EKS / Client / describe_certificate_authority

describe_certificate_authority

EKS.Client.describe_certificate_authority(**kwargs)

Returns detailed information about a certificate authority (CA) in your cluster, including its validity period, signing and distribution status, provenance, scheduled auto-activation events, and public certificate data.

See also: AWS API Documentation

Request Syntax

response = client.describe_certificate_authority(
    clusterName='string',
    certificateAuthorityId='string'
)
Parameters:

  • clusterName (string) –

    [REQUIRED]

    The name of your cluster.

  • certificateAuthorityId (string) –

    [REQUIRED]

    The ID of the certificate authority to describe.

Return type:

dict

Returns:

Response Syntax

{
    'certificateAuthority': {
        'id': 'string',
        'createdAt': datetime(2015, 1, 1),
        'createdBy': 'EKS'|'CUSTOMER',
        'activatedAt': datetime(2015, 1, 1),
        'activatedBy': 'EKS'|'CUSTOMER',
        'signingStatus': 'NOT_USED'|'ACTIVATING'|'IN_USE',
        'distributionStatus': 'IN_PROGRESS'|'COMPLETE'|'FAILED'|'DELETING',
        'validity': {
            'notBefore': datetime(2015, 1, 1),
            'notAfter': datetime(2015, 1, 1)
        },
        'scheduledEvents': {
            'firstAutoActivation': datetime(2015, 1, 1),
            'finalAutoActivation': datetime(2015, 1, 1)
        },
        'rollbackAvailable': True|False,
        'data': 'string'
    }
}

Response Structure

  • (dict) –

    • certificateAuthority (dict) –

      An object containing detailed information about the certificate authority.

      • id (string) –

        The unique identifier of the certificate authority.

      • createdAt (datetime) –

        The Unix epoch timestamp in seconds for when the certificate authority was created.

      • createdBy (string) –

        The entity that created the certificate authority. Certificate authorities that you create are CUSTOMER; those that Amazon EKS provisions on your behalf, such as a cluster’s initial certificate authority, are EKS.

      • activatedAt (datetime) –

        The Unix epoch timestamp in seconds for when the certificate authority was last activated as the cluster’s signer. This value is absent if the certificate authority has never been activated.

      • activatedBy (string) –

        The entity that most recently activated the certificate authority. A value of EKS indicates that Amazon EKS activated it automatically; CUSTOMER indicates that you activated it.

      • signingStatus (string) –

        The signing status of the certificate authority. IN_USE means the certificate authority is currently signing certificates for the cluster, ACTIVATING means it’s being promoted to the signer, and NOT_USED means it’s trusted by the cluster (for example, a successor CA during a rotation, or a retired outgoing CA) but isn’t the signer.

      • distributionStatus (string) –

        The distribution status of the certificate authority, which tracks whether Amazon EKS has distributed its trust to the Amazon Web Services managed components in your cluster (the control plane, Amazon EKS Auto Mode instances, and Amazon Web Services Fargate nodes). Valid values are IN_PROGRESS, COMPLETE, FAILED, and DELETING. A successor CA can only be activated after its distribution status is COMPLETE.

      • validity (dict) –

        The validity period of the certificate authority’s certificate.

        • notBefore (datetime) –

          The Unix epoch timestamp in seconds for the start of the certificate authority’s validity period.

        • notAfter (datetime) –

          The Unix epoch timestamp in seconds for the end of the certificate authority’s validity period.

      • scheduledEvents (dict) –

        The scheduled auto-activation events for the certificate authority, computed from its validity period.

        • firstAutoActivation (datetime) –

          The earliest Unix epoch timestamp in seconds at which Amazon EKS may automatically activate this certificate authority.

        • finalAutoActivation (datetime) –

          The Unix epoch timestamp in seconds by which Amazon EKS will automatically activate this certificate authority if you haven’t already activated it.

      • rollbackAvailable (boolean) –

        Indicates whether CA rollback is still available for this certificate authority. After you activate a successor CA, rollback lets you revert to the outgoing CA for a limited period while you finish updating any worker nodes or clients that were missed.

      • data (string) –

        The Base64-encoded public certificate of the certificate authority.

Exceptions