In typical multi-tenant environments, Alibaba Cloud Container Compute Service (ACS) issues kubeconfig files with embedded identity information that allow users to connect to a cluster. If an employee leaves your organization or a kubeconfig file is suspected to be compromised, you must revoke the file to ensure the security of your cluster. This topic describes how an Alibaba Cloud account or a RAM user can revoke a kubeconfig file.
Usage notes
You can revoke kubeconfig files in the following scenarios:
-
An Alibaba Cloud account revokes a kubeconfig file for any of its RAM users.
-
A RAM user revokes their own kubeconfig file.
Revoking a kubeconfig file automatically generates a new one.
For Alibaba Cloud accounts: revoke a RAM user's kubeconfig
Only an Alibaba Cloud account can revoke kubeconfig files for other RAM users or RAM roles.
Log on to the console with your Alibaba Cloud account and follow these steps.
-
Log on to the ACS console. In the left navigation pane, choose Authorizations.
-
On the sub account tab, find the target RAM user and click KubeConfig Management. A list of clusters created by the RAM user appears. Follow the on-screen instructions to revoke the file for the target cluster.
For RAM users: revoke your own kubeconfig
Log on to the console with your RAM user credentials and follow these steps.
After revoking the kubeconfig file, you can no longer use it to connect to the cluster. Proceed with caution.
-
Log on to the ACS console. In the left navigation pane, click Clusters.
-
On the Clusters page, click the name of the target cluster. In the left navigation pane, choose Cluster Information.
-
On the Connection Information tab, click the red Revoke Kubeconfig button, and then click OK.
Revoke a kubeconfig for untrusted users
If an employee leaves your organization or you no longer trust a user, an Alibaba Cloud account must first revoke their kubeconfig file. Then, delete the corresponding RAM user or RAM role. Deleting a RAM user or RAM role alone does not remove the RBAC permissions embedded in the kubeconfig file.
Before you revoke the kubeconfig file and delete the corresponding RAM user, verify that no services in the cluster depend on that user's credentials. For specific instructions, see For Alibaba Cloud accounts: revoke a RAM user's kubeconfig.