This message was deleted.
# rke2a
adamant-kite-43734
11/20/2025, 10:24 AMThis message was deleted.
c
creamy-pencil-82913
11/20/2025, 7:11 PMTreat this as if an attacker compromised the root password or ssh keys to your nodes. Delete the cluster and all the nodes and rebuild from scratch.
creamy-pencil-82913
11/20/2025, 7:12 PMKubernetes does not support certificate revocation so there is no way to revoke access to the client cert that is contained in the admin kubeconfig. You have to completely replace the root CA for the cluster. Even if you do that, you have no way of knowing what the attacker may have planted on the nodes while they had access - so your best bet is to just start over.
d
delightful-alligator-2265
11/20/2025, 7:41 PMThere was no attack, it's just that the employees initially had access to the cluster using this key, and now one of them has been fired.
You have to completely replace the root CA for the cluster.Can you advise me please how to do this exactly?
c
creamy-pencil-82913
11/20/2025, 7:44 PMdon’t share access to the admin kubeconfig. Create unique certs and RBAC for each user so that you can delete them if you need to revoke access.
creamy-pencil-82913
11/20/2025, 7:45 PMRancher will do this for you, as will other projects that offer access management for Kubernetes
creamy-pencil-82913
11/20/2025, 7:45 PMd
delightful-alligator-2265
11/20/2025, 7:46 PMdon’t share access to the admin kubeconfigYeah, yeah, I know 😆 I already don't
c
creamy-pencil-82913
11/20/2025, 7:47 PMOnce you’ve rotated through once, you can remove the old server CA and cross-signed new CA from the bundles and run the
rotate-cad
delightful-alligator-2265
11/20/2025, 7:53 PMI've read this article thrice today, along with bash scripts, but unfortunately I couldn't figure out what exactly needs to be done
Correct me please if I'm wrong:
1. use
generate-custom-ca-certs.shservice.keyroot-caintermediate-carke2 certificate rotate-ca --forcec
creamy-pencil-82913
11/20/2025, 7:58 PMno, don’t generate custom certs. We do not test going from self-signed to custom.
creamy-pencil-82913
11/20/2025, 7:58 PMRead the docs I linked to to rotate the self-signed certs
creamy-pencil-82913
11/20/2025, 7:59 PMonce you’ve followed those steps, edit the CA bundles to remove the old CA certs, and the cross-signed new CA cert, and then perform the rotate-ca step again.
d
delightful-alligator-2265
11/20/2025, 8:11 PMThanks, I'll try to understand this article again tomorrow 🙏
24 Views