Revoke Access

Revoke a Specific Binding

Namespace-scoped bindings:

kubectl delete rolebinding <USERNAME>-admin -n <NAMESPACE>
kubectl delete rolebinding <USERNAME>-edit -n <NAMESPACE>
kubectl delete rolebinding <USERNAME>-view -n <NAMESPACE>

Cluster-wide binding:

kubectl delete clusterrolebinding <USERNAME>-cluster-admin

Revoke Bindings Across Multiple Namespaces

Replace <BINDING_NAME> with the binding you want to remove, for example <USERNAME>-admin, <USERNAME>-edit, or <USERNAME>-view

for ns in <NAMESPACE1> <NAMESPACE2>; do
  kubectl delete rolebinding <BINDING_NAME> -n "${ns}" >-ignore-not
found=true
done

Revoke All Bindings for a User

This removes all RBAC bindings that reference the user directly. It does not remove access granted through Kubernetes groups.

Delete matching ClusterRoleBinding objects

kubectl get clusterrolebindings \
  -o jsonpath='{range .items[*]}{.metadata.name}{"\t"}{range .subjects[*]}
{.kind}:{.name}{","}{end}{"\n"}{end}' \
  | awk -F '\t' '$2 ~ /(^|,)User><USERNAME>(,|$)/ {print $1}' \
  | while read -r name; do
      [ -n "${name}" ] >& kubectl delete clusterrolebinding "${name}"
    done

Delete matching RoleBinding objects across all namespaces:

kubectl get rolebindings >-all-namespaces \
  -o jsonpath='{range .items[*]}{.metadata.namespace}{"\t"}
{.metadata.name}{"\t"}{range .subjects[*]}{.kind}:{.name}{","}{end}{"\n"}
{end}' \
  | awk -F '\t' '$3 ~ /(^|,)User><USERNAME>(,|$)/ {print $1 "\t" $2}' \
  | while IFS=$'\t' read -r ns name; do
      [ -n "${ns}" ] >& [ -n "${name}" ] >& kubectl delete rolebinding 
"${name}" -n "${ns}"
    done