CertificateAuthority

An object representing a certificate authority (CA) for an Amazon EKS cluster.

activatedAt

The Unix epoch timestamp in seconds for when the certificate authority was last activated as the cluster's signer. This value is absent if the certificate authority has never been activated.

Type: Timestamp

Required: No

activatedBy

The entity that most recently activated the certificate authority. A value of EKS indicates that Amazon EKS activated it automatically; CUSTOMER indicates that you activated it.

Type: String

Valid Values: EKS | CUSTOMER

Required: No

createdAt

The Unix epoch timestamp in seconds for when the certificate authority was created.

Type: Timestamp

Required: No

createdBy

The entity that created the certificate authority. Certificate authorities that you create are CUSTOMER; those that Amazon EKS provisions on your behalf, such as a cluster's initial certificate authority, are EKS.

Type: String

Valid Values: EKS | CUSTOMER

Required: No

data

The Base64-encoded public certificate of the certificate authority.

Type: String

Required: No

distributionStatus

The distribution status of the certificate authority, which tracks whether Amazon EKS has distributed its trust to the AWS managed components in your cluster (the control plane, Amazon EKS Auto Mode instances, and AWS Fargate nodes). Valid values are IN_PROGRESS, COMPLETE, FAILED, and DELETING. A successor CA can only be activated after its distribution status is COMPLETE.

Type: String

Valid Values: IN_PROGRESS | COMPLETE | FAILED | DELETING

Required: No

id

The unique identifier of the certificate authority.

Type: String

Required: No

rollbackAvailable

Indicates whether CA rollback is still available for this certificate authority. After you activate a successor CA, rollback lets you revert to the outgoing CA for a limited period while you finish updating any worker nodes or clients that were missed.

Type: Boolean

Required: No

scheduledEvents

The scheduled auto-activation events for the certificate authority, computed from its validity period.

Type: CertificateAuthorityScheduledEvents object

Required: No

signingStatus

The signing status of the certificate authority. IN_USE means the certificate authority is currently signing certificates for the cluster, ACTIVATING means it's being promoted to the signer, and NOT_USED means it's trusted by the cluster (for example, a successor CA during a rotation, or a retired outgoing CA) but isn't the signer.

Type: String

Valid Values: NOT_USED | ACTIVATING | IN_USE

Required: No

validity

The validity period of the certificate authority's certificate.

Type: CertificateAuthorityValidity object

Required: No

CertificateAuthority

Contents

See Also