Every connection to the Kubernetes API of an Amazon Elastic Kubernetes Service (Amazon EKS) cluster relies on Transport Layer Security (TLS) certificates to secure connectivity. These certificates are signed by the cluster’s certificate authority (CA), which establishes trust between all connecting systems and the API server. When a client runs kubectl, when ArgoCD reconciles a deployment, when a kubelet on a worker node reports status, each of these connections authenticates against the API server using certificates that trace back to the cluster’s CA. This is how Kubernetes works: The CA is the root of trust for the entire cluster.
Like any certificate, CAs have a finite lifetime. When a CA reaches the end of its validity period, the certificates it signed can no longer be validated. Systems that depend on those certificates lose their ability to connect. CA rotation is the process of replacing the CA before this happens, transitioning the cluster to a…
https://aws.amazon.com/blogs/containers/deep-dive-into-amazon-eks-certificate-authority-rotation/