Amazon EKS Eks Certificate Authorities API

openapi: 3.1.0
info:
  title: Amazon Elastic Kubernetes Service Certificate Authorities API
  version: '2017-11-01'
  description: Generated from AWS's published Smithy model for Amazon Elastic Kubernetes Service. 4 operation(s).
  contact:
    name: Amazon Web Services
    url: https://aws.amazon.com/contact-us/
  license:
    name: Apache 2.0
    identifier: Apache-2.0
    url: https://github.com/aws/api-models-aws/blob/main/LICENSE
servers:
- url: https://eks.{region}.amazonaws.com
  variables:
    region:
      default: us-east-1
security:
- sigv4: []
paths:
  /clusters/{clusterName}/certificate-authorities:
    post:
      operationId: CreateCertificateAuthority
      summary: Create Certificate Authority
      description: 'Appends a successor certificate authority (CA) to your cluster, beginning the CA rotation process. A cluster
        certificate authority is the root of trust for your cluster''s control plane. It signs the certificates that secure
        communication between the Kubernetes API server and its clients, and its public certificate is distributed to your
        cluster''s trust bundle so that worker nodes and clients can verify the API server''s identity. Each cluster can have
        at most two certificate authorities at a time: the outgoing CA that''s currently signing (its signingStatus is IN_USE)
        and one successor CA (signingStatus of NOT_USED) that you can later activate to complete the rotation. Appending a
        successor CA adds its public certificate to the cluster''s trust bundle so that the cluster trusts both CAs simultaneously
        (the dual trust period), but it doesn''t begin signing certificates. Amazon EKS then distributes the successor CA
        to the Amazon Web Services managed components in your cluster; you can track this through the CA''s distributionStatus.
        The successor CA can''t be activated until its distributionStatus is COMPLETE. To activate it as the cluster''s signer,
        use ActivateCertificateAuthority . This '
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CreateCertificateAuthorityResponse'
        '400':
          description: InvalidParameterException; ResourceLimitExceededException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InvalidParameterException'
        '409':
          description: ResourceInUseException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ResourceInUseException'
        '404':
          description: ResourceNotFoundException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ResourceNotFoundException'
        '500':
          description: ServerException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ServerException'
        '503':
          description: ServiceUnavailableException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ServiceUnavailableException'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateCertificateAuthorityRequest'
      tags:
      - Certificate Authorities
    get:
      operationId: ListCertificateAuthorities
      summary: List Certificate Authorities
      description: 'Lists the certificate authorities (CAs) for your cluster. A cluster has at most two certificate authorities:
        the outgoing CA that''s currently signing and, during a rotation, one successor CA.'
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListCertificateAuthoritiesResponse'
        '400':
          description: InvalidParameterException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InvalidParameterException'
        '404':
          description: ResourceNotFoundException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ResourceNotFoundException'
        '500':
          description: ServerException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ServerException'
        '503':
          description: ServiceUnavailableException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ServiceUnavailableException'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ListCertificateAuthoritiesRequest'
      tags:
      - Certificate Authorities
  /clusters/{clusterName}/certificate-authorities/{certificateAuthorityId}:
    delete:
      operationId: DeleteCertificateAuthority
      summary: Delete Certificate Authority
      description: Deletes a certificate authority (CA) from your cluster. Deleting a certificate authority removes its public
        certificate from the cluster's trust bundle. You can't delete the certificate authority that's currently signing certificates
        for the cluster (its signingStatus is IN_USE) — to remove the outgoing CA, first activate the successor CA with ActivateCertificateAuthority
        . Amazon EKS also protects a successor CA from deletion in certain cases to keep a valid rotation path — for example,
        a successor that Amazon EKS appended can't be deleted while it's the only successor on the cluster. This is an asynchronous
        operation that returns an update object.
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DeleteCertificateAuthorityResponse'
        '400':
          description: InvalidParameterException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InvalidParameterException'
        '409':
          description: ResourceInUseException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ResourceInUseException'
        '404':
          description: ResourceNotFoundException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ResourceNotFoundException'
        '500':
          description: ServerException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ServerException'
        '503':
          description: ServiceUnavailableException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ServiceUnavailableException'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/DeleteCertificateAuthorityRequest'
      tags:
      - Certificate Authorities
    get:
      operationId: DescribeCertificateAuthority
      summary: Describe Certificate Authority
      description: Returns detailed information about a certificate authority (CA) in your cluster, including its validity
        period, signing and distribution status, provenance, scheduled auto-activation events, and public certificate data.
