<p><strong>First</strong> <a href="https://kubernetes.io/docs/tasks/administer-cluster/kubeadm/kubeadm-certs/#check-certificate-expiration" rel="nofollow noreferrer">How to check Check certificate expiration</a></p>

<p>You can use the <code>kubeadm alpha certs check-expiration</code> command to check when certificates expire on a given cluster.</p>

<p><strong>Simplest remedy</strong> : you can choose to upgrade the control plance which will renew the certs and then you are good and secure as before loosing your laptop.</p>

<p><a href="https://kubernetes.io/docs/tasks/administer-cluster/kubeadm/kubeadm-certs/#automatic-certificate-renewal" rel="nofollow noreferrer">Automatic certificate renewal</a></p>

<blockquote>
  <p>Note : kubeadm renews all the certificates during control plane upgrade.</p>
</blockquote>

<p>This feature is designed for addressing the simplest use cases; if you don’t have specific requirements on certificate renewal and perform Kubernetes version upgrades regularly (less than 1 year in between each upgrade), kubeadm will take care of keeping your cluster up to date and reasonably secure.</p>

<blockquote>
  <p>Note: It is a best practice to upgrade your cluster frequently in order to stay secure.</p>
</blockquote>

<p><strong>Another option is to perform</strong> <a href="https://kubernetes.io/docs/tasks/administer-cluster/kubeadm/kubeadm-certs/#manual-certificate-renewal" rel="nofollow noreferrer">Manual certificate renewal</a></p>

<blockquote>
  <p>Note: The default Kubernetes certificates normally reach their expiration date after one year.</p>
</blockquote>

<p>Refer more on <code>kubeadm alpha certs renew</code> command usage.</p>

<p>You probably also need to explore the beta feature for <a href="https://kubernetes.io/docs/reference/command-line-tools-reference/kubelet-tls-bootstrapping/#certificate-rotation" rel="nofollow noreferrer">Certificate Rotation</a></p>

CC BY-SA 4.0
2020-02-06T17:55:31.667Z
How does this apply to Azure managed Azure Kubernetes Service?
Steven K7FAQ
CC BY-SA 4.0
2020-02-06T18:07:30.553Z
On AKS Kubernetes master components are part of the managed service provided by Microsoft, so it's is more or less just contact them  for service to get certs refreshed :)
DT.
CC BY-SA 4.0
2020-02-06T18:10:22.430Z
So now I am confused as to how this answers the question. I am looking for a solution on how to define the time credentials remain valid before they expire.
Steven K7FAQ
CC BY-SA 4.0
2020-02-06T18:37:56.460Z
https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-configurable-token-lifetimes#token-lifetime-policy-properties when you are using active directory as a [best practice](https://docs.microsoft.com/en-us/azure/aks/operator-best-practices-identity)
DT.
CC BY-SA 4.0
2020-05-31T16:28:52.930Z
These tokens should not require Active Directory integration. Further proves security is the last priority of Microsoft.
Steven K7FAQ
CC BY-SA 4.0
2020-02-06T16:03:04.140Z
2020-02-06T16:09:00.050Z
2020-02-06T16:09:00.050Z
DT.
<p>You would normally use an Azure AD object like a Service Principal to get the credentials for AKS using the <code>az aks get-credentials</code> command.</p>

<p>To expire the aks credentials, you need to set a policy for token expiry on the
Service principal which you use.</p>

<p>Once you set the expiry time, kubectl will ask you to reauthenticate when the token expires. </p>

<p><strong>Refer:</strong> <a href="https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-configurable-token-lifetimes" rel="nofollow noreferrer">https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-configurable-token-lifetimes</a></p>

<p>This github issue can help understand as well: <a href="https://github.com/Azure/AKS/issues/133" rel="nofollow noreferrer">https://github.com/Azure/AKS/issues/133</a></p>

CC BY-SA 4.0
2020-05-31T16:30:00.590Z
This issue should not require Active Directory integration. This proves a major security vulnerability. Further proves security is the last priority of Microsoft.
Steven K7FAQ
CC BY-SA 4.0
2020-06-01T07:17:25.890Z
It doesn't need AD Integration to the cluster. All you need to do is set a policy for token expiry for your AD user or service principal which you use to sign in using `az login` to your machine.
Karthick Prabu
CC BY-SA 4.0
2020-06-01T07:20:07.810Z
As of today(1st June, 2020) this feature has been moved to Azure AD Conditional Access. You can set the token lifetime of your AD object by setting a sign-in frequency here. As soon as the token expires, the AD user needs to sign in again or else they cannot use either `kubectl` or `az` commands
Karthick Prabu
CC BY-SA 4.0
2020-05-31T05:33:52.400Z
2020-05-31T05:33:52.400Z
Karthick Prabu
<p>I am looking for information on how to forcefully expire users credentials in Azure Kubernetes Service (AKS). The reason is to better understand Security models and protecting Kubernetes deployments from unauthorized access.</p>

<p>Scenario: You are an Administrator and your notebook is lost/stolen. Your Kubernetes credentials have been cached because you used <code>az aks get-credentials ...</code>. The one who now has your notebook has been able to extract your <code>~/.kube/config</code> file. They now have your Admin access!</p>

