CODEWITHSUNDEEP
azureazure-aks
Yannick
Yannick

Reputation: 545

How to revoke tokens from aks get-credentials?

The command az aks get-credentials gives clients a token that allows them to connect to Kubernetes. Where are these stored on the Azure side, and how can I revoke them?

Upvotes: 1

Views: 1878

Answers (1)

bpdohall
bpdohall

Reputation: 1051

Client tokens can be revoked by running az aks rotate-certificates. This operation can incur downtime, so is not the ideal method to use for fine-grained revokation. See https://learn.microsoft.com/en-us/azure/aks/certificate-rotation.

To be able to revoke individual access (for example when someone leaves the company), you should be setting up your cluster with RBAC. You can then add and remove users/groups via RoleBinding resources which will reflect access grants/restrictions immediately after making a change. Users should be granted "Azure Kubernetes Service Cluster User Role" rather than the Admin role. Please see detailed instructions on Active Directory integrated RBAC here: https://learn.microsoft.com/en-us/azure/aks/azure-ad-rbac

Upvotes: 4

Related Questions