Skip to content

Expiry and revocation

Credentials aren't renewed: when they expire, you issue another. Here's what to do when one is about to expire, how to revoke one you no longer need, and what happens to the commands you had open.

Expiry

Every credential expires on its own after the number of days you chose when issuing it (up to 30 days for a person, 90 for a bot). It isn't renewed and there's no warning before it expires: on Inicio (Home), under Mis credenciales (My credentials), each row shows its status (Activa, caduca en... (Active, expires in...), Caducada (Expired), or Revocada el... (motivo) (Revoked on... (reason))).

An expired credential doesn't reactivate. To keep working, issue a new one from the same Mis credenciales form (see Get a credential).

Revoke your own credential

  1. On Inicio, find the credential under Mis credenciales.
  2. Click Revocar (Revoke).
  3. Type a reason if you want (optional, up to 500 characters) and confirm.

kubectl answers 401 instantly on the next request with that credential: there's no grace window at all.

Token lost or leaked: revoke it now

If the token could have been copied to an insecure place (a log, a chat, a repository), revoke it right away and issue a new one. The token can't be invalidated any other way: kubelatch only stores its hash, so neither you nor an administrator can look at it to confirm whether it leaked, only revoke it just in case.

What happens to what you had open

An exec, logs -f, port-forward or watch that was running is cut off in under 10 seconds after revocation (kubelatch checks every credential used in a live stream every 10 seconds). kubectl usually shows a connection-closed error, for example websocket: close 1006 (abnormal closure). Nothing else is needed: the next kubectl get pods with that credential already answers 401.

Who else can revoke it

An administrator can revoke any credential, not just yours, for example if you leave the team or lose your laptop. If your credential suddenly stops working and you didn't revoke it, ask an administrator: they may have revoked it, or your account may be disabled (disabling it also revokes all your credentials at once).

Check that it works

kubectl --kubeconfig ~/.kube/kubelatch.yaml get pods

After revoking, this answers 401 with a revoked-credential message. That's confirmation the revocation is already in effect.

To see what was done with a credential before revoking it, check My activity.