aws AWS Containers Blog ·

Amazon EKS Introduces Managed Certificate Authority Rotation with Safeguards

blogsecurityawsgaengineeraws-eks
feature

Amazon EKS now provides a managed certificate authority (CA) rotation lifecycle, simplifying the process for clusters approaching their 10-year CA expiration. This new capability includes automated safeguards to maintain cluster availability during rotation, such as auto-appending and auto-activating successor CAs, and a rollback option. CA rotation is a shared responsibility, with AWS handling managed components and customers responsible for updating their worker nodes and external clients like CI/CD pipelines. A dual-trust period allows incremental updates to client configurations before the new CA is fully activated.

  • Managed Certificate Authority Rotation for Amazon EKS
  • Automated Management and Safeguards for EKS Components
  • Shared Responsibility for Customer-Managed Components
Features (1)
  • Managed Certificate Authority Rotation for Amazon EKS

    Amazon EKS now offers a managed certificate authority (CA) rotation lifecycle, including automated safeguards to preserve cluster availability. This addresses the 10-year validity period of CAs, ensuring secure connectivity as clusters created in 2018-2019 approach their expiration.

Enhancements (1)
  • Automated Management and Safeguards for EKS Components

    AWS automatically handles the rotation for its managed components like the control plane, EKS Auto Mode, and AWS Fargate, updating them to trust the successor CA. Safeguards include automatic successor CA appending, auto-activation before expiration, and a self-service rollback option if connectivity issues arise. Notifications are provided via AWS Health and email.

Notes (1)
  • Shared Responsibility for Customer-Managed Components

    Customers are responsible for updating their self-managed worker nodes (managed node groups, Karpenter, self-managed) and external clients such as CI/CD pipelines, workstations, and GitOps controllers. A dual trust period allows the cluster to accept certificates signed by both outgoing and successor CAs simultaneously, enabling incremental updates to client configurations.

Read the original announcement →

https://aws.amazon.com/blogs/containers/deep-dive-into-amazon-eks-certificate-authority-rotation/

Related releases