded certificate.
• groups_claim (String) The claim to use as the groups.
• groups_prefix (String) The prefix to use for the groups.
• required_claim (String) The claim to require for authentication.
• signing_algs (Set of String) A list of signing algorithms that the OpenID Connect discovery endpoint uses.
• username_claim (String) The claim to use as the username.
• username_prefix (String) The prefix to use for the username.

​

Nested Schema for tailscale

• client_id (String) The Tailscale Client ID for the federated identity.

​

Nested Schema for kube_api_access_status

• ca_data (String) The base64-encoded PEM CA bundle for the Kubernetes API server. Use base64decode() to obtain the PEM text. null until the API reports a CA.
• public (Attributes) Observed state of direct public access. null when the API reports no public access status. (see below for nested schema)

​

Nested Schema for kube_api_access_status.public

• endpoint (String) The HTTPS URL of the public Kubernetes API endpoint, suitable for a kubeconfig server. null until the endpoint is available.
• status (String) Acceptance of the endpoint’s route and access policy. The value is one of the following: STATUS_UNSPECIFIED, STATUS_UNKNOWN, STATUS_PENDING, STATUS_ACCEPTED, STATUS_REJECTED, STATUS_ERROR. STATUS_ACCEPTED does not confirm that the endpoint is reachable or that CIDR rules are enforced.

​

Import

terraform import coreweave_cks_cluster.default {{id}}

import {
  to = coreweave_cks_cluster.default
  id = "{{id}}"
}