ACK issues kubeconfig credentials for Alibaba Cloud accounts, RAM users, and RAM roles. Use kubeconfig management to view issued credentials at the cluster or user level and revoke risky or unused kubeconfig files to prevent unauthorized API server access.
Manage kubeconfig credentials securely. Revoke compromised credentials immediately. See shared responsibility model.
Use ack-ram-authenticator for API server webhook authentication in an ACK managed cluster for granular RBAC control and automatic credential revocation when RAM users or roles are deleted.
Kubeconfig files expire on a defined schedule and automatically revoke access. See How do I query the expiration date of the certificate used in a kubeconfig file?
Kubeconfig file statuses
| Status | Description |
|---|---|
| Not Issued | No kubeconfig file has been issued to the RAM user or role for this cluster. |
| Effective | Issued and valid. Also applies when the kubeconfig file is deleted but RBAC permissions are not revoked. |
| Expired | Issued but expired. |
| Deleted | Issued and deleted. Both kubeconfig information and RBAC binding are removed. |
Impact of deleting a kubeconfig file
Review the consequences before deleting a kubeconfig file:
| What happens | Details |
|---|---|
| Credential is permanently invalidated | API server access through this kubeconfig file is permanently disabled. |
| RBAC binding is removed | Both kubeconfig information and RBAC binding of the RAM user or role are removed. |
| 7-day access check runs automatically | The system checks API server audit logs for access in the last 7 days. Requires cluster auditing. |
| Recovery is possible | Deleted kubeconfig files can be restored from the kubeconfig recycle bin. |
Verify no operational dependencies before deleting a kubeconfig file. For example, delete departed employees' kubeconfig files individually to avoid invalidating active credentials.
Prerequisites
Make sure that you have:
-
An Alibaba Cloud account, or a RAM user or role with the following permissions:
-
AliyunCSFullAccess RAM permission
-
AliyunRAMReadOnlyAccess RAM permission
-
These permissions apply to all kubeconfig management operations: cluster-level, user-level, and deleted RAM user/role cleanup.
Delete a kubeconfig file for a specific user
View and revoke credentials for individual RAM users or RAM roles in a specific cluster.
-
Log on to the ACK console. In the left-side navigation pane, click Authorizations.
-
On the Authorizations page, click the KubeConfig File Management tab. Find the target cluster and click KubeConfig File Management in the Actions column. The page lists users with kubeconfig files or historical RBAC permissions. Each entry shows:
-
User information: username, user ID, account type, and account status
-
Kubeconfig file information: expiration date and status
If deleted RAM users or roles have active kubeconfig files, the console displays a notification.
-
-
Confirm the kubeconfig file is not in use. Click Delete KubeConfig File in the Actions column for the target RAM user or role.
Delete kubeconfig files for a RAM user across clusters
View and revoke credentials for a specific RAM user across clusters. Supports batch deletion.
-
Log on to the ACK console. In the left-side navigation pane, click Authorizations.
-
On the Authorizations page, click the RAM Users tab. Find the target RAM user and click KubeConfig Management in the Actions column. The KubeConfig Management panel displays the kubeconfig status for each cluster. Each entry shows:
-
Cluster information: cluster name and ID
-
Kubeconfig file information: expiration date, status, and 7-day audit logs (certificate access logs)
-
-
Confirm the kubeconfig files are not in use, then delete them:
-
Single cluster: Find the cluster and click Delete KubeConfig File in the Actions column.
-
Multiple clusters: Select the target clusters and click Delete KubeConfig File in the lower-left corner of the panel.
-
Clean up kubeconfig files from deleted RAM users or roles
Kubeconfig files and RBAC permissions may remain active after a RAM user or role is deleted. Remove residual credentials to prevent unauthorized access.
ACK console
-
Log on to the ACK console. In the left-side navigation pane, click Authorizations.
-
If residual kubeconfig files exist for deleted RAM users or roles, the Authorizations page displays a notification.
-
Click manage the kubeconfig files associated with invalid accounts in the message. The Delete KubeConfig Files of Deleted RAM Users/Roles page lists deleted RAM users and roles with active kubeconfig files or RBAC permissions.
-
Confirm the residual kubeconfig file is not in use. Click Delete KubeConfig File for the target deleted RAM user or role.
ack-ram-tool
For automated or bulk cleanup, see Use ack-ram-tool to revoke the permissions of specified users on ACK clusters.
FAQ
What is the 7-day access record check?
When you click Delete KubeConfig File, the system checks whether the kubeconfig file accessed the cluster in the last 7 days. Results are for reference only. Always confirm the kubeconfig file is not in use before deleting.
This check requires cluster auditing.
How do I read the 7-day access record check results?
| Check result | Type | Meaning |
|---|---|---|
| Successful | No access record found | The kubeconfig file did not access the cluster API server in the last 7 days. |
| Successful | Access records found | The kubeconfig file accessed the API server in the last 7 days. |
| Failed | Failed to query access records | Cluster auditing is disabled. |
| Failed | Failed to query access records | Other errors such as cluster connection failures or network issues. |
When can I not delete a kubeconfig file?
Deletion is blocked when:
-
Abnormal cluster states: Clusters in the Deletion Failed, Deleting, Deleted, or Failed state.
-
Abnormal kubeconfig states: Kubeconfig files in the Not Issued, Deleted, or Unknown state.
-
Self-owned kubeconfig files: You cannot delete your own kubeconfig files.
-
Alibaba Cloud account kubeconfig files: Kubeconfig files issued to Alibaba Cloud accounts cannot be deleted.
Can I restore a deleted kubeconfig file?
Yes. Use the kubeconfig recycle bin to restore deleted kubeconfig files or roll back to a historical version.
Security best practices
Secure kubeconfig credential lifecycle management:
-
[ ] Adopt webhook authentication for production clusters. Use ack-ram-authenticator for automatic revocation of kubeconfig files and RBAC permissions when a RAM user or role is deleted.
-
[ ] Apply the least privilege principle. Grant only minimum required permissions to each RAM user and role.
-
[ ] Revoke access promptly after employee departure. Delete the employee's kubeconfig files across all clusters immediately.
-
[ ] Audit kubeconfig file status regularly. Review the KubeConfig File Management tab to identify expired, unused, or orphaned credentials.
-
[ ] Keep credentials confidential. Protect AccessKey pairs, tokens, and kubeconfig files from unauthorized access.
-
[ ] Enable cluster auditing. Activate API server audit logging for 7-day access record checks before deletion.
You are responsible for any losses or consequences caused by the leak or expiration of credentials, such as AccessKey pairs of RAM users and kubeconfig files, due to inappropriate credential management. Read and understand the requirements in shared responsibility model.
References
-
Revoke the kubeconfig file of a cluster -- Revoke and regenerate kubeconfig files after employee departure or suspected credential leaks.
-
DescribeClusterUserKubeconfig -- Query kubeconfig files via the API.
-
Grant RBAC permissions to RAM users or RAM roles -- Configure RBAC admin permissions required for kubeconfig management.
-
Work with cluster auditing -- Enable audit logging for 7-day access record checks.
-
Use the kubeconfig recycle bin -- Restore deleted kubeconfig files.