<p>We have a few k8s clusters in AWS that were created using Kops.<br />
We are trying to improve security by setting up RBAC using service accounts and users.<br />
Unfortunately, some of our devs were given the master/admin certificates.<br />
Would it be possible to regenerate the master certificates without creating a new cluster?</p>
<p>Other best practices related to security would also be appreciated!
Thanks.</p>

<p>This is a community wiki answer based on a solution from a similar question. Feel free to expand it.</p>
<p>As already mentioned in the comments, the answer to your question boils down to the below conclusions:</p>
<ul>
<li><p>Currently there is no easy way to <a href="https://kops.sigs.k8s.io/rotate-secrets/" rel="nofollow noreferrer">roll certificates without disruptions</a></p>
</li>
<li><p>You cannot disable certificates as Kubernetes relies on the PKI to authenticate</p>
</li>
<li><p>Rotating secrets should be graceful in the future as stated in <a href="https://github.com/kubernetes/kops/pull/10516" rel="nofollow noreferrer">this PR</a></p>
</li>
</ul>
