3

I am looking for information on how to forcefully expire users credentials in Azure Kubernetes Service (AKS). The reason is to better understand Security models and protecting Kubernetes deployments from unauthorized access.

Scenario: You are an Administrator and your notebook is lost/stolen. Your Kubernetes credentials have been cached because you used az aks get-credentials .... The one who now has your notebook has been able to extract your ~/.kube/config file. They now have your Admin access!

Thankfully this has not happened to me. However, imagine the nightmare! Now, how do we prevent unauthorized access with this scenario?

One thing I have not yet found is how/where to forcefully expire credentials after X hours. Thus requiring users to get fresh credentials every day or (X hours). What should I be looking for or where can I find documentation that talks of this?

Google searches did not render results to answer this.

Improve this question
1

2 Answers 2

Reset to default
2

First How to check Check certificate expiration

You can use the kubeadm alpha certs check-expiration command to check when certificates expire on a given cluster.

Simplest remedy : you can choose to upgrade the control plance which will renew the certs and then you are good and secure as before loosing your laptop.

Automatic certificate renewal

Note : kubeadm renews all the certificates during control plane upgrade.

This feature is designed for addressing the simplest use cases; if you don’t have specific requirements on certificate renewal and perform Kubernetes version upgrades regularly (less than 1 year in between each upgrade), kubeadm will take care of keeping your cluster up to date and reasonably secure.

Note: It is a best practice to upgrade your cluster frequently in order to stay secure.

Another option is to perform Manual certificate renewal

Note: The default Kubernetes certificates normally reach their expiration date after one year.

Refer more on kubeadm alpha certs renew command usage.

You probably also need to explore the beta feature for Certificate Rotation

Improve this answer
5
  • How does this apply to Azure managed Azure Kubernetes Service?
    – Steven K7FAQ
    Feb 6, 2020 at 17:55
  • On AKS Kubernetes master components are part of the managed service provided by Microsoft, so it's is more or less just contact them for service to get certs refreshed :)
    – DT.
    Feb 6, 2020 at 18:07
  • So now I am confused as to how this answers the question. I am looking for a solution on how to define the time credentials remain valid before they expire.
    – Steven K7FAQ
    Feb 6, 2020 at 18:10
  • docs.microsoft.com/en-us/azure/active-directory/develop/… when you are using active directory as a best practice
    – DT.
    Feb 6, 2020 at 18:37
  • These tokens should not require Active Directory integration. Further proves security is the last priority of Microsoft.
    – Steven K7FAQ
    May 31, 2020 at 16:28
1

You would normally use an Azure AD object like a Service Principal to get the credentials for AKS using the az aks get-credentials command.

To expire the aks credentials, you need to set a policy for token expiry on the Service principal which you use.

Once you set the expiry time, kubectl will ask you to reauthenticate when the token expires.

Refer: https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-configurable-token-lifetimes

This github issue can help understand as well: https://github.com/Azure/AKS/issues/133

Improve this answer
3
  • This issue should not require Active Directory integration. This proves a major security vulnerability. Further proves security is the last priority of Microsoft.
    – Steven K7FAQ
    May 31, 2020 at 16:30
  • It doesn't need AD Integration to the cluster. All you need to do is set a policy for token expiry for your AD user or service principal which you use to sign in using az login to your machine.
    – Karthick Prabu
    Jun 1, 2020 at 7:17
  • 1
    As of today(1st June, 2020) this feature has been moved to Azure AD Conditional Access. You can set the token lifetime of your AD object by setting a sign-in frequency here. As soon as the token expires, the AD user needs to sign in again or else they cannot use either kubectl or az commands
    – Karthick Prabu
    Jun 1, 2020 at 7:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.