EKS / Client / create_certificate_authority

create_certificate_authority

EKS.Client.create_certificate_authority(**kwargs)

Appends a successor certificate authority (CA) to your cluster, beginning the CA rotation process.

A cluster certificate authority is the root of trust for your cluster’s control plane. It signs the certificates that secure communication between the Kubernetes API server and its clients, and its public certificate is distributed to your cluster’s trust bundle so that worker nodes and clients can verify the API server’s identity. Each cluster can have at most two certificate authorities at a time: the outgoing CA that’s currently signing (its signingStatus is IN_USE) and one successor CA ( signingStatus of NOT_USED) that you can later activate to complete the rotation.

Appending a successor CA adds its public certificate to the cluster’s trust bundle so that the cluster trusts both CAs simultaneously (the dual trust period), but it doesn’t begin signing certificates. Amazon EKS then distributes the successor CA to the Amazon Web Services managed components in your cluster; you can track this through the CA’s distributionStatus. The successor CA can’t be activated until its distributionStatus is COMPLETE. To activate it as the cluster’s signer, use ActivateCertificateAuthority. This is an asynchronous operation that returns an update object. If you don’t append a successor CA yourself, Amazon EKS appends one automatically before the outgoing CA approaches expiration.

For more information, see Rotate the Amazon EKS cluster certificate authority in the Amazon EKS User Guide.

See also: AWS API Documentation

Request Syntax

response = client.create_certificate_authority(
    clusterName='string',
    clientRequestToken='string'
)

Parameters:

• clusterName (string) –

  [REQUIRED]

  The name of your cluster.

• clientRequestToken (string) –

  A unique, case-sensitive identifier that you provide to ensure the idempotency of the request.

  This field is autopopulated if not provided.

Return type:

dict

Returns:

Response Syntax

{
    'update': {
        'id': 'string',
        'status': 'InProgress'|'Failed'|'Cancelled'|'Successful',
        'type': 'VersionUpdate'|'EndpointAccessUpdate'|'LoggingUpdate'|'ConfigUpdate'|'AssociateIdentityProviderConfig'|'DisassociateIdentityProviderConfig'|'AssociateEncryptionConfig'|'AddonUpdate'|'VpcConfigUpdate'|'AccessConfigUpdate'|'UpgradePolicyUpdate'|'ZonalShiftConfigUpdate'|'AutoModeUpdate'|'RemoteNetworkConfigUpdate'|'DeletionProtectionUpdate'|'CapabilityUpdate'|'ControlPlaneScalingConfigUpdate'|'VendedLogsUpdate'|'ControlPlaneEgressUpdate'|'VersionRollback'|'ControlPlaneComponentConfigUpdate'|'CertificateAuthorityUpdate',
        'params': [
            {
                'type': 'Version'|'PlatformVersion'|'EndpointPrivateAccess'|'EndpointPublicAccess'|'ClusterLogging'|'DesiredSize'|'LabelsToAdd'|'LabelsToRemove'|'TaintsToAdd'|'TaintsToRemove'|'MaxSize'|'MinSize'|'ReleaseVersion'|'PublicAccessCidrs'|'LaunchTemplateName'|'LaunchTemplateVersion'|'IdentityProviderConfig'|'EncryptionConfig'|'AddonVersion'|'ServiceAccountRoleArn'|'ResolveConflicts'|'MaxUnavailable'|'MaxUnavailablePercentage'|'NodeRepairEnabled'|'UpdateStrategy'|'ConfigurationValues'|'SecurityGroups'|'Subnets'|'AuthenticationMode'|'PodIdentityAssociations'|'UpgradePolicy'|'ZonalShiftConfig'|'ComputeConfig'|'StorageConfig'|'KubernetesNetworkConfig'|'RemoteNetworkConfig'|'DeletionProtection'|'NodeRepairConfig'|'RoleArn'|'RoleMappingsToAddOrUpdate'|'RoleMappingsToRemove'|'NetworkAccess'|'VendedLogs'|'UpdatedTier'|'PreviousTier'|'WarmPoolEnabled'|'WarmPoolMaxGroupPreparedCapacity'|'WarmPoolMinSize'|'WarmPoolState'|'WarmPoolReuseOnScaleIn'|'ControlPlaneEgressMode'|'KubeApiServerConfig'|'KubeSchedulerConfig'|'KubeControllerManagerConfig'|'ActiveCertificateAuthority'|'TrustedCertificateAuthorities'|'CertificateAuthorityId'|'SigningStatus',
                'value': 'string'
            },
        ],
        'createdAt': datetime(2015, 1, 1),
        'errors': [
            {
                'errorCode': 'SubnetNotFound'|'SecurityGroupNotFound'|'EniLimitReached'|'IpNotAvailable'|'AccessDenied'|'OperationNotPermitted'|'VpcIdNotFound'|'Unknown'|'NodeCreationFailure'|'PodEvictionFailure'|'InsufficientFreeAddresses'|'ClusterUnreachable'|'InsufficientNumberOfReplicas'|'ConfigurationConflict'|'AdmissionRequestDenied'|'UnsupportedAddonModification'|'K8sResourceNotFound',
                'errorMessage': 'string',
                'resourceIds': [
                    'string',
                ]
            },
        ],
        'cancellation': {
            'status': 'InProgress'|'Failed'|'Successful',
            'reason': 'string'
        }
    },
    'certificateAuthority': {
        'id': 'string',
        'createdAt': datetime(2015, 1, 1),
        'createdBy': 'EKS'|'CUSTOMER',
        'activatedAt': datetime(2015, 1, 1),
        'activatedBy': 'EKS'|'CUSTOMER',
        'signingStatus': 'NOT_USED'|'ACTIVATING'|'IN_USE',
        'distributionStatus': 'IN_PROGRESS'|'COMPLETE'|'FAILED'|'DELETING'
    }
}