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DescribeCertificateAuthorityResponse'
        '404':
          description: ResourceNotFoundException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ResourceNotFoundException'
        '500':
          description: ServerException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ServerException'
        '503':
          description: ServiceUnavailableException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ServiceUnavailableException'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/DescribeCertificateAuthorityRequest'
      tags:
      - Certificate Authorities
components:
  securitySchemes:
    sigv4:
      type: apiKey
      in: header
      name: Authorization
      description: AWS Signature Version 4. The Authorization header carries an AWS4-HMAC-SHA256 signature over the canonical
        request, with X-Amz-Date (and X-Amz-Security-Token for temporary credentials). Not a bearer token.
      x-aws-sigv4:
        signingName: eks
  schemas:
    Cancellation:
      type: object
      properties:
        status:
          type: string
          enum:
          - InProgress
          - Failed
          - Successful
          description: The current status of the cancellation. Valid values are InProgress, Failed, and Successful.
        reason:
          type: string
          description: A message providing additional details about the cancellation, such as the reason for the cancellation
            or failure details.
    CertificateAuthority:
      type: object
      properties:
        id:
          type: string
          description: The unique identifier of the certificate authority.
        createdAt:
          type: string
          format: date-time
          description: The Unix epoch timestamp in seconds for when the certificate authority was created.
        createdBy:
          type: string
          enum:
          - EKS
          - CUSTOMER
          description: The entity that created the certificate authority. Certificate authorities that you create are CUSTOMER;
            those that Amazon EKS provisions on your behalf, such as a cluster's initial certificate authority, are EKS.
        activatedAt:
          type: string
          format: date-time
          description: The Unix epoch timestamp in seconds for when the certificate authority was last activated as the cluster's
            signer. This value is absent if the certificate authority has never been activated.
        activatedBy:
          type: string
          enum:
          - EKS
          - CUSTOMER
          description: The entity that most recently activated the certificate authority. A value of EKS indicates that Amazon
            EKS activated it automatically; CUSTOMER indicates that you activated it.
        signingStatus:
          type: string
          enum:
          - NOT_USED
          - ACTIVATING
          - IN_USE
          description: The signing status of the certificate authority. IN_USE means the certificate authority is currently
            signing certificates for the cluster, ACTIVATING means it's being promoted to the signer, and NOT_USED means it's
            trusted by the cluster (for example, a successor CA during a rotation, or a retired outgoing CA) but isn't the
            signer.
        distributionStatus:
          type: string
          enum:
          - IN_PROGRESS
          - COMPLETE
          - FAILED
          - DELETING
          description: The distribution status of the certificate authority, which tracks whether Amazon EKS has distributed
            its trust to the Amazon Web Services managed components in your cluster (the control plane, Amazon EKS Auto Mode
            instances, and Amazon Web Services Fargate nodes). Valid values are IN_PROGRESS, COMPLETE, FAILED, and DELETING.
            A successor CA can only be activated after its distribution status is COMPLETE.
        validity:
          $ref: '#/components/schemas/CertificateAuthorityValidity'
        scheduledEvents:
          $ref: '#/components/schemas/CertificateAuthorityScheduledEvents'
        rollbackAvailable:
          type: boolean
          description: Indicates whether CA rollback is still available for this certificate authority. After you activate
            a successor CA, rollback lets you revert to the outgoing CA for a limited period while you finish updating any
            worker nodes or clients that were missed.
        data:
          type: string
          description: The Base64-encoded public certificate of the certificate authority.
    CertificateAuthorityScheduledEvents:
      type: object
      properties:
        firstAutoActivation:
          type: string
          format: date-time
          description: The earliest Unix epoch timestamp in seconds at which Amazon EKS may automatically activate this certificate
            authority.
        finalAutoActivation:
          type: string
          format: date-time
          description: The Unix epoch timestamp in seconds by which Amazon EKS will automatically activate this certificate
            authority if you haven't already activated it.
    CertificateAuthoritySummary:
      type: object
      properties:
        id:
          type: string
          description: The unique identifier of the certificate authority.
        createdAt:
          type: string
          format: date-time
          description: The Unix epoch timestamp in seconds for when the certificate authority was created.
        createdBy:
          type: string
          enum:
          - EKS
          - CUSTOMER
          description: The entity that created the certificate authority, either CUSTOMER or EKS.
        activatedAt:
          type: string
          format: date-time
          description: The Unix epoch timestamp in seconds for when the certificate authority was last activated. This value
            is absent if the certificate authority has never been activated.
        activatedBy:
          type: string
          enum:
          - EKS
          - CUSTOMER
          description: The entity that most recently activated the certificate authority, either CUSTOMER or EKS.
        signingStatus:
          type: string
          enum:
          - NOT_USED
          - ACTIVATING
          - IN_USE
          description: 'The signing status of the certificate authority: IN_USE, ACTIVATING, or NOT_USED.'
        distributionStatus:
          type: string
          enum:
          - IN_PROGRESS
          - COMPLETE
          - FAILED
          - DELETING
          description: 'The distribution status of the certificate authority: IN_PROGRESS, COMPLETE, FAILED, or DELETING.'
    CertificateAuthorityValidity:
      type: object
      properties:
        notBefore:
          type: string
          format: date-time
          description: The Unix epoch timestamp in seconds for the start of the certificate authority's validity period.
        notAfter:
          type: string
          format: date-time
          description: The Unix epoch timestamp in seconds for the end of the certificate authority's validity period.
