Expiry and revocation¶

Credentials aren't renewed: when they expire, you issue another. Here's what to do when one is about to expire, how to revoke one you no longer need, and what happens to the commands you had open.

Expiry¶

Every credential expires on its own after the duration you chose when issuing it (up to 30 days for a person by default, 90 for a bot). It isn't renewed and nothing is sent before it expires: on Home, under My credentials, each active one shows when it expires and when it was last used (or never used), the nearest expiry first. Its expiry turns amber in the last 7 days and red in the last 24 hours. To see the others, tick Show expired and revoked: they show Expired, or Revoked on… with the reason on a line below.

A CLI session is the exception: its mark reads session · 11 h and never changes colour, because you renew it by running kubelatch login (When the session expires).

Your week also shows a credential that ends within the next seven days, on its day (Your week). An expired credential doesn't reactivate. To keep working, issue a new one: Issue a matching one, on the row of a credential that expired (in the row's menu for one that expires within the week), opens the form with its name and cluster filled in, and Issue a credential, in the My credentials card, starts from nothing (see Get a credential).

Your week¶

Your week, on Home, shows what of yours ends in the next seven days, and which day: your active permissions and your credentials, not your CLI sessions or CI tokens, which renew themselves. Each day is a column, today first (Today · Fri 24), and each thing on it says what it is (the role, or Credential "k9s"), where and at what time it ends, in red with under 24 hours left and in amber for the rest of the week. Each one has its way out:

• A permission: Ask for an extension, which leads to the contact your administrators have set up, or, without one, tells you to ask an administrator. In Pro it opens the request form on that permission instead, as Ask for an extension, or Ask for more for one that comes from a group or a set (Extensions). An administrator sees Renew instead, which opens Permissions.
• A credential: Issue a matching one, which opens the form with its name and cluster filled in.

A day shows two things at most, and +N more opens the rest. Permissions of yours that expired this week without being renewed are one line over the days, with the same way out (in Pro, Ask for access). With nothing in the week, the card says what ends next ("Nothing of yours ends this week. Next: viewer in qa-1, on 23 Nov") or Nothing of yours expires. See everything that expires takes you to My clusters, where the clusters with something that ends are open (See your access). On a phone the week is a list of the days that have something.

Revoke your own credential¶

1. On Home, find the credential under My credentials.
2. Click Revoke on its row.
3. In the dialog, type a reason if you want (optional, up to 500 characters) and click Revoke. A notice confirms it.

To end your CLI session instead, click Sign out in the line under the title of Home: it signs the CLI out on that computer, and kubectl asks for kubelatch login there again.

kubectl answers 401 instantly on the next request with that credential: there's no grace window at all.

What happens to what you had open¶

An exec, logs -f, port-forward or watch that was running is cut off in under 10 seconds after revocation. kubectl usually shows a connection-closed error, for example websocket: close 1006 (abnormal closure). Nothing else is needed: the next kubectl get pods with that credential already answers 401.

Who else can revoke it¶

An administrator can revoke any credential, not just yours, for example if you leave the team or lose your laptop. If your credential suddenly stops working and you didn't revoke it, ask an administrator: they may have revoked it, or your account may be disabled (disabling it also revokes all your credentials at once, with the reason account disabled, or account disabled by the system when leaving the GitHub organization disabled it).

Check that it is revoked¶

kubectl --kubeconfig ~/.kube/kubelatch.yaml get pods

After revoking, this answers 401 with the message credential revoked. That's confirmation the revocation is already in effect.

To see what was done with a credential before revoking it, check My activity.