Response Structure

• (dict) –

  • update (dict) –

    An object representing the asynchronous update that adds the certificate authority to the cluster’s trust bundle.

    • id (string) –

      A UUID that is used to track the update.

    • status (string) –

      The current status of the update.

    • type (string) –

      The type of the update.

    • params (list) –

      A key-value map that contains the parameters associated with the update.

      • (dict) –

        An object representing the details of an update request.

        • type (string) –

          The keys associated with an update request.

        • value (string) –

          The value of the keys submitted as part of an update request.

    • createdAt (datetime) –

      The Unix epoch timestamp at object creation.

    • errors (list) –

      Any errors associated with a Failed update.

      • (dict) –

        An object representing an error when an asynchronous operation fails.

        • errorCode (string) –

          A brief description of the error.

          • SubnetNotFound: We couldn’t find one of the subnets associated with the cluster.

          • SecurityGroupNotFound: We couldn’t find one of the security groups associated with the cluster.

          • EniLimitReached: You have reached the elastic network interface limit for your account.

          • IpNotAvailable: A subnet associated with the cluster doesn’t have any available IP addresses.

          • AccessDenied: You don’t have permissions to perform the specified operation.

          • OperationNotPermitted: The service role associated with the cluster doesn’t have the required access permissions for Amazon EKS.

          • VpcIdNotFound: We couldn’t find the VPC associated with the cluster.

        • errorMessage (string) –

          A more complete description of the error.

        • resourceIds (list) –

          An optional field that contains the resource IDs associated with the error.

          • (string) –

    • cancellation (dict) –

      The latest cancellation information for the update. This field is present only if any cancellation is attempted for the update.

      • status (string) –

        The current status of the cancellation. Valid values are InProgress, Failed, and Successful.

      • reason (string) –

        A message providing additional details about the cancellation, such as the reason for the cancellation or failure details.

  • certificateAuthority (dict) –

    Summary information about the certificate authority that was created, including its ID and initial signing and distribution status.

    • id (string) –

      The unique identifier of the certificate authority.

    • createdAt (datetime) –

      The Unix epoch timestamp in seconds for when the certificate authority was created.

    • createdBy (string) –

      The entity that created the certificate authority, either CUSTOMER or EKS.

    • activatedAt (datetime) –

      The Unix epoch timestamp in seconds for when the certificate authority was last activated. This value is absent if the certificate authority has never been activated.

    • activatedBy (string) –

      The entity that most recently activated the certificate authority, either CUSTOMER or EKS.

    • signingStatus (string) –

      The signing status of the certificate authority: IN_USE, ACTIVATING, or NOT_USED.

    • distributionStatus (string) –

      The distribution status of the certificate authority: IN_PROGRESS, COMPLETE, FAILED, or DELETING.

Exceptions

• EKS.Client.exceptions.ResourceNotFoundException

• EKS.Client.exceptions.ResourceLimitExceededException

• EKS.Client.exceptions.InvalidParameterException

• EKS.Client.exceptions.ResourceInUseException

• EKS.Client.exceptions.ServerException

• EKS.Client.exceptions.ServiceUnavailableException