tag: Certificate-Management · 4 items
- Platform/SRE — Plan: Enable EKS Dashboard trusted access via AWS Organizations to get consolidated CA rotation status across all clusters and regions — clusters created since 2018 carry 10-year CAs that are now entering the window where rotation planning should begin. No hard expiration deadline is cited, but this is a free GA capability worth enabling this quarter to surface clusters approaching rotation.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Plan: If you operate AWS Private CA, the new IssueCertificateDetails CloudTrail management event (auto-delivered, no opt-in) enables compliance auditing and failed-issuance alerting that wasn’t possible before; schedule a review of your CloudTrail-based monitoring to add rules for this event, including pre-signing failures and algorithm tracking.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Plan: GovCloud operators running EKS with cert-manager and service meshes like Istio or Linkerd should evaluate adopting the Private CA EKS add-on to automate TLS certificate lifecycle; no deadline, but it simplifies a previously manual integration.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Plan: EKS clusters created in 2018 have 10-year CAs now approaching expiry (~2028); audit cluster creation dates and schedule CA rotation this quarter — worker nodes must be replaced and external API clients updated to trust the successor CA before activation, which AWS will not do automatically.
- CI/CD — Learn: Pipelines that connect directly to EKS API servers (kubectl, Helm deploys, kubeconfig-based auth) qualify as external clients under the shared-responsibility model and would need CA trust updates during any rotation; no immediate action required but worth noting when rotation is scheduled by Platform.
- Leader — Skip