coreweave_sandbox_managed_runner (Resource)

​

Example usage

# Requires a Sandbox API deployment implementing full v1 managed-runner CRUD.
# Configure COREWEAVE_API_TOKEN with sandbox_admin access. COREWEAVE_API_ENDPOINT
# can select a different API deployment when needed.
provider "coreweave" {}

variable "cluster_id" {
  type        = string
  description = "CKS cluster UUID for the managed runner."
}

variable "zone" {
  type        = string
  description = "Cluster geographic zone, for example us-east-04a."
}

resource "coreweave_sandbox_managed_runner" "development" {
  runner_id       = "development"
  runner_group_id = "engineering"
  display_name    = "Engineering development"
  cluster_id      = var.cluster_id
  # The Sandbox API returns lowercase zones; normalize values supplied by CKS.
  zone = lower(var.zone)

  spec = {
    release_channel = "RELEASE_CHANNEL_STABLE"
    maintenance_policy = {
      windows = [{ cron = "0 2 * * SAT", duration_seconds = 3600 }]
    }
    overrides = {
      resources = {
        cpu_request    = "1"
        memory_request = "2Gi"
        cpu_limit      = "4"
        memory_limit   = "8Gi"
      }
      scaling = { replicas = 2 }
    }
    image_pull = { policy = "SANDBOX_IMAGE_PULL_POLICY_ALWAYS" }
    volumes = {
      enabled              = true
      csi_driver_allowlist = ["csi.vastdata.com"]
    }
    data_plane = { disabled = true }
  }

  policy = {
    display_name = "Development constraints"
    constraints = {
      resources = {
        default_cpu    = "1"
        default_memory = "2Gi"
        max_cpu        = "8"
        max_memory     = "32Gi"
        max_gpu_count  = 0 # Explicitly forbid GPUs; omitting this removes the cap.
      }
      lifecycle = { default_lifetime_seconds = 3600 }
      volumes   = { max_size = "100Gi" }
    }
    # To restrict public API sources, supply your organization's actual CIDRs:
    # control_plane_access = {
    #   source_ip_allowlist = { cidrs = ["203.0.113.0/24"] }
    # }
    # source_ip_allowlist = {} denies every public source. Omitting the
    # source_ip_allowlist object leaves source IP access unrestricted.
  }
}

​

Schema

​

Required

• cluster_id (String) CKS cluster UUID. Changing it replaces the runner.
• policy (Attributes) Policy governing every sandbox on this runner. Required even for the explicit empty posture policy = {}. Policy is updated with an etag to detect concurrent changes. (see below for nested schema)
• runner_id (String) Operator-assigned runner identifier, unique within the authenticated organization. Changing it replaces the runner.
• zone (String) Lowercase geographic zone of the runner, for example us-east-04a. Use lower(coreweave_cks_cluster.example.zone) when referencing a CKS cluster zone. Changing it replaces the runner.

​

Optional

• display_name (String) Human-readable runner name.
• runner_group_id (String) Runner group for scheduling affinity. Defaults to default; omitting or setting this attribute to null resets a custom group to default.
• spec (Attributes) Desired runner configuration. When omitted, the server’s defaults are adopted. Removing an optional setting inside this object resets that setting through an explicit update mask. (see below for nested schema)

​

Read-Only

• active_config_version (String) Configuration version currently running.
• active_revision (Number) Revision currently running.
• cluster_name (String) Cluster display name resolved by the server.
• connection_status (String) Observed live connection status.
• create_time (String) Creation timestamp (RFC 3339).
• data_plane_status (String) Observed direct endpoint state, URI, protocols, and certificate expiry as JSON, or null.
• deployment_spec (String, Sensitive) Resolved deployment configuration as JSON. Read-only; use spec.overrides to change supported settings.
• etag (String) Opaque policy revision used for optimistic concurrency. A concurrent policy edit fails the apply; refresh the plan before retrying.
• id (String) Terraform resource ID, equal to runner_id within the authenticated organization.
• install_error (String) Structured installation failure details as JSON, or null.
• install_status (String) Observed installation status.
• last_heartbeat_time (String) Last runner heartbeat timestamp (RFC 3339).
• rollout_in_progress (Boolean) Whether a newer desired revision is still rolling out.
• target_revision (Number) Desired deployment revision.
• update_available (Boolean) Whether a newer version is available on the release channel.
• update_time (String) Last configuration update timestamp (RFC 3339).

