<p>I'm hosting on google container engine. Recently one of my team mates left the company and I want to revoke his access rights to the cluster. I removed his account from the compute engine project already, yet he can still access the cluster.</p>

<p>He got access through <code>gcloud container clusters get-credentials &lt;cluster&gt;</code>. The entries I see in my <code>~/.kube/config</code> look as if I get the same certificate as all of my colleagues.</p>

<p>What do I need to do to remove him from the cluster? To me it seems as if there is zero documentation on this topic.</p>

<p><em>Additional Note:</em>
The cluster is still on kubernetes 1.2.5</p>

<p>When using the per-cluster certificate, there is currently no way to revoke/rotate certificates (see <a href="https://github.com/kubernetes/kubernetes/issues/4672" rel="nofollow">Issue #4672</a>). The only way to completely revoke access is to delete and recreate the cluster.</p>

<p>If you instead use Google OAuth2 credentials to access your cluster (the default w/ a 1.3 cluster and an up-to-date client), permissions are tied to your project's <a href="http://console.developers.google.com/iam-admin/iam/project" rel="nofollow">IAM configuration</a>, and can be revoked/changed at any time.</p>

<p>Retrieving the cluster certificate requires the caller to have <code>container.clusters.getCredentials</code> permission, which is contained by the <code>Container Engine Admin</code> and <code>Editor</code> roles. As long as the roles that you give to your team members do not contain that permission (e.g. <code>Container Engine Developer</code>), they will not be able to retrieve cluster certificates.</p>

<p>Here are the <a href="https://cloud.google.com/container-engine/docs/iam-integration" rel="nofollow">GKE IAM docs</a> for more info on GKE permissions and roles.</p>
