SourceAmazon EKS now supports certificate authority (CA) rotation with automated lifecycle management
Users with older EKS clusters must perform this rotation to avoid service disruptions caused by expired certificates. It provides a way to maintain security without risking downtime through automated safeguards and rollback capabilities.
- Enables rotation of cluster Certificate Authorities (CAs) with 10-year validity periods approaching expiration for clusters created since 2018
- Operates as a shared responsibility model where AWS automatically updates AWS-managed components, EKS Auto Mode instances, and AWS Fargate nodes
- Includes automated safeguards such as advance notifications, automatic appending of successor CAs, and automatic activation if not scheduled by customers
- Provides a rollback capability to revert to the previous CA to resolve any issues during the update transition
- Available at no additional cost in all commercial AWS Regions via AWS CLI, EKS APIs, CloudFormation, and the AWS console