How to invalidate system admin kubeconfig

Issue

• How to invalidate a kubeconfig that was created for system:admin user during the installation?
• How to invalidate a client certificate for system:admin user in case of data leak?
• Is there option to create a new kubeconfig with new client certificate to replace the kubeconfig from the installation?
• How to prevent unauthorized access with the admin kubeconfig to the cluster?
• How to rotate the kubeconfigs on regular basis?