Deep dive into Amazon EKS certificate authority rotation

Sicherheitsmeldung mit Schweregrad noch nicht bewertet. Technische Details im Tab „Originaltext“; empfohlene Schritte in der Checkliste.

Originaltext der Quelle (nicht übersetzt) – die deutsche Zusammenfassung findest du im Tab „Kurzfassung".

Every connection to the Kubernetes API of an Amazon Elastic Kubernetes Service (Amazon EKS) cluster relies on Transport Layer Security (TLS) certificates to secure connectivity. These certificates are signed by the cluster’s certificate authority (CA), which establishes trust between all connecting systems and the API server. When a client runs kubectl, when ArgoCD reconciles a deployment, when a kubelet on a worker node reports status, each of these connections authenticates against the API server using certificates that trace back to the cluster’s CA. This is how Kubernetes works: The CA is the root of trust for the entire cluster. Like any certificate, CAs have a finite lifetime. When a CA reaches the end of its validity period, the certificates it signed can no longer be validated. Systems that depend on those certificates lose their ability to connect. CA rotation is the process of replacing the CA before this happens, transitioning the cluster to a successor CA while maintaining connectivity for all components throughout. Amazon EKS clusters created since launch in 2018 have CAs with a 10-year validity period, and clusters from that era are now approaching the point where CA rotation activities should begin. With this launch, Amazon EKS provides a managed CA rotation lifecycle with automated safeguards that preserve cluster availability throughout the rotation process. You keep control to act on your own timeline. CA rotation is a shared responsibility. AWS automatically handles the components it manages on your behalf. You are responsible for updating the …

Vollständiger Originalartikel ↗

• Betroffenheit im eigenen Stack prüfen: Versionen/Komponenten abgleichen.
• Originalquelle / Hersteller-Advisory lesen: https://aws.amazon.com/blogs/containers/deep-dive-into-amazon-eks-certificate-authority-rotation/
• Verfügbaren Patch oder Workaround einspielen und dokumentieren.