Container Service for Kubernetes:Delete kubeconfig files

Kubeconfig file overview

Kubeconfig files store credentials that are used by clients to access ACK clusters. You can use the ACK console or call the DescribeClusterUserKubeconfig API operation to query kubeconfig files. Securely manage kubeconfig confidentials to prevent leakage that may result in security exposures such as data breaches.

Status of kubeconfig files

The following table describes the status of the kubeconfig files used in ACK.

To revoke active kubeconfig credentials, verify their validity and necessity first. For example, delete kubeconfig files issued to partitioned employees individually to avoid invalidating valid credentials in active use. We recommend that you use ack-ram-authenticator for API server webhook authentication in an ACK managed cluster, enabling granular RBAC control and automatic revocation of kubeconfig credentials when associated RAM users/roles are deleted.

Kubeconfig file management

Example on managing kubeconfig files in clusters

1. Log on to the ACK console. In the left-side navigation pane, click Authorizations.

2. On the Authorizations page, click the KubeConfig File Management tab. Then, find the target cluster and click KubeConfig File Management in the Actions column to view users holding kubeconfig files and users with historical RBAC permissions from revoked kubeconfig files.

   If your account contains deleted RAM users/roles whose associated kubeconfig files remain active, the console will show a relevant notification.

   • User information: the username, user ID, account type, and account status.

   • Kubeconfig file information: the expiration date and status of the kubeconfig file.

3. After you confirm that the kubeconfig file of the current cluster held by a RAM user or RAM role is not used by any applications, click Delete KubeConfig File in the Actions column that corresponds to the RAM user or RAM role to delete the kubeconfig file.

   Important

   • Before deleting a kubeconfig file, ensure no operational dependencies exist. Otherwise, cluster API server access via this credential will be permanently disabled.

   • You are responsible for maintaining and managing kubeconfig files. Immediate revocation of compromised credentials is mandatory for security compliance.

   After you click Delete KubeConfig File, the system automatically checks the access records of the kubeconfig file within last 7 days from the API server audit logs. To use this feature, make sure that the cluster auditing feature of the API server is enabled. For more information, see Work with cluster auditing.

Example on managing kubeconfig files that are issued to RAM users or RAM roles

1. Log on to the ACK console. In the left-side navigation pane, click Authorizations.

2. On the Authorizations page, click the RAM Users tab, find the target RAM user, and click KubeConfig Management in the Actions column.

   The KubeConfig Management panel displays the status list of kubeconfig files across all clusters associated with this RAM user.

   • Cluster information: includes the name and ID of the cluster.

   • Kubeconfig file information: includes the expiration date and status of the kubeconfig file, and 7-day audit logs (specifically certificate access logs).

3. Delete the kubeconfig file of a cluster or delete the kubeconfig files of multiple clusters at a time. Before you delete a kubeconfig file, make sure that the kubeconfig file is not used by any applications.

   • Delete the kubeconfig file of a cluster: Find the cluster whose kubeconfig files you want to delete and click Delete KubeConfig File in the Actions column.

   • Delete the kubeconfig files of multiple clusters at a time: Select the clusters whose kubeconfig files you want to delete and click Delete KubeConfig File in the lower-left part of the panel.

     Important

     • Before deleting a kubeconfig file, ensure no operational dependencies exist. Otherwise, cluster API server access via this credential will be permanently disabled.

     • You are responsible for maintaining and managing kubeconfig files. Immediate revocation of compromised credentials is mandatory for security compliance.

     After you click Delete KubeConfig File, the system automatically checks the access records of the kubeconfig file within last 7 days from the API server audit logs. To use this feature, make sure that the cluster auditing feature of the API server is enabled. For more information, see Work with cluster auditing.

Example on deleting residual kubeconfig files

FAQs

What is 7-day access record check?

The 7-day access record check feature checks whether a kubeconfig file is used to access the corresponding cluster within the last 7 days. The check results are only for reference. You must make sure that the kubeconfig file to be deleted is not used by any applications.

To use this feature, make sure that the cluster auditing feature of the API server is enabled. For more information, see Work with cluster auditing.

How do I understand the seven-day access record check results?

In which scenarios am I unable to delete kubeconfig files?

• Abnormal cluster states: Do not delete the kubeconfig files of clusters that are in the Deletion Failed, Deleting, Deleted, and Failed states.

• Abnormal kubeconfig file or certificate states: Do not delete kubeconfig files that are in the Not Issued, Revoked, and Unknown states.

• You cannot delete kubecofig files held by you.

• You cannot delete kubeconfig files issued to Alibaba Cloud accounts.

Can I restore kubeconfig files that are accidentally deleted or restore a historical version of a kubeconfig file?

You can use the kubeconfig recycle bin to restore kubeconfig files that you accidentally deleted or restore a historical version of a kubeconfig file. For more information, see Use the kubeconfig recycle bin.

What is the best security practice for kubeconfig file management?

You need to manage accounts and credentials used to access ACK clusters and keep them confidential, such as AccessKey pairs of RAM users, tokens, and kubeconfig files. Follow the least privilege principle when you manage accounts and grant permissions on ACK clusters, and revoke permissions promptly. For example, after an employee resigns, you need to revoke the cluster access permissions from the account of the employee at the earliest opportunity. In addition, we recommend that you Use ack-ram-authenticator for API server webhook authentication in an ACK managed cluster so that the kubeconfig files and RBAC permissions of a RAM user or RAM role can be automatically revoked after the RAM user or RAM role is deleted.

References

If an employee leaves the company or a kubeconfig file is suspected to be leaked, you can revoke the kubeconfig file and generate a new kubeconfig file. For more information, see Revoke the kubeconfig file of a cluster.