Container Service for Kubernetes:Get a kubeconfig and connect to a cluster with kubectl

By validity period

By access method

A bound EIP incurs pay-as-you-go charges.

For ACK dedicated clusters with public access, you can also connect to the master node via SSH to get the kubeconfig.

Rotate credentials before they expire

A long-term kubeconfig is valid for 3 years. Get a new one from the ACK console or the DescribeClusterUserKubeconfig API within 180 days of expiration to avoid service disruptions.

The new kubeconfig is valid for 3 years. The old one remains valid until its original expiration date.

Revoke compromised credentials

If you suspect a kubeconfig is compromised, revoke the cluster's kubeconfig credentials immediately. This invalidates all existing connections and generates a new kubeconfig.

Clean up permissions for departing users

When a user no longer needs access (for example, after a project ends or an employee leaves), revoke their kubeconfig permissions in bulk by deleting kubeconfig files or using ack-ram-tool. The system does not generate a new kubeconfig after revocation.

To restore accidentally revoked permissions, use the kubeconfig recycle bin.

How do I find the identity associated with a kubeconfig certificate?

Extract the certificate subject:

# Extract the client certificate, decode it from base64,
# then use OpenSSL to display the Subject field
grep client-certificate-data kubeconfig | awk '{print $2}' | base64 -d | openssl x509 -noout -text | grep Subject:

Expected output:

        Subject: O=system:users, OU=, CN=1***-1673419473

• O—The Kubernetes user group. In this example, system:users.

• CN—The user identifier. In this example, 1***-1673419473, where 1*** is the Alibaba Cloud user ID.

How do I check when a kubeconfig certificate expires?

Check the certificate expiration:

# Extract the client certificate, decode it from base64,
# then use OpenSSL to print the expiration date
grep client-certificate-data kubeconfig | awk '{print $2}' | base64 -d | openssl x509 -noout -enddate

Expected output:

notAfter=Jan 10 06:44:34 2026 GMT

In this example, the certificate expires on January 10, 2026.

Get a new kubeconfig from the console or API within 180 days before expiration, or at any time after it expires.

How do I extract the client certificate, private key, and API server URL from a kubeconfig?

Extract the certificate, key, and API server URL:

# Extract and decode the client certificate to a PEM file
grep client-certificate-data ./kubeconfig | awk -F ' ' '{print $2}' | base64 -d > ./client-cert.pem

# Extract and decode the client private key to a PEM file
grep client-key-data ./kubeconfig | awk -F ' ' '{print $2}' | base64 -d > ./client-key.pem

# Extract the API server URL into a variable
APISERVER=$(grep server ./kubeconfig | awk -F ' ' '{print $2}')

How do I resolve the "certificate is valid for" error?

This error occurs when you bind a new IP address to the Server Load Balancer (SLB) instance for the API server. kubectl commands targeting the new IP fail with Error while proxying request: x509: certificate is valid for xxx or Unable to connect to the server: x509: certificate is valid for xxx.

The fix depends on your cluster type:

• ACK managed clusters: Add the new IP address to the Subject Alternative Name (SAN) of the API server certificate.

• ACK dedicated clusters: Configure kubectl to skip TLS verification with one of these methods:

  Important

  Skipping TLS verification is a security risk. Do not use this in production. Migrate to ACK Pro clusters, then add the new IP address to the SAN of the API server certificate.

  • Method 1: Pass the --insecure-skip-tls-verify flag:

    kubectl -s https://<IP>:6443 --insecure-skip-tls-verify get ns

  • Method 2: Edit the kubeconfig file. Add insecure-skip-tls-verify: true and remove the certificate-authority-data field:

    apiVersion: v1
    clusters:
    - cluster:
        server: https://<IP>:6443
        insecure-skip-tls-verify: true
      name: kubernetes
    contexts:
    ...

Can I get the root certificate key for an ACK managed cluster to generate a kubeconfig myself?

No. ACK managed clusters do not expose the root certificate key. Get the kubeconfig from the console or the DescribeClusterUserKubeconfig API.