Amazon Elastic Kubernetes Service added a certificate authority rotation feature that automates the managed lifecycle of cluster CAs responsible for encrypted API connections. This facilitates proactive CA rotation before expiration without service disruption, addressing the impending need for key updates in clusters created since 2018, which have 10-year CA validity.
AWS manages rotation lifecycle and updates managed components while customers must update worker nodes and external clients, except for nodes updated automatically by AWS such as Fargate. Automated safeguards include advance warnings, rollbacks, and automatic activation options, all without extra cost and globally available in commercial AWS regions.
Source & further reading
Amazon EKS now supports certificate authority (CA) rotation with automated lifecycle management ↗Source published 2026-08-20. This report was prepared with AI assistance from the linked primary-source material. Claims and limitations should be checked against the original announcement or research.