​

Nested Schema for policy

• base (String, Sensitive) Runtime defaults and attachments as a JSON object, for example jsonencode({ ... }). Typed constraints belong in constraints. Values are stored in Terraform state.
• constraints (Attributes) Typed constraints applied to the resolved sandbox specification. Omitted groups impose no constraint of that kind; individual security allowlists remain fail-closed. (see below for nested schema)
• control_plane_access (Attributes) Request-time controls in addition to authentication and tenant authorization. (see below for nested schema)
• display_name (String) Human-readable policy name.

​

Nested Schema for policy.constraints

• image (Attributes) Image restrictions. (see below for nested schema)
• instance (Attributes) Node instance-type restrictions. (see below for nested schema)
• lifecycle (Attributes) Lifetime defaults. (see below for nested schema)
• metadata (Attributes) Annotation restrictions. (see below for nested schema)
• network (Attributes) Network envelopes and defaults. Empty allowed envelopes impose no restriction. (see below for nested schema)
• resources (Attributes) Per-container bounds, defaults, and whole-sandbox ceilings. (see below for nested schema)
• security (Attributes) Container privilege and runtime-class constraints. (see below for nested schema)
• volumes (Attributes) Sandbox volume restrictions. (see below for nested schema)

​

Nested Schema for policy.constraints.image

• allowed_images (Set of String) Allowed image references. Empty permits any image within the registry restrictions.
• allowed_registries (Set of String) Allowed registry prefixes. Empty permits any registry.

​

Nested Schema for policy.constraints.instance

• allowed_instance_types (Set of String) Allowed instance types. Empty permits any offered by the runner.

​

Nested Schema for policy.constraints.lifecycle

• default_lifetime_seconds (Number) Default sandbox lifetime in seconds; zero leaves the platform default. Maximum 30 days.

​

Nested Schema for policy.constraints.metadata

• denied_annotation_prefixes (Set of String) Rejected annotation key prefixes.
• max_annotation_count (Number) Maximum annotations; zero means no limit.

​

Nested Schema for policy.constraints.network

• allowed_egress (Attributes List) Allowed egress envelope. HTTPS hostname wildcard * is permitted here. Select exactly one peer kind per rule. (see below for nested schema)
• allowed_ingress (Attributes List) Allowed ingress sources for custom-visibility ports. Select exactly one peer kind per rule. (see below for nested schema)
• default_egress (Attributes List) Egress applied when the sandbox specifies none. HTTPS hostname destinations are not permitted here. Select exactly one peer kind per rule. (see below for nested schema)
• default_ingress (Attributes List) Ingress applied when the sandbox specifies none. Select exactly one peer kind per rule. (see below for nested schema)
• deny_dns (Boolean, Deprecated) Deprecated alias for deny_https_hostname_rules. Does not disable DNS resolution.
• deny_https_hostname_rules (Boolean) Forbid hostname-based HTTPS egress grants. Does not disable DNS resolution.
• dns_egress (String) Outbound DNS traffic ceiling on UDP/TCP port 53. Unspecified permits DNS; DENY requires sandboxes to block it. Independent of hostname-based HTTPS grants. Values: DNS_EGRESS_MODE_ALLOW, DNS_EGRESS_MODE_DENY.

​

Nested Schema for policy.constraints.network.allowed_egress

• any (Boolean) Set to true to select any address-shaped peer.
• cidr (Attributes) CIDR range with optional carve-outs. (see below for nested schema)
• dns_name (String, Deprecated) Deprecated alias for https_hostname.
• dns_name_except (Set of String, Deprecated) Deprecated alias for https_hostname_except.
• https_hostname (String) Exact HTTPS hostname or a single leftmost wildcard label; * is allowed only in allowed_egress.
• https_hostname_except (Set of String) Hostnames excluded from an allowed_egress HTTPS envelope.
• ports (Attributes List) Allowed ports. Empty means all ports, except HTTPS hostname destinations which use HTTPS (TCP 443). (see below for nested schema)
• selector (Attributes) Explicit entitlement to reach cluster workloads by label. (see below for nested schema)
• tenant (String) Relational tenant selection. Values: TENANT_SCOPE_SAME_USER, TENANT_SCOPE_SAME_ORG, TENANT_SCOPE_SANDBOX_NETWORK.

​

Nested Schema for policy.constraints.network.allowed_egress.cidr

• cidr (String) IPv4 or IPv6 CIDR.

• except (Set of String) Excluded subranges.

​

Nested Schema for policy.constraints.network.allowed_egress.ports

• port (Number) Starting port.

