Amazon EKS Introduces Managed Certificate Authority Rotation with Safeguards
Amazon EKS now provides a managed certificate authority (CA) rotation lifecycle, simplifying the process for clusters approaching their 10-year CA expiration. This new capability includes automated safeguards to maintain cluster availability during rotation, such as auto-appending and auto-activating successor CAs, and a rollback option. CA rotation is a shared responsibility, with AWS handling managed components and customers responsible for updating their worker nodes and external clients like CI/CD pipelines. A dual-trust period allows incremental updates to client configurations before the new CA is fully activated.
- →Managed Certificate Authority Rotation for Amazon EKS
- →Automated Management and Safeguards for EKS Components
- →Shared Responsibility for Customer-Managed Components
Features (1) ›
- Managed Certificate Authority Rotation for Amazon EKS
Amazon EKS now offers a managed certificate authority (CA) rotation lifecycle, including automated safeguards to preserve cluster availability. This addresses the 10-year validity period of CAs, ensuring secure connectivity as clusters created in 2018-2019 approach their expiration.
Enhancements (1) ›
- Automated Management and Safeguards for EKS Components
AWS automatically handles the rotation for its managed components like the control plane, EKS Auto Mode, and AWS Fargate, updating them to trust the successor CA. Safeguards include automatic successor CA appending, auto-activation before expiration, and a self-service rollback option if connectivity issues arise. Notifications are provided via AWS Health and email.
Notes (1) ›
- Shared Responsibility for Customer-Managed Components
Customers are responsible for updating their self-managed worker nodes (managed node groups, Karpenter, self-managed) and external clients such as CI/CD pipelines, workstations, and GitOps controllers. A dual trust period allows the cluster to accept certificates signed by both outgoing and successor CAs simultaneously, enabling incremental updates to client configurations.
https://aws.amazon.com/blogs/containers/deep-dive-into-amazon-eks-certificate-authority-rotation/
Related releases
- Amazon EKS Capability for Argo CD adds custom configuration support AWS What's New ·
- AWS Local Zone in Las Vegas, Nevada, Now Generally Available AWS What's New ·
- Amazon EKS now supports certificate authority (CA) rotation with automated management AWS What's New ·
- Amazon EKS now supports advanced Kubernetes control plane configuration AWS What's New ·
- Amazon EKS 1.34+ enables forensic container checkpointing with Kubelet API AWS Containers Blog ·
- Amazon EKS introduces advanced Kubernetes control plane configuration AWS Containers Blog ·