Invalidate token when az logout

[antoineozenne]

The access token in ~/.kube/cache/kubelogin is valid for 1 hour and is not invalidated when we logout with the command az logout. My kubelogin command is configured with --login azurecli. So, if :

• I login as a user A: az login -u A
• I get an access token which is cached in ~/.kube/cache/kubelogin.
• I logout: az logout
• I login as a user B: az login -u B
• I have the access token of the user A valid for 1 hour, so I have the privileges (because of the groups present in the token) of the user A.

I think this is a critical security issue. Is it possible to invalidate the access token when logout ? Or, at least, remove the access token in cache, but this is not sufficient I think.

[weinong]

i think we can disable token cache in azurecli mode.

[weinong]

fixed in v0.0.21