/AWS1/CL_EKSCERTAUTHORITY

An object representing a certificate authority (CA) for an Amazon EKS cluster.

CONSTRUCTOR

IMPORTING

Optional arguments:

iv_id TYPE /AWS1/EKSSTRING /AWS1/EKSSTRING

The unique identifier of the certificate authority.

iv_createdat TYPE /AWS1/EKSTIMESTAMP /AWS1/EKSTIMESTAMP

The Unix epoch timestamp in seconds for when the certificate authority was created.

iv_createdby TYPE /AWS1/EKSCERTAUTHCREATEDBY /AWS1/EKSCERTAUTHCREATEDBY

The entity that created the certificate authority. Certificate authorities that you create are CUSTOMER; those that Amazon EKS provisions on your behalf, such as a cluster's initial certificate authority, are EKS.

iv_activatedat TYPE /AWS1/EKSTIMESTAMP /AWS1/EKSTIMESTAMP

The Unix epoch timestamp in seconds for when the certificate authority was last activated as the cluster's signer. This value is absent if the certificate authority has never been activated.

iv_activatedby TYPE /AWS1/EKSCERTAUTHACTIVATEDBY /AWS1/EKSCERTAUTHACTIVATEDBY

The entity that most recently activated the certificate authority. A value of EKS indicates that Amazon EKS activated it automatically; CUSTOMER indicates that you activated it.

iv_signingstatus TYPE /AWS1/EKSCERTAUTHSIGNINGSTATUS /AWS1/EKSCERTAUTHSIGNINGSTATUS

The signing status of the certificate authority. IN_USE means the certificate authority is currently signing certificates for the cluster, ACTIVATING means it's being promoted to the signer, and NOT_USED means it's trusted by the cluster (for example, a successor CA during a rotation, or a retired outgoing CA) but isn't the signer.

iv_distributionstatus TYPE /AWS1/EKSCERTAUTHDISTRIBSTATUS /AWS1/EKSCERTAUTHDISTRIBSTATUS

The distribution status of the certificate authority, which tracks whether Amazon EKS has distributed its trust to the Amazon Web Services managed components in your cluster (the control plane, Amazon EKS Auto Mode instances, and Amazon Web Services Fargate nodes). Valid values are IN_PROGRESS, COMPLETE, FAILED, and DELETING. A successor CA can only be activated after its distribution status is COMPLETE.

io_validity TYPE REF TO /AWS1/CL_EKSCERTAUTHVALIDITY /AWS1/CL_EKSCERTAUTHVALIDITY

The validity period of the certificate authority's certificate.

io_scheduledevents TYPE REF TO /AWS1/CL_EKSCERTAUTHSCHDEVENTS /AWS1/CL_EKSCERTAUTHSCHDEVENTS

The scheduled auto-activation events for the certificate authority, computed from its validity period.

iv_rollbackavailable TYPE /AWS1/EKSBOXEDBOOLEAN /AWS1/EKSBOXEDBOOLEAN

Indicates whether CA rollback is still available for this certificate authority. After you activate a successor CA, rollback lets you revert to the outgoing CA for a limited period while you finish updating any worker nodes or clients that were missed.

iv_data TYPE /AWS1/EKSSTRING /AWS1/EKSSTRING

The Base64-encoded public certificate of the certificate authority.

---

Queryable Attributes

id

The unique identifier of the certificate authority.

Accessible with the following methods

Method	Description
GET_ID()	Getter for ID, with configurable default
ASK_ID()	Getter for ID w/ exceptions if field has no value
HAS_ID()	Determine if ID has a value

createdAt

The Unix epoch timestamp in seconds for when the certificate authority was created.

Accessible with the following methods

Method	Description
GET_CREATEDAT()	Getter for CREATEDAT, with configurable default
ASK_CREATEDAT()	Getter for CREATEDAT w/ exceptions if field has no value
HAS_CREATEDAT()	Determine if CREATEDAT has a value

createdBy

The entity that created the certificate authority. Certificate authorities that you create are CUSTOMER; those that Amazon EKS provisions on your behalf, such as a cluster's initial certificate authority, are EKS.

