Prerequisites
- A CKS cluster with OIDC Workload Identity enabled.
- An AI Object Storage bucket. For setup instructions, see Get started with AI Object Storage.
- Appropriate IAM roles (for example, CKS Admin and Object Storage Admin) assigned through an IAM Access Policy.
Authentication methods
CKS Workload Federation supports two methods for authenticating to AI Object Storage:- Automatic using the Pod Identity Webhook, which is recommended for most use cases.
- Manual by configuring the OIDC Workload Federation manually, which is useful for debugging or when the Pod Identity Webhook isn’t available.
How the three authorization systems relate
CoreWeave uses separate authorization systems that apply at different stages of this setup:| System | What it controls | When it applies in this flow |
|---|---|---|
| CoreWeave IAM Access Policies | Who can manage the platform and Object Storage control plane (create clusters, create buckets, edit org policies, create WIF config). The Object Storage Admin role doesn’t grant S3 data access. | You need appropriate IAM roles (for example, CKS Admin, Object Storage Admin) to create the cluster, configure OIDC Workload Federation, and manage org and bucket policies. |
| Kubeconfig and Kubernetes RBAC | A kubeconfig is a config file with the cluster server URL and an API key (the same type used for other CoreWeave APIs). No separate kubeconfig permissions are required. Kubernetes RBAC controls what you can do inside the cluster (for example, creating Pods and service accounts). | You use a kubeconfig to run kubectl and create the workload. The API key authenticates you to the cluster, and Kubernetes RBAC authorizes your requests. |
| AI Object Storage org and bucket access policies | Who can perform S3 operations (read or write objects, list buckets). Principals include federated OIDC roles such as role/[ISSUER]:system:serviceaccount:namespace:name. | When a Pod uses OIDC to obtain temporary S3 credentials, only org and bucket policies are evaluated for that Pod’s S3 requests. IAM and kubeconfig aren’t checked. |