• end_port (Number) Inclusive end port; zero or omitted means a single port.
• protocol (String) TCP (default), UDP, or SCTP.

​

Nested Schema for policy.constraints.network.allowed_egress.selector

• pod_labels (Map of String) Pod labels to match (at least one required).

• namespace_labels (Map of String) Namespace labels to match. Omitted means the sandbox’s own namespace.

​

Nested Schema for policy.constraints.network.allowed_ingress

• any (Boolean) Set to true to select any address-shaped peer.
• cidr (Attributes) CIDR range with optional carve-outs. (see below for nested schema)
• ports (Attributes List) Allowed ports. Empty means all ports, except HTTPS hostname destinations which use HTTPS (TCP 443). (see below for nested schema)
• tenant (String) Relational tenant selection. Values: TENANT_SCOPE_SAME_USER, TENANT_SCOPE_SAME_ORG, TENANT_SCOPE_SANDBOX_NETWORK.

​

Nested Schema for policy.constraints.network.allowed_ingress.cidr

• cidr (String) IPv4 or IPv6 CIDR.

• except (Set of String) Excluded subranges.

​

Nested Schema for policy.constraints.network.allowed_ingress.ports

• port (Number) Starting port.

• end_port (Number) Inclusive end port; zero or omitted means a single port.
• protocol (String) TCP (default), UDP, or SCTP.

​

Nested Schema for policy.constraints.network.default_egress

• any (Boolean) Set to true to select any address-shaped peer.
• cidr (Attributes) CIDR range with optional carve-outs. (see below for nested schema)
• dns_name (String, Deprecated) Deprecated alias for https_hostname.
• dns_name_except (Set of String, Deprecated) Deprecated alias for https_hostname_except.
• https_hostname (String) Exact HTTPS hostname or a single leftmost wildcard label; * is allowed only in allowed_egress.
• https_hostname_except (Set of String) Hostnames excluded from an allowed_egress HTTPS envelope.
• ports (Attributes List) Allowed ports. Empty means all ports, except HTTPS hostname destinations which use HTTPS (TCP 443). (see below for nested schema)
• selector (Attributes) Explicit entitlement to reach cluster workloads by label. (see below for nested schema)
• tenant (String) Relational tenant selection. Values: TENANT_SCOPE_SAME_USER, TENANT_SCOPE_SAME_ORG, TENANT_SCOPE_SANDBOX_NETWORK.

​

Nested Schema for policy.constraints.network.default_egress.cidr

• cidr (String) IPv4 or IPv6 CIDR.

• except (Set of String) Excluded subranges.

​

Nested Schema for policy.constraints.network.default_egress.ports

• port (Number) Starting port.

• end_port (Number) Inclusive end port; zero or omitted means a single port.
• protocol (String) TCP (default), UDP, or SCTP.

​

Nested Schema for policy.constraints.network.default_egress.selector

• pod_labels (Map of String) Pod labels to match (at least one required).

• namespace_labels (Map of String) Namespace labels to match. Omitted means the sandbox’s own namespace.

​

Nested Schema for policy.constraints.network.default_ingress

• any (Boolean) Set to true to select any address-shaped peer.
• cidr (Attributes) CIDR range with optional carve-outs. (see below for nested schema)
• ports (Attributes List) Allowed ports. Empty means all ports, except HTTPS hostname destinations which use HTTPS (TCP 443). (see below for nested schema)
• tenant (String) Relational tenant selection. Values: TENANT_SCOPE_SAME_USER, TENANT_SCOPE_SAME_ORG, TENANT_SCOPE_SANDBOX_NETWORK.

​

Nested Schema for policy.constraints.network.default_ingress.cidr

• cidr (String) IPv4 or IPv6 CIDR.

• except (Set of String) Excluded subranges.

​

Nested Schema for policy.constraints.network.default_ingress.ports

• port (Number) Starting port.

• end_port (Number) Inclusive end port; zero or omitted means a single port.
• protocol (String) TCP (default), UDP, or SCTP.

