Why kubeconfig order can change identity
Kubernetes documents that files named by KUBECONFIG are merged in order and that the first file to set a map key wins. If two files define a user called admin, the second user is not field-merged with the first—it is discarded. The same applies to cluster and context names. This auditor preserves the selected order, shows every collision, and resolves each effective context to the winning cluster and user.
Why an untrusted kubeconfig is executable input
The official Kubernetes guidance warns that a specially crafted kubeconfig can cause malicious code execution or file exposure. An exec credential plug-in names a local command and arguments that a client may run to obtain credentials. This page inventories those fields as inert text; it never invokes them.
What the security preflight checks
The audit flags embedded tokens, passwords and private keys; multiple authentication techniques on one effective user; exec and legacy auth-provider configurations; absolute or parent-relative credential paths; invalid, non-HTTPS or proxy-bearing server configuration; disabled TLS verification; broken context references; and readable embedded CA or client-certificate validity dates and fingerprints. The field model follows the official kubeconfig v1 API reference.
Exports are deliberately different
The audit JSON contains findings and inventories but no credential values or raw entry bodies. The redacted support copy is a JSON-form kubeconfig-shaped document: sensitive values become placeholders and exec commands are replaced. It is for diagnosis and sharing, not authentication; do not feed it to production automation.
Validation boundary
This is a static preflight, not kubectl. It does not implement every YAML feature, apply command-line overrides, read files named by the configuration, validate certificate signatures or trust, consult revocation, refresh tokens, run authentication plug-ins, contact servers, prove RBAC permissions, or guarantee identical behavior for malformed files. Confirm important results with a controlled installation of the intended kubectl version.
Frequently asked questions
Does the last file override the first?
No. For kubeconfig merging, the first file to define a particular named cluster, user, or context wins. Reorder the files here to see how the effective configuration changes.
Why is an identical duplicate still shown?
It is harmless evidence today, but it means behavior depends on name and order. If one copy changes later, the other can become a silent conflicting shadow.
Can this tell whether my token works?
No. The tool records that a credential mechanism is present without sending, refreshing, or validating any credential.
Will the redacted copy work with kubectl?
It is intentionally not authentication-ready. Secrets and active exec commands are replaced so the file can be reviewed more safely.
Inspect a PKCS#12/PFX container · Browse PKI and DevOps tools