coreweave-enterprise-rbac

name	coreweave-enterprise-rbac
description	Configure RBAC and namespace isolation for CoreWeave multi-team GPU access. Use when managing team permissions, isolating GPU quotas, or implementing namespace-level access control. Trigger with phrases like "coreweave rbac", "coreweave permissions", "coreweave namespace isolation", "coreweave team access".
allowed-tools	Read, Write, Edit, Bash(kubectl:*), Grep
version	1.11.0
license	MIT
author	Jeremy Longshore <[e-mail]>
tags	["saas","gpu-cloud","kubernetes","inference","coreweave"]
compatibility	Designed for Claude Code

CoreWeave Enterprise RBAC

Community-contributed. Not affiliated with, endorsed by, or sponsored by CoreWeave, Inc. CoreWeave is a registered trademark of CoreWeave, Inc.

Overview

CoreWeave runs GPU workloads on Kubernetes, so RBAC maps directly to K8s namespace isolation and ResourceQuotas. Each team gets a dedicated namespace with GPU limits, storage caps, and network policies. This prevents noisy-neighbor problems where one team's training job starves another's inference service. SOC 2 and HIPAA workloads require namespace-level audit logging and team-scoped API key rotation.

Role Hierarchy

Role	Permissions	Scope
Cluster Admin	Full CKS control, namespace creation, quota management	All namespaces
Team Lead	Deploy workloads, manage team API keys, adjust pod limits	Own namespace
ML Engineer	Launch jobs, access PVCs, view logs	Own namespace
Inference Operator	Deploy/scale inference endpoints, read metrics	Own namespace
Viewer	Read-only pod status, logs, GPU utilization metrics	Own namespace

Permission Check

import { KubeConfig, RbacAuthorizationV1Api } from '@kubernetes/client-node';

async function checkNamespaceAccess(user: string, namespace: string, verb: string, resource: string): Promise<boolean> {
  const kc = new KubeConfig();
  kc.loadFromDefault();
  const rbac = kc.();
   review = { : , : ,
    : { user, : { namespace, verb, resource } } };
   result =  rbac.(review);
   result..?. ?? ;
}