Amazon EKS now supports certificate authority (CA) rotation with automated lifecycle management

Amazon EKS now supports certificate authority (CA) rotation with automated lifecycle management and safeguards. Clusters created since 2018 have CAs with a 10-year validity period and are approaching the point where rotation is needed. Amazon EKS manages the rotation lifecycle and automatically updates AWS-managed components to trust the new CA. Customers are responsible for replacing worker nodes and updating external clients to trust the new CA before activation. EKS Auto Mode and AWS Fargate nodes are updated automatically, but customers must still update any external clients connecting to the cluster's API server. Automated safeguards include advance notifications before CA expiration, automatic addition of a successor CA if not created by the customer, and automatic activation if the customer does not activate on schedule. A rollback capability allows reverting to the previous CA to resolve any issues during the transition. CA rotation is available at no additional cost in all commercial AWS Regions, accessible via AWS CLI, EKS APIs, CloudFormation, and the AWS console

Why it matters

This update affects all Amazon EKS users, particularly those needing to ensure cluster security and continuous operation