EKS / Client / delete_certificate_authority

delete_certificate_authority

EKS.Client.delete_certificate_authority(**kwargs)

Deletes a certificate authority (CA) from your cluster.

Deleting a certificate authority removes its public certificate from the cluster’s trust bundle. You can’t delete the certificate authority that’s currently signing certificates for the cluster (its signingStatus is IN_USE) — to remove the outgoing CA, first activate the successor CA with ActivateCertificateAuthority. Amazon EKS also protects a successor CA from deletion in certain cases to keep a valid rotation path — for example, a successor that Amazon EKS appended can’t be deleted while it’s the only successor on the cluster. This is an asynchronous operation that returns an update object.

See also: AWS API Documentation

Request Syntax

response = client.delete_certificate_authority(
    clusterName='string',
    certificateAuthorityId='string',
    clientRequestToken='string'
)
Parameters:

  • clusterName (string) –

    [REQUIRED]

    The name of your cluster.

  • certificateAuthorityId (string) –

    [REQUIRED]

    The ID of the certificate authority to delete. You can’t delete the certificate authority that’s currently signing certificates for the cluster.

  • clientRequestToken (string) –

    A unique, case-sensitive identifier that you provide to ensure the idempotency of the request.

    This field is autopopulated if not provided.

Return type:

dict

Returns:

Response Syntax

{
    'update': {
        'id': 'string',
        'status': 'InProgress'|'Failed'|'Cancelled'|'Successful',
        'type': 'VersionUpdate'|'EndpointAccessUpdate'|'LoggingUpdate'|'ConfigUpdate'|'AssociateIdentityProviderConfig'|'DisassociateIdentityProviderConfig'|'AssociateEncryptionConfig'|'AddonUpdate'|'VpcConfigUpdate'|'AccessConfigUpdate'|'UpgradePolicyUpdate'|'ZonalShiftConfigUpdate'|'AutoModeUpdate'|'RemoteNetworkConfigUpdate'|'DeletionProtectionUpdate'|'CapabilityUpdate'|'ControlPlaneScalingConfigUpdate'|'VendedLogsUpdate'|'ControlPlaneEgressUpdate'|'VersionRollback'|'ControlPlaneComponentConfigUpdate'|'CertificateAuthorityUpdate',
        'params': [
            {
                'type': 'Version'|'PlatformVersion'|'EndpointPrivateAccess'|'EndpointPublicAccess'|'ClusterLogging'|'DesiredSize'|'LabelsToAdd'|'LabelsToRemove'|'TaintsToAdd'|'TaintsToRemove'|'MaxSize'|'MinSize'|'ReleaseVersion'|'PublicAccessCidrs'|'LaunchTemplateName'|'LaunchTemplateVersion'|'IdentityProviderConfig'|'EncryptionConfig'|'AddonVersion'|'ServiceAccountRoleArn'|'ResolveConflicts'|'MaxUnavailable'|'MaxUnavailablePercentage'|'NodeRepairEnabled'|'UpdateStrategy'|'ConfigurationValues'|'SecurityGroups'|'Subnets'|'AuthenticationMode'|'PodIdentityAssociations'|'UpgradePolicy'|'ZonalShiftConfig'|'ComputeConfig'|'StorageConfig'|'KubernetesNetworkConfig'|'RemoteNetworkConfig'|'DeletionProtection'|'NodeRepairConfig'|'RoleArn'|'RoleMappingsToAddOrUpdate'|'RoleMappingsToRemove'|'NetworkAccess'|'VendedLogs'|'UpdatedTier'|'PreviousTier'|'WarmPoolEnabled'|'WarmPoolMaxGroupPreparedCapacity'|'WarmPoolMinSize'|'WarmPoolState'|'WarmPoolReuseOnScaleIn'|'ControlPlaneEgressMode'|'KubeApiServerConfig'|'KubeSchedulerConfig'|'KubeControllerManagerConfig'|'ActiveCertificateAuthority'|'TrustedCertificateAuthorities'|'CertificateAuthorityId'|'SigningStatus',
                'value': 'string'
            },
        ],
        'createdAt': datetime(2015, 1, 1),
        'errors': [
            {
                'errorCode': 'SubnetNotFound'|'SecurityGroupNotFound'|'EniLimitReached'|'IpNotAvailable'|'AccessDenied'|'OperationNotPermitted'|'VpcIdNotFound'|'Unknown'|'NodeCreationFailure'|'PodEvictionFailure'|'InsufficientFreeAddresses'|'ClusterUnreachable'|'InsufficientNumberOfReplicas'|'ConfigurationConflict'|'AdmissionRequestDenied'|'UnsupportedAddonModification'|'K8sResourceNotFound',
                'errorMessage': 'string',
                'resourceIds': [
                    'string',
                ]
            },
        ],
        'cancellation': {
            'status': 'InProgress'|'Failed'|'Successful',
            'reason': 'string'
        }
    },
    'certificateAuthority': {
        'id': 'string',
        'createdAt': datetime(2015, 1, 1),
        'createdBy': 'EKS'|'CUSTOMER',
        'activatedAt': datetime(2015, 1, 1),
        'activatedBy': 'EKS'|'CUSTOMER',
        'signingStatus': 'NOT_USED'|'ACTIVATING'|'IN_USE',
        'distributionStatus': 'IN_PROGRESS'|'COMPLETE'|'FAILED'|'DELETING'
    }
}