​

Nested Schema for policy.constraints.resources

• cpu_ceiling (String) Sum-of-requests CPU ceiling across the sandbox.
• default_cpu (String) Default CPU per container. When a container declares neither requests nor limits, a positive default also sets its CPU limit.
• default_memory (String) Default memory per container. When a container declares neither requests nor limits, a positive default also sets its memory limit.
• max_cpu (String) Maximum CPU per container, as a Kubernetes quantity.
• max_gpu_count (Number) Maximum GPUs per container. Omitted means no cap; explicit zero forbids GPUs.
• max_memory (String) Maximum memory per container.
• memory_ceiling (String) Sum-of-requests memory ceiling across the sandbox.
• min_cpu (String) Minimum CPU per container.
• min_memory (String) Minimum memory per container.
• require_limits (Boolean) Require every container to have requests and limits after defaults are applied.

​

Nested Schema for policy.constraints.security

• allow_privileged (Boolean) Permit privileged containers.
• allowed_capabilities (Set of String) Linux capabilities containers may add. Empty permits none beyond defaults.
• allowed_runtime_classes (Set of String) Runtime classes callers may explicitly select. Empty forbids caller-selected runtime classes. Cannot be combined with runtime_class_mappings.
• allowed_seccomp_profiles (Set of String) Permitted seccomp profiles, such as RuntimeDefault or Unconfined.
• default_cpu_runtime_class (String) Default CPU runtime class. Must fit a nonempty runtime-class allowlist. Cannot be combined with runtime_class_mappings.
• default_gpu_runtime_class (String) Default GPU runtime class. Must fit a nonempty runtime-class allowlist. Cannot be combined with runtime_class_mappings.
• runtime_class_mappings (Attributes Set) Bindings from portable runtime classes to concrete runtimes. A non-empty set switches the runner to mappings: a mapped class is available both for caller selection and as the automatic CPU or GPU default, an unmapped class is unavailable, and callers cannot pin a concrete runtime class. Omitting a default class disables automatic selection for that resource family. Each class appears at most once. Cannot be combined with allowed_runtime_classes, default_cpu_runtime_class, or default_gpu_runtime_class. (see below for nested schema)

​

Nested Schema for policy.constraints.security.runtime_class_mappings

• runtime_class (String) Portable runtime class provided by the target. Values: RUNTIME_CLASS_CPU_DEFAULT, RUNTIME_CLASS_CPU_NESTED_VIRT, RUNTIME_CLASS_CPU_SNAPSHOT_RESTORE, RUNTIME_CLASS_GPU_DEFAULT.

• kubernetes_runtime_class_name (String) Kubernetes RuntimeClass name. Set exactly one of kubernetes_runtime_class_name or node_default.
• node_default (Boolean) Set to true to use the node’s default container runtime. Permitted only for RUNTIME_CLASS_CPU_DEFAULT and RUNTIME_CLASS_GPU_DEFAULT, and only serves CKS-mode placement outside the shared serverless pool.

​

Nested Schema for policy.constraints.volumes

• allowed_media (Set of String) Allowed storage media. Empty permits any.
• max_size (String) Maximum size per volume, for example 100Gi.

​

Nested Schema for policy.control_plane_access

• source_ip_allowlist (Attributes) Public source IP restriction. A present empty object denies every public source; an absent object imposes no source IP restriction. (see below for nested schema)

​

Nested Schema for policy.control_plane_access.source_ip_allowlist

• cidrs (Set of String) Canonical, nonredundant IPv4/IPv6 prefixes (at most 256). Do not include a prefix already covered by another entry. An empty set denies every public source. Omitting the enclosing source_ip_allowlist leaves access unrestricted.

​

Nested Schema for spec

• data_plane (Attributes) Direct sandbox data endpoint. Select exactly one of disabled, cluster_ip, load_balancer, or custom. Certificates are managed by the platform. (see below for nested schema)
• enforce_resource_limits (Boolean) Require sandboxes to declare both memory and CPU limits.
• image_pull (Attributes) Workload container image pull behavior. (see below for nested schema)
• maintenance_policy (Attributes) Update scheduling in UTC. Exclusions take precedence over windows. (see below for nested schema)
• overrides (Attributes) Customer-settable runner deployment overrides. (see below for nested schema)
• release_channel (String) Automatic update channel. Defaults to stable. Values: RELEASE_CHANNEL_STABLE, RELEASE_CHANNEL_RAPID.
• tenant_metrics (Attributes) Per-sandbox tenant usage collection. Overrides corresponding deployment environment entries. (see below for nested schema)
• volumes (Attributes) Registered volume support. These settings take precedence over corresponding deployment environment entries. (see below for nested schema)

​

Nested Schema for spec.data_plane

• cluster_ip (Attributes) Expose through a ClusterIP service. (see below for nested schema)
• custom (Attributes) Advertise a customer-managed network path. (see below for nested schema)
• disabled (Boolean) Set to true to explicitly disable the direct endpoint.
• load_balancer (Attributes) Expose through an L4 load balancer forwarding mutual TLS to the runner. (see below for nested schema)

​

Nested Schema for spec.data_plane.cluster_ip

• annotations (Map of String) Service annotations.