<p>Thankfully this has not happened to me. However, imagine the nightmare! Now, how do we prevent unauthorized access with this scenario?</p>

<p>One thing I have not yet found is how/where to forcefully expire credentials after X hours. Thus requiring users to get fresh credentials every day or (X hours). What should I be looking for or where can I find documentation that talks of this?</p>

<p>Google searches did not render results to answer this.</p>

CC BY-SA 4.0
2020-02-06T18:26:30.857Z
side note for reference, AWS implements this requirement through service-linked roles.
https://docs.aws.amazon.com/IAM/latest/UserGuide/using-service-linked-roles.html
Ta Mu
<kubernetes><security><azure-kubernetes-service><credentials>
How do I expire users credentials for Kubernetes in Azure?
Steven K7FAQ
# How do I expire users credentials for Kubernetes in Azure?

(Asked by: username_0 on 2020-02-03)

I am looking for information on how to forcefully expire users credentials in Azure Kubernetes Service (AKS). The reason is to better understand Security models and protecting Kubernetes deployments from unauthorized access.

Scenario: You are an Administrator and your notebook is lost/stolen. Your Kubernetes credentials have been cached because you used `az aks get-credentials ...`. The one who now has your notebook has been able to extract your `~/.kube/config` file. They now have your Admin access!

Thankfully this has not happened to me. However, imagine the nightmare! Now, how do we prevent unauthorized access with this scenario?

One thing I have not yet found is how/where to forcefully expire credentials after X hours. Thus requiring users to get fresh credentials every day or (X hours). What should I be looking for or where can I find documentation that talks of this?

Google searches did not render results to answer this.

**Tags:** kubernetes, security, azure-kubernetes-service, credentials

> **Comments:**
> **username_1**: side note for reference, AWS implements this requirement through service-linked roles. https://docs.aws.amazon.com/IAM/latest/UserGuide/using-service-linked-roles.html  

---

## 2 answers

### Answer by username_2 on 2020-02-06. Score: 2

**First** [How to check Check certificate expiration](https://kubernetes.io/docs/tasks/administer-cluster/kubeadm/kubeadm-certs/#check-certificate-expiration)

You can use the `kubeadm alpha certs check-expiration` command to check when certificates expire on a given cluster.

**Simplest remedy** : you can choose to upgrade the control plance which will renew the certs and then you are good and secure as before loosing your laptop.

[Automatic certificate renewal](https://kubernetes.io/docs/tasks/administer-cluster/kubeadm/kubeadm-certs/#automatic-certificate-renewal)

> Note : kubeadm renews all the certificates during control plane upgrade.

This feature is designed for addressing the simplest use cases; if you don’t have specific requirements on certificate renewal and perform Kubernetes version upgrades regularly (less than 1 year in between each upgrade), kubeadm will take care of keeping your cluster up to date and reasonably secure.

> Note: It is a best practice to upgrade your cluster frequently in order to stay secure.

**Another option is to perform** [Manual certificate renewal](https://kubernetes.io/docs/tasks/administer-cluster/kubeadm/kubeadm-certs/#manual-certificate-renewal)

> Note: The default Kubernetes certificates normally reach their expiration date after one year.

Refer more on `kubeadm alpha certs renew` command usage.

You probably also need to explore the beta feature for [Certificate Rotation](https://kubernetes.io/docs/reference/command-line-tools-reference/kubelet-tls-bootstrapping/#certificate-rotation)

> **Comments:**
> **username_0**: How does this apply to Azure managed Azure Kubernetes Service?  
> **username_2**: On AKS Kubernetes master components are part of the managed service provided by Microsoft, so it's is more or less just contact them  for service to get certs refreshed :)  
> **username_0**: So now I am confused as to how this answers the question. I am looking for a solution on how to define the time credentials remain valid before they expire.  
> **username_2**: https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-configurable-token-lifetimes#token-lifetime-policy-properties when you are using active directory as a [best practice](https://docs.microsoft.com/en-us/azure/aks/operator-best-practices-identity)  
> **username_0**: These tokens should not require Active Directory integration. Further proves security is the last priority of Microsoft.  

---

### Answer by username_3 on 2020-05-31. Score: 1

You would normally use an Azure AD object like a Service Principal to get the credentials for AKS using the `az aks get-credentials` command.

To expire the aks credentials, you need to set a policy for token expiry on the
Service principal which you use.

Once you set the expiry time, kubectl will ask you to reauthenticate when the token expires.

**Refer:** <https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-configurable-token-lifetimes>

This github issue can help understand as well: <https://github.com/Azure/AKS/issues/133>

> **Comments:**
> **username_0**: This issue should not require Active Directory integration. This proves a major security vulnerability. Further proves security is the last priority of Microsoft.  
> **username_3**: It doesn't need AD Integration to the cluster. All you need to do is set a policy for token expiry for your AD user or service principal which you use to sign in using `az login` to your machine.  
> **username_3**: As of today(1st June, 2020) this feature has been moved to Azure AD Conditional Access. You can set the token lifetime of your AD object by setting a sign-in frequency here. As soon as the token expires, the AD user needs to sign in again or else they cannot use either `kubectl` or `az` commands  

---

