Managed Authentication in CKS

Use this page to understand the kubeconfig files that Managed Auth generates for CoreWeave Kubernetes Service (CKS) clusters, including the fields in a generated file and common authentication errors. To create an API access token and download a kubeconfig file, see Manage API access tokens and kubeconfig files. For an overview of Managed Auth across CoreWeave, see Managed Auth.

Generated kubeconfig structure

Managed Auth generates kubeconfig files for your CKS clusters from the Cloud Console. These files follow the permissions configured for their related tokens and embed the API access token. The following example shows a kubeconfig file generated by Managed Auth:

apiVersion: v1
clusters:
- cluster:
    server: https://api-server.url.com
  name: my-cluster
contexts:
- context:
    cluster: my-cluster
    namespace: my-namespace
    user: token
  name: my-cluster
current-context: my-cluster
kind: Config
preferences: {}
users:
- name: token
  user:
    token: REDACTED

Generated kubeconfig files contain the following values and might include additional values:

Field	Description
`apiVersion`	The API group version.
`clusters`	Connection settings for the target cluster, including the API server URL.
`clusters.cluster.server`	The API server URL.
`clusters.cluster.name`	The cluster name.
`contexts`	The Kubernetes context containing the related cluster, user, and namespace name.
`contexts.context.cluster`	The cluster associated with the context.
`contexts.context.namespace`	The namespace associated with the context.
`contexts.context.user`	The user associated with the context, in this case an API access token (`token`).
`users`	A list of users associated with the context, in this case the API access token (`token`).
`users.name`	The name of the user, in this case the API access token, `token`.
`users.user.token`	The API access token value.

Authentication errors

The following errors can occur when you use a Managed Auth kubeconfig file. For help choosing an authentication method, see Introduction to authentication and access control.

Error or symptom	What it means and how to resolve it
`403 Forbidden` on every request, often with an empty response body and messages such as `couldn't get current server API group list` or `Error from server (Forbidden)`	The API access token is missing, malformed, expired, or revoked. Tokens have an expiration date, so a token that worked previously can expire between sessions. Reissue the token and download a new kubeconfig file from the Access Tokens dashboard in the Cloud Console. See Manage API access tokens and kubeconfig files.
`403 Forbidden` on specific actions	The token is valid, but it lacks the permissions for the action. API access tokens are user-scoped and inherit the token owner’s IAM roles. Review the owner’s assigned roles in IAM Access Policies. The Access Tokens dashboard only lists and deletes tokens, so it doesn’t show or configure permissions.
The `certificate-authority-data` field is present on a new cluster	The managed endpoint uses a publicly trusted certificate, so the `certificate-authority-data` field is unnecessary and can cause connection errors. Don’t set this field in a Managed Auth kubeconfig file for a new cluster. Use the kubeconfig file generated by the Cloud Console without changes. Clients that connect through a TLS-passthrough path, such as the Traefik API proxy or the Tailscale proxy in Direct Auth mode, reach the API server directly. Those clients must trust the cluster certificate authority (CA) and authenticate with a Kubernetes-native credential, such as an OIDC token, because the API server rejects API access tokens.

The managed endpoint returns 403 Forbidden for token problems, not 401 Unauthorized. A 401 on a CKS cluster points to an OIDC or unmanaged authentication issue instead. If several users share one token, its expiration or revocation blocks all of them at once. Give each user their own token.

​Generated kubeconfig structure

​Authentication errors

Generated kubeconfig structure

Authentication errors