​

Nested Schema for spec.data_plane.custom

• advertised_uri (String) Stable absolute URI returned to direct clients.

• service_annotations (Map of String) Annotations on the backing ClusterIP service.

​

Nested Schema for spec.data_plane.load_balancer

• annotations (Map of String) Service annotations.
• external_traffic_policy (String) External traffic policy. Values: RUNNER_DATA_PLANE_EXTERNAL_TRAFFIC_POLICY_CLUSTER, RUNNER_DATA_PLANE_EXTERNAL_TRAFFIC_POLICY_LOCAL.
• hostname (String) Endpoint DNS name included in the server certificate. The platform may assign one when empty.
• load_balancer_class (String) Kubernetes load balancer class.
• scope (String) Load balancer scope. Values: RUNNER_DATA_PLANE_SERVICE_SCOPE_PUBLIC, RUNNER_DATA_PLANE_SERVICE_SCOPE_PRIVATE.
• source_ranges (Set of String) Allowed client source CIDRs.

​

Nested Schema for spec.image_pull

• policy (String) Image pull policy. The platform default is IF_NOT_PRESENT. ALWAYS reauthorizes pull credentials on every start. Values: SANDBOX_IMAGE_PULL_POLICY_IF_NOT_PRESENT, SANDBOX_IMAGE_PULL_POLICY_ALWAYS.

​

Nested Schema for spec.maintenance_policy

• exclusions (Attributes List) One-time periods during which updates cannot start. (see below for nested schema)
• windows (Attributes List) Recurring update windows. An empty list permits updates at any time outside exclusions. (see below for nested schema)

​

Nested Schema for spec.maintenance_policy.exclusions

• end_time (String) Exclusive RFC 3339 end timestamp, after start_time.
• start_time (String) Inclusive RFC 3339 start timestamp.

• reason (String) Reason for the exclusion.

​

Nested Schema for spec.maintenance_policy.windows

• cron (String) Five-field cron expression in UTC, for example 0 2 * * SAT.
• duration_seconds (Number) Window duration in seconds (60-604800).

​

Nested Schema for spec.overrides

• annotations (Map of String) Annotations on runner pods.
• args (List of String) Ordered runner command-line arguments.
• cpu_runtime_class (String) Runtime class for CPU sandboxes.
• env (Map of String, Sensitive) Runner environment overrides. Values are stored in Terraform state; use a protected state backend.
• gpu_runtime_class (String) Runtime class for GPU sandboxes.
• labels (Map of String) Labels on runner pods.
• node_selector (Map of String) Node label selectors for the runner deployment.
• resources (Attributes) CPU and memory requests and limits for runner pods, as Kubernetes quantities. (see below for nested schema)
• scaling (Attributes) Runner replica and autoscaling configuration. (see below for nested schema)
• tolerations (Attributes List) Kubernetes tolerations for runner pods. (see below for nested schema)

​

Nested Schema for spec.overrides.resources

• cpu_limit (String) CPU limit.
• cpu_request (String) CPU request.
• memory_limit (String) Memory limit.
• memory_request (String) Memory request.

​

Nested Schema for spec.overrides.scaling

• autoscaling_enabled (Boolean) Enable runner autoscaling.
• max_replicas (Number) Maximum replicas.
• min_replicas (Number) Minimum replicas.
• replicas (Number) Desired replicas when autoscaling is disabled.

​

Nested Schema for spec.overrides.tolerations

• effect (String) Taint effect. Empty matches all effects.
• key (String) Taint key.
• operator (String) Toleration operator (Equal or Exists).
• value (String) Taint value.

​

Nested Schema for spec.tenant_metrics

• enabled (Boolean) Enable the tenant metrics collector.
• image (String) Release-pinned collector image. Empty retains the deployment environment’s image.

​

Nested Schema for spec.volumes

• csi_driver_allowlist (Set of String) Allowed CSI drivers. Empty uses the platform default (csi.vastdata.com).
• enabled (Boolean) Enable registered volume mounts; the runner’s PVC/PV permission preflight must also pass.

​

Import

# Import a runner by runner_id within the authenticated organization.
terraform import coreweave_sandbox_managed_runner.development development