Delete kubeconfig files

Kubeconfig file overview

Kubeconfig files store the credentials that clients use to access ACS clusters. Query them in the ACS console or by calling the DescribeClusterUserKubeconfig API operation. Keep kubeconfig files confidential to prevent credential leaks.

Status of kubeconfig files

The following table describes the status values of kubeconfig files.

Before deleting a kubeconfig file, check its importance and validity period. For example, delete kubeconfig files issued to employees who have left the company, and address files approaching expiration to prevent business interruptions.

Kubeconfig file management

Example of managing kubeconfig files in clusters

1. Log on to the ACS console. In the left-side navigation pane, click Authorizations.

2. On the Authorizations page, click the KubeConfig File Management tab. Then, find the cluster that you want to manage and click KubeConfig File Management in the Actions column. The KubeConfig File Management panel appears.

   The panel lists RAM users and RAM roles that hold kubeconfig files for this cluster, including those who deleted their kubeconfig files but retain RBAC permissions:

   • User information: Username, user ID, account type, and account status

   • Kubeconfig file information: Expiration date and status

3. After confirming that no applications use the kubeconfig file, click Delete KubeConfig File in the Actions column for the target RAM user or RAM role.

   Important

   • Make sure that no risk occurs before you delete a kubeconfig file. Otherwise, you cannot access the API server of the cluster that generates the kubeconfig file.

   • As defined in the shared responsibility model, kubeconfig files are managed and maintained by the customers of Alibaba Cloud. We recommend that you delete kubeconfig files that have potential risks as soon as possible.

   After you click Delete KubeConfig File, the system automatically accesses the audit logs of the API server to check the access records of the kubeconfig file within the previous seven days. To use this feature, make sure that the cluster auditing feature of the API server is enabled. For more information, see Work with cluster auditing.

Example on managing kubeconfig files that are issued to RAM users or RAM roles

1. Log on to the ACS console. In the left-side navigation pane, click Authorizations.

2. On the Authorizations page, click the RAM Users tab. On the RAM Users tab, find the RAM user that you want to manage and click KubeConfig Management on the right. The KubeConfig Management panel appears.

   The panel displays the kubeconfig file status across clusters for the selected RAM user or RAM role, including cluster and kubeconfig file details.

   • Cluster information: includes the name and ID of the cluster.

   • Kubeconfig file information: includes the expiration date and status of the kubeconfig file and records of access by using the kubeconfig file in the previous seven days.

3. Delete the kubeconfig file of a cluster or delete the kubeconfig files of multiple clusters at a time. Before you delete a kubeconfig file, make sure that the kubeconfig file is not used by any applications.

   • Delete the kubeconfig file of a cluster: Find the cluster whose kubeconfig files you want to delete and click Delete KubeConfig File in the Actions column.

   • Delete the kubeconfig files of multiple clusters at a time: Select the clusters whose kubeconfig files you want to delete and click Delete KubeConfig File in the lower-left part of the panel.

     Important

     • Make sure that no risk occurs before you delete a kubeconfig file. Otherwise, you cannot access the API server of the cluster that generates the kubeconfig file.

     • As defined in the shared responsibility model, kubeconfig files are managed and maintained by the customers of Alibaba Cloud. We recommend that you delete kubeconfig files that have potential risks as soon as possible.

     Note

     After you click Delete KubeConfig File, the system automatically accesses the audit logs of the API server to check the access records of the kubeconfig file within the previous seven days. To use this feature, make sure that the cluster auditing feature of the API server is enabled. For more information, see Work with cluster auditing.

Example of deleting residual kubeconfig files

FAQ about kubeconfig files

What is seven-day access record check?

The seven-day access record check determines whether a kubeconfig file was used to access the cluster in the past seven days. This feature requires API server cluster auditing to be enabled. For more information, see Work with cluster auditing. Check results are for reference only. Always verify that the kubeconfig file is not in use before deletion.

How do I understand the seven-day access record check results?

In which scenarios am I unable to delete kubeconfig files?

• Abnormal cluster states: Do not delete the kubeconfig files of clusters that are in the Deletion Failed, Deleting, Deleted, and Failed states.

• Abnormal kubeconfig file or certificate states: Do not delete kubeconfig files that are in the Not Issued, Revoked, and Unknown states.

• You cannot delete kubecofig files held by you.

• You cannot delete kubeconfig files issued to Alibaba Cloud accounts.

What is the best security practice for kubeconfig file management?

Manage and safeguard all credentials used to access clusters, including RAM user AccessKey pairs, tokens, and kubeconfig files. Follow the least privilege principle when granting cluster permissions, and revoke access promptly. For example, revoke cluster access for an employee's account as soon as they leave the company.

References

If an employee leaves the company or a kubeconfig file is suspected to be leaked, you can revoke the kubeconfig file and generate a new kubeconfig file. For more information, see Revoke a cluster kubeconfig file.