Response Structure

  • (dict) –

    • update (dict) –

      An object representing the asynchronous update that removes the certificate authority from the cluster’s trust bundle.

      • id (string) –

        A UUID that is used to track the update.

      • status (string) –

        The current status of the update.

      • type (string) –

        The type of the update.

      • params (list) –

        A key-value map that contains the parameters associated with the update.

        • (dict) –

          An object representing the details of an update request.

          • type (string) –

            The keys associated with an update request.

          • value (string) –

            The value of the keys submitted as part of an update request.

      • createdAt (datetime) –

        The Unix epoch timestamp at object creation.

      • errors (list) –

        Any errors associated with a Failed update.

        • (dict) –

          An object representing an error when an asynchronous operation fails.

          • errorCode (string) –

            A brief description of the error.

            • SubnetNotFound: We couldn’t find one of the subnets associated with the cluster.

            • SecurityGroupNotFound: We couldn’t find one of the security groups associated with the cluster.

            • EniLimitReached: You have reached the elastic network interface limit for your account.

            • IpNotAvailable: A subnet associated with the cluster doesn’t have any available IP addresses.

            • AccessDenied: You don’t have permissions to perform the specified operation.

            • OperationNotPermitted: The service role associated with the cluster doesn’t have the required access permissions for Amazon EKS.

            • VpcIdNotFound: We couldn’t find the VPC associated with the cluster.

          • errorMessage (string) –

            A more complete description of the error.

          • resourceIds (list) –

            An optional field that contains the resource IDs associated with the error.

            • (string) –

      • cancellation (dict) –

        The latest cancellation information for the update. This field is present only if any cancellation is attempted for the update.

        • status (string) –

          The current status of the cancellation. Valid values are InProgress, Failed, and Successful.

        • reason (string) –

          A message providing additional details about the cancellation, such as the reason for the cancellation or failure details.

    • certificateAuthority (dict) –

      Summary information about the certificate authority that is being deleted.

      • id (string) –

        The unique identifier of the certificate authority.

      • createdAt (datetime) –

        The Unix epoch timestamp in seconds for when the certificate authority was created.

      • createdBy (string) –

        The entity that created the certificate authority, either CUSTOMER or EKS.

      • activatedAt (datetime) –

        The Unix epoch timestamp in seconds for when the certificate authority was last activated. This value is absent if the certificate authority has never been activated.

      • activatedBy (string) –

        The entity that most recently activated the certificate authority, either CUSTOMER or EKS.

      • signingStatus (string) –

        The signing status of the certificate authority: IN_USE, ACTIVATING, or NOT_USED.

      • distributionStatus (string) –

        The distribution status of the certificate authority: IN_PROGRESS, COMPLETE, FAILED, or DELETING.

Exceptions