<p>Whenever you start a Kubernetes cluster at one of the big clouds (EKS at AWS, GKE at GCP, AKS at Azure, or Kubernetes at Digitalocean), you can generate a kubeconfig file from them, which grants you full access.</p>
<p>It is now very nice to work with them, but I am always concerned about what I can do if someone manages to steal it. What can I do then?</p>
<p>I never found a button at one of the big clouds to revoke access of the stolen kubeconfig and to regenerate a new one. Is there anything with which I can make that aspect more secure - if you have a documentation at hand, that would be appreciated.</p>

tobias
<p>In GKE at GCP the Kubeconfig file which is generated while the cluster creation is located in <strong>$HOME/.kube/config</strong>. The kubeconfig directory is default to $HOME/.kube/config where <strong>$HOME</strong> refers to the /home/.</p>
<p><strong>1.</strong> If you want to remove user from kubeconfig file use the following command:</p>
<p><code>$ kubectl --kubeconfig=&lt;kubeconfig-name&gt; config unset users.&lt;name&gt;</code></p>
<p><strong>2.</strong> If you want to regenerate the Kubeconfig file with the previous Kubeconfig file contents try authorizing the cluster using the command:</p>
<p><code>$ gcloud container clusters get-credentials &lt;cluster-name&gt; --zone &lt;zone&gt; --project &lt;project-id&gt;</code></p>
<p><strong>3.</strong> If you want to restrict users to kubeconfig file, add permissions to kubeconfig file using the following permission commands:</p>
<p><code>$ chmod 644 &lt;kubeconfig-file&gt;</code>  - which means that the owner can read and write the file, and all others on the system can only read it.</p>
<p><code>$ chmod 640 &lt;kubeconfig-file&gt;</code> - that the owner has read and write permissions, the group has read permissions, and all other users have no rights to the file.</p>
<p><code>$ chmod 600 &lt;kubeconfig-file&gt;</code> - only the owner of the file has full read and write access to it. Once a file permission is set to <strong>600</strong>, no one else can access the file.</p>
<p><strong>NOTE:</strong> Revoking the contents of Kubeconfig file after the kubeconfig file deletion is not possible, you can regenerate the contents of Kubeconfig file only by authorizing the cluster.</p>
<p>Refer to the <a href="https://kubernetes.io/docs/tasks/access-application-cluster/configure-access-multiple-clusters/#define-clusters-users-and-contexts" rel="nofollow noreferrer">documentation</a> for more information.</p>
