---
格式版本: 2
标题: "Amazon EKS now supports certificate authority (CA) rotation with automated lifecycle management"
原文链接: "https://aws.amazon.com/cn/about-aws/whats-new/2026/08/amazon-eks-certificate-authority-ca-rotation-automated-lifecycle-management/"
发布日期: "2026-08-20"
发布时间校准状态: "found"
发布时间需复核: "否"
发布时间来源: "llm:local:original_script_field"
发布时间证据: "postDateTime: 2026-08-20T18:30:00Z"
发布时间校准原因: "候选日期来自原始脚本字段postDateTime，符合文章发布时间标注，且标题/URL日期一致。"
发布时间校准置信度: "1"
发布时间候选数量: 1
发布时间严格候选数量: 0
发布时间原页读取状态: "source template page reused from URL open"
发布时间未找到原因: ""
发布时间校准时间: "2026-08-21T09:55:15+08:00"
发布时间仲裁状态: "confirmed"
发布时间仲裁尝试次数: 1
发布时间仲裁耗时毫秒: 8051
发现时间: "2026-08-21T09:50:45+08:00"
入库时间: "2026-08-21T01:55:25.319Z"
来源平台: "固定入口"
搜索渠道: "fixed_url"
搜索词: "https://aws.amazon.com/new"
匹配关键词:
  []
相关厂家:
  - "AWS"
相关专家:
  []
内容类型: "网页"
抓取工具: "Free Fetch + Defuddle"
清洗工具: "Defuddle Markdown + Defuddle/Readability 正文提取"
原始附件:
  []
AI优质: "否"
AI打分: 23
AI分档: "非优质"
AI质检状态: "不通过"
AI打分理由: "内容为Amazon EKS证书轮换功能公告，与超节点/AI Rack/机柜级AI基础设施完全无关，无技术或商业参考价值。"
AI质检模型: "ali-deepseek-v4-flash"
AI质检时间: "2026-08-21T09:55:38+08:00"
AI主题相关性: 0
AI来源权威性: 15
AI新颖性: 0
AI技术细节: 0
AI商业部署信号: 0
AI完整性: 8
AI摘要: "亚马逊EKS推出证书颁发机构（CA）轮换功能，通过托管生命周期与自动保护在CA到期前完成集群安全轮换。"
AI摘要模型: "ali-deepseek-v4-flash"
AI摘要时间: "2026-09-07T02:13:47.690Z"
采集批次: "2026年8月21日9点50分40秒"
采集批次ID: "20260821-095040-035"
去重键: "https://aws.amazon.com/cn/about-aws/whats-new/2026/08/amazon-eks-certificate-authority-ca-rotation-automated-lifecycle-management"
---

Today, Amazon Elastic Kubernetes Service (Amazon EKS) announced certificate authority (CA) rotation, enabling customers to rotate their cluster's CA through a managed lifecycle with automated safeguards. Each Amazon EKS cluster has its own CA that allows encrypted connections to the cluster's Kubernetes API, and now you can rotate the CA before it expires to ensure your cluster remains operational and secure.

Amazon EKS clusters created since launch in 2018 have CAs with a 10-year validity period, and clusters from that era are now approaching the point where CA rotation activities should begin. CA rotation in Amazon EKS is a shared responsibility. Amazon EKS manages the rotation lifecycle and automatically updates AWS-managed components to trust the successor CA. Customers are responsible for replacing their worker nodes and updating external clients to trust the successor CA before it is activated. EKS Auto Mode instances and AWS Fargate nodes are updated automatically by AWS, but customers are still responsible for updating any external clients that connect to the cluster's API server. Amazon EKS provides automated safeguards to support customers through this process, including advance notifications before CA expiration, automatic appending of a successor CA if one is not created by the customer, and automatic activation if the customer does not activate on their own schedule. A rollback capability allows customers to revert to the previous CA to resolve any issues that may arise with their updates during the transition to the successor CA.

Amazon EKS CA rotation is available at no additional cost in all commercial AWS Regions. To get started with CA rotation, you can use the AWS CLI, EKS APIs, CloudFormation, and the AWS console. For more information, see the [Amazon EKS documentation](https://docs.aws.amazon.com/eks/latest/userguide/certificate-authority-rotation.html) and [Deep dive into Amazon EKS certificate authority rotation](https://aws.amazon.com/blogs/containers/deep-dive-into-amazon-eks-certificate-authority-rotation/).