Skip to main content
In CKS, unmanaged authentication refers to the use of user identities and credentials that aren’t managed within the CoreWeave cloud platform.

​
API endpoint

CKS provides a Kubernetes API endpoint for implementing unmanaged authentication. This endpoint lets you authenticate with the Kubernetes API without relying on CoreWeave’s Managed Auth service. Each CKS cluster exposes a managed and an unmanaged endpoint. The unmanaged endpoint adds an api. prefix to the cluster’s apiServerEndpoint, and it’s the only endpoint that accepts unmanaged credentials such as OIDC, Service Account, and webhook tokens. Without the prefix, kubectl connects to the managed endpoint, which rejects those tokens. To learn how to construct and verify the endpoint URL, see Implement unmanaged authentication. Use this endpoint if you prefer to manage your own authentication mechanisms for CKS clusters, such as OIDC, Service Account tokens, and authentication webhooks. The endpoint provides flexibility if you have specific authentication requirements that can’t be met through CoreWeave-managed authentication. The unmanaged auth API endpoint works best in the following scenarios:
  • OIDC authentication: Integrate standard OIDC IdPs for authentication to your CKS clusters.
  • Service Account authentication: Use Kubernetes Service Account tokens to authenticate with your CKS clusters.
  • Custom authentication providers: Integrate with enterprise identity systems not supported by standard OIDC.
  • Multi-factor authentication: Implement custom MFA workflows.
Unmanaged auth can be configured on existing clusters without requiring cluster recreation.

​
Customer-managed webhook authentication

If you use webhook authentication, you operate the webhook service. When its TLS certificate expires, every authentication request through that webhook fails. A sudden cluster-wide authentication outage with no configuration change is a strong signal that a webhook TLS certificate expired. Monitor the certificate and renew it before expiry. To learn how to implement unmanaged auth, see Implement unmanaged authentication.
Last modified on July 31, 2026