Deep dive into Amazon EKS certificate authority rotation

This article explains Amazon EKS's new managed certificate authority (CA) rotation lifecycle, which automatically handles AWS-managed components while requiring customers to update their own infrastructure.

• AWS automatically appends successor CA, distributes to managed components, and provides auto-activation safeguards before CA expiration
• Customers must update managed node groups, Karpenter nodes, kubeconfig files, CI/CD pipelines, and external clients during the dual trust period
• Dual trust period allows both old and new CAs to be trusted simultaneously, enabling incremental component updates without coordination pressure
• AWS sends notifications at each rotation stage and provides API queries to track progress and check rollback availability
• CA rollback is available after activation to revert to the outgoing CA if connectivity issues arise with updated components
• Successor CA has 5-year validity, resetting the rotation clock for clusters originally created in 2018 with 10-year CAs

The managed rotation process balances AWS automation with customer control, ensuring cluster availability while giving teams flexibility to update components on their own timeline.