Accessible with the following methods

Method	Description
GET_CREATEDBY()	Getter for CREATEDBY, with configurable default
ASK_CREATEDBY()	Getter for CREATEDBY w/ exceptions if field has no value
HAS_CREATEDBY()	Determine if CREATEDBY has a value

activatedAt

The Unix epoch timestamp in seconds for when the certificate authority was last activated as the cluster's signer. This value is absent if the certificate authority has never been activated.

Accessible with the following methods

Method	Description
GET_ACTIVATEDAT()	Getter for ACTIVATEDAT, with configurable default
ASK_ACTIVATEDAT()	Getter for ACTIVATEDAT w/ exceptions if field has no value
HAS_ACTIVATEDAT()	Determine if ACTIVATEDAT has a value

activatedBy

The entity that most recently activated the certificate authority. A value of EKS indicates that Amazon EKS activated it automatically; CUSTOMER indicates that you activated it.

Accessible with the following methods

Method	Description
GET_ACTIVATEDBY()	Getter for ACTIVATEDBY, with configurable default
ASK_ACTIVATEDBY()	Getter for ACTIVATEDBY w/ exceptions if field has no value
HAS_ACTIVATEDBY()	Determine if ACTIVATEDBY has a value

signingStatus

The signing status of the certificate authority. IN_USE means the certificate authority is currently signing certificates for the cluster, ACTIVATING means it's being promoted to the signer, and NOT_USED means it's trusted by the cluster (for example, a successor CA during a rotation, or a retired outgoing CA) but isn't the signer.

Accessible with the following methods

Method	Description
GET_SIGNINGSTATUS()	Getter for SIGNINGSTATUS, with configurable default
ASK_SIGNINGSTATUS()	Getter for SIGNINGSTATUS w/ exceptions if field has no value
HAS_SIGNINGSTATUS()	Determine if SIGNINGSTATUS has a value

distributionStatus

The distribution status of the certificate authority, which tracks whether Amazon EKS has distributed its trust to the Amazon Web Services managed components in your cluster (the control plane, Amazon EKS Auto Mode instances, and Amazon Web Services Fargate nodes). Valid values are IN_PROGRESS, COMPLETE, FAILED, and DELETING. A successor CA can only be activated after its distribution status is COMPLETE.

Accessible with the following methods

Method	Description
GET_DISTRIBUTIONSTATUS()	Getter for DISTRIBUTIONSTATUS, with configurable default
ASK_DISTRIBUTIONSTATUS()	Getter for DISTRIBUTIONSTATUS w/ exceptions if field has no
HAS_DISTRIBUTIONSTATUS()	Determine if DISTRIBUTIONSTATUS has a value

validity

The validity period of the certificate authority's certificate.

Accessible with the following methods

Method	Description
GET_VALIDITY()	Getter for VALIDITY

scheduledEvents

The scheduled auto-activation events for the certificate authority, computed from its validity period.

Accessible with the following methods

Method	Description
GET_SCHEDULEDEVENTS()	Getter for SCHEDULEDEVENTS

rollbackAvailable

Indicates whether CA rollback is still available for this certificate authority. After you activate a successor CA, rollback lets you revert to the outgoing CA for a limited period while you finish updating any worker nodes or clients that were missed.

Accessible with the following methods

Method	Description
GET_ROLLBACKAVAILABLE()	Getter for ROLLBACKAVAILABLE, with configurable default
ASK_ROLLBACKAVAILABLE()	Getter for ROLLBACKAVAILABLE w/ exceptions if field has no v
HAS_ROLLBACKAVAILABLE()	Determine if ROLLBACKAVAILABLE has a value

data

The Base64-encoded public certificate of the certificate authority.

Accessible with the following methods

Method	Description
GET_DATA()	Getter for DATA, with configurable default
ASK_DATA()	Getter for DATA w/ exceptions if field has no value
HAS_DATA()	Determine if DATA has a value