<p>I need to rotate admin.conf for a cluster so old users who used that as their kubeconfig wouldn't be allowed to perform actions anymore.
How can i do that?</p>

Julessoulfly
<p><em>This is a Community Wiki answer, posted for better visibility, so feel free to edit it and add any additional details you consider important.</em></p>
<p>As <a href="https://stackoverflow.com/users/225016/mdaniel">mdaniel</a> wrote in his comment:</p>
<blockquote>
<p>the answer to your question is &quot;rekey the entire apiserver CA
hierarchy&quot; or wait for <code>admin.conf</code> cert to expire, because those
<code>admin.conf</code> credentials are absolute. Next time, use the provided
<a href="https://kubernetes.io/docs/reference/access-authn-authz/authentication/#openid-connect-tokens" rel="nofollow noreferrer">oidc mechanism</a> for user auth.</p>
</blockquote>
<p>For <a href="https://kubernetes.io/docs/setup/production-environment/tools/kubeadm/create-cluster-kubeadm/" rel="nofollow noreferrer">kubeadm based kubernetes cluster</a> please also refer to <a href="https://kubernetes.io/docs/tasks/administer-cluster/kubeadm/kubeadm-certs/" rel="nofollow noreferrer">Certificate Management with kubeadm</a>. For manual rotation of CA Certificates, please refer to <a href="https://kubernetes.io/docs/tasks/tls/manual-rotation-of-ca-certificates/" rel="nofollow noreferrer">this section</a>. Pay special attention to point 7:</p>
<blockquote>
<ol start="7">
<li>Update certificates for user accounts by replacing the content of client-certificate-data and client-key-data respectively.</li>
</ol>
<p>For information about creating certificates for individual user
accounts, see <a href="https://kubernetes.io/docs/setup/best-practices/certificates/#configure-certificates-for-user-accounts" rel="nofollow noreferrer">Configure certificates for user accounts</a>.</p>
<p>Additionally, update the certificate-authority-data section in the
kubeconfig files, respectively with Base64-encoded old and new
certificate authority data</p>
</blockquote>
