Container Service for Kubernetes:Restore or delete kubeconfig files from the recycle bin

Prerequisites

Ensure the following:

• An Alibaba Cloud account, or a RAM user or RAM role with the AliyunCSFullAccess and AliyunRAMReadOnlyAccess permissions

Use cases

• Recover from accidental deletion: Admin A accidentally deleted RAM User B's kubeconfig file for Cluster 1. RAM User B can ask Admin A to restore it from the recycle bin.

• Restore a previous version with specific RBAC permissions: Admin A deleted kubeconfig v1, which had specific RBAC permissions. RAM User B obtained kubeconfig v2, but some applications still depend on v1's permissions. To restore v1, Admin A must delete v2 first, then restore v1 from the recycle bin.

Restore kubeconfig files

The recycle bin retains deleted kubeconfig files for 30 days. After that, files are permanently removed.

1. Log on to the ACK console. In the left-side navigation pane, click Authorizations.

2. Click the KubeConfig File Management tab, then click KubeConfig File Recycle Bin in the upper-right corner.

   Column	Description
   Username and UID	The Alibaba Cloud account, RAM user, or RAM role associated with the kubeconfig file
   Certificate CN	The CommonName of the client certificate. See Client certificate CommonNames
   Cluster Name and Cluster ID	The ACK cluster the kubeconfig file was issued for
   RBAC Permissions	The RBAC permissions granted by the kubeconfig file
   Recycled At	When the kubeconfig file was moved to the recycle bin
   Deletion Interval	When the record will be permanently removed. Records expire after 30 days

3. Click Restore in the Actions column. This restores the kubeconfig file and its RBAC permissions. To recover multiple files, select them and click Batch Restore. Ensure selected files do not conflict.

   If Restore is dimmed, an active kubeconfig file already exists for this Alibaba Cloud account, RAM user, or RAM role on the cluster. Each identity can have only one active kubeconfig per cluster. Delete the active file first, then restore the historical version. See Delete kubeconfig files.

Delete kubeconfig records

Permanently remove kubeconfig records from the recycle bin. Deleted records cannot be restored.

1. Log on to the ACK console. In the left-side navigation pane, click Authorizations.

2. Click the KubeConfig File Management tab, then click KubeConfig File Recycle Bin in the upper-right corner.

3. Find the record you want to delete, click Delete, and enter the client certificate CommonName to confirm.

Client certificate CommonNames

A client certificate CommonName identifies the client accessing an ACK cluster via the kubeconfig file. See kube-apiserver.

In ACK, CommonNames follow the {UserID}-{SuffixID} format:

• UserID: The ID of the RAM user or RAM role

• SuffixID: A random string that changes each time the kubeconfig is revoked or deleted, preventing reuse of older versions

FAQ

openssl x509 -in <(kubectl config view --kubeconfig {Kubeconfig file name} --raw --minify --output=jsonpath='{.users[0].user.client-certificate-data}'|base64 -d) -noout -subject

Next steps

• Delete kubeconfig files issued to former employees or that may pose security risks. See Delete kubeconfig files.

• If an active kubeconfig file is exposed or compromised, revoke it and issue a new one. See Revoke a KubeConfig file.