Managed Authentication in CKS

This page explains how Managed Authentication generates Kubeconfig files for CoreWeave Kubernetes Service (CKS) clusters, describes the fields in a generated file, and lists common authentication errors and how to resolve them. In Kubernetes, Kubeconfig files are YAML configuration files that manage access to Kubernetes clusters. They specify the details needed to authenticate and interact with the cluster’s API server. With a Kubeconfig file, you can run commands without repeatedly providing connection details or credentials. Managed Auth generates Kubeconfig files for your CKS clusters from the Cloud Console. These Kubeconfig files follow the permissions configured for their related tokens and automatically embed the API Access Token. To generate a Kubeconfig file, follow the instructions in Manage API Access Tokens and Kubeconfig Files. The following example shows a Kubeconfig file generated by Managed Auth in the Cloud Console:

apiVersion: v1
clusters:
- cluster:
    server: https://api-server.url.com
  name: my-cluster
contexts:
- context:
    cluster: my-cluster
    namespace: my-namespace
    user: token
  name: my-cluster
current-context: my-cluster
kind: Config
preferences: {}
users:
- name: token
  user:
    token: REDACTED

Generated Kubeconfig files contain the following values and might include additional values:

Field	Description
`apiVersion`	The API group version
`clusters`	Connection settings for the target cluster, including the API server addresses
`clusters.cluster.server`	API server addresses
`clusters.cluster.name`	The cluster name
`contexts`	The Kubernetes context containing the related cluster, user, and namespace name
`contexts.context.cluster`	The cluster associated with the context
`contexts.context.namespace`	The namespace associated with the context
`contexts.context.user`	The user associated with the context, in this case an API Access Token (`token`)
`users`	A list of “users” associated with the context, in this case the API Access Token (`token`)
`users.name`	The name of the user, in this case the Access Token, `token`
`users.user.token`	The actual Access Token value

Authentication errors

The following errors can occur when you use a Managed Auth Kubeconfig file. For a complete guide to choosing an authentication method, see the Introduction to authentication and access control.

Error or symptom	What it means and how to resolve it
`403 Forbidden` on every request, often with an empty response body and messages such as `couldn't get current server API group list` or `Error from server (Forbidden)`	The API Access Token is missing, malformed, expired, or revoked. Tokens have an expiration date, so a token that worked previously can expire between sessions. Reissue the token and download a new Kubeconfig file from the Access Tokens dashboard in the Cloud Console. See Manage API Access Tokens and Kubeconfig Files.
`403 Forbidden` on specific actions	The token is valid, but it lacks the permissions for the action. API Access Tokens are user-scoped and inherit the token owner’s IAM roles. Review the owner’s assigned roles in IAM Access Policies. The Access Tokens dashboard only lists and deletes tokens, so it doesn’t show or configure permissions.
The `certificate-authority-data` field is present on a new cluster	The managed endpoint uses a publicly trusted certificate, so the `certificate-authority-data` field is unnecessary and can cause connection errors. Don’t set this field in a Kubeconfig file for a new managed cluster. Use the Kubeconfig file generated by the Cloud Console as is.

The managed endpoint returns 403 Forbidden for token problems, not 401 Unauthorized. A 401 on a CKS cluster points to an OIDC or unmanaged authentication issue instead. If several users share one token, its expiration or revocation blocks all of them at once. Give each user their own token.

​Authentication errors

Authentication errors