Every connection to the Kubernetes API of an Amazon Elastic Kubernetes Service (Amazon EKS) cluster relies on Transport Layer Security (TLS) certificates to secure connectivity. These certificates are signed by the cluster’s certificate authority (CA), which establishes trust between all connecting systems and the API server. When a client runs kubectl, when ArgoCD reconciles a deployment, when a kubelet on a worker node reports status, each of these connections authenticates against the API server using certificates that trace back to the cluster’s CA.
This is how Kubernetes works: The CA is the root of trust for the entire cluster. Like any certificate, CAs have a finite lifetime. When a CA reaches the end of its validity period, the certificates it signed can no longer be validated. Systems that depend on those certificates lose their ability to connect. CA rotation is the process of replacing the CA before this happens, transitioning the cluster to a successor CA while maintaining connectivity for all components throughout.
Amazon EKS clusters created since launch in 2018 have CAs with a 10-year validity period, and clusters from that era are now approaching the point where CA rotation activities should begin. With this launch, Amazon EKS provides a managed CA rotation lifecycle with automated safeguards that preserve cluster availability throughout the rotation process. You keep control to act on your own timeline. CA rotation is a shared responsibility. AWS automatically handles the components it manages on your behalf.
You are responsible for updating the components that only you can reach, such as your continuous integration and continuous delivery (CI/CD) pipelines, workstations, and worker nodes that are not managed by AWS. The sections that follow break down what this looks like in practice. A successful CA rotation means two things: Your cluster remains available (AWS safeguards keep it available), and all of your components maintain connectivity throughout the transition. The first is guaranteed by AWS. The second depends on you completing your side. This post walks through what that looks like end to end.