    CreateCertificateAuthorityRequest:
      type: object
      properties:
        clusterName:
          type: string
          description: The name of your cluster.
        clientRequestToken:
          type: string
          description: A unique, case-sensitive identifier that you provide to ensure the idempotency of the request.
      required:
      - clusterName
    CreateCertificateAuthorityResponse:
      type: object
      properties:
        update:
          $ref: '#/components/schemas/Update'
        certificateAuthority:
          $ref: '#/components/schemas/CertificateAuthoritySummary'
    DeleteCertificateAuthorityRequest:
      type: object
      properties:
        clusterName:
          type: string
          description: The name of your cluster.
        certificateAuthorityId:
          type: string
          description: The ID of the certificate authority to delete. You can't delete the certificate authority that's currently
            signing certificates for the cluster.
        clientRequestToken:
          type: string
          description: A unique, case-sensitive identifier that you provide to ensure the idempotency of the request.
      required:
      - clusterName
      - certificateAuthorityId
    DeleteCertificateAuthorityResponse:
      type: object
      properties:
        update:
          $ref: '#/components/schemas/Update'
        certificateAuthority:
          $ref: '#/components/schemas/CertificateAuthoritySummary'
    DescribeCertificateAuthorityRequest:
      type: object
      properties:
        clusterName:
          type: string
          description: The name of your cluster.
        certificateAuthorityId:
          type: string
          description: The ID of the certificate authority to describe.
      required:
      - clusterName
      - certificateAuthorityId
    DescribeCertificateAuthorityResponse:
      type: object
      properties:
        certificateAuthority:
          $ref: '#/components/schemas/CertificateAuthority'
    ErrorDetail:
      type: object
      properties:
        errorCode:
          type: string
          enum:
          - SubnetNotFound
          - SecurityGroupNotFound
          - EniLimitReached
          - IpNotAvailable
          - AccessDenied
          - OperationNotPermitted
          - VpcIdNotFound
          - Unknown
          - NodeCreationFailure
          - PodEvictionFailure
          - InsufficientFreeAddresses
          - ClusterUnreachable
          - InsufficientNumberOfReplicas
          - ConfigurationConflict
          - AdmissionRequestDenied
          - UnsupportedAddonModification
          - K8sResourceNotFound
          description: 'A brief description of the error. SubnetNotFound: We couldn''t find one of the subnets associated
            with the cluster. SecurityGroupNotFound: We couldn''t find one of the security groups associated with the cluster.
            EniLimitReached: You have reached the elastic network interface limit for your account. IpNotAvailable: A subnet
            associated with the cluster doesn''t have any available IP addresses. AccessDenied: You don''t have permissions
            to perform the specified operation. OperationNotPermitted: The service role associated with the cluster doesn''t
            have the required access permissions for Amazon EKS. V'
        errorMessage:
          type: string
          description: A more complete description of the error.
        resourceIds:
          type: array
          items:
            type: string
          description: An optional field that contains the resource IDs associated with the error.
    InvalidParameterException:
      type: object
      properties:
        clusterName:
          type: string
          description: The Amazon EKS cluster associated with the exception.
        nodegroupName:
          type: string
          description: The Amazon EKS managed node group associated with the exception.
        fargateProfileName:
          type: string
          description: The Fargate profile associated with the exception.
        addonName:
          type: string
          description: The specified parameter for the add-on name is invalid. Review the available parameters for the API
            request
        subscriptionId:
          type: string
          description: The Amazon EKS subscription ID with the exception.
        message:
          type: string
          description: The specified parameter is invalid. Review the available parameters for the API request.
    ListCertificateAuthoritiesRequest:
      type: object
      properties:
        clusterName:
          type: string
          description: The name of your cluster.
        maxResults:
          type: integer
          description: The maximum number of results to return in a single call. To retrieve the remaining results, make another
            call with the returned nextToken value. If you don't specify a value, the default is 100 results.
        nextToken:
          type: string
          description: The nextToken value returned from a previous paginated request, where maxResults was used and the results
            exceeded the value of that parameter. Pagination continues from the end of the previous results that returned
            the nextToken value. This value is null when there are no more results to return. This token should be treated
            as an opaque identifier that is used only to retrieve the next items in a list and not for other programmatic
            purposes.
      required:
      - clusterName
    ListCertificateAuthoritiesResponse:
      type: object
      properties:
        certificateAuthorities:
          type: array
          items:
            $ref: '#/components/schemas/CertificateAuthoritySummary'
          description: A list of certificate authority summary objects, each containing basic information about a certificate
            authority, including its ID, signing status, and distribution status.
        nextToken:
          type: string
          description: The nextToken value to include in a future ListCertificateAuthorities request. When the results of
            a ListCertificateAuthorities request exceed maxResults, you can use this value to retrieve the next page of results.
            This value is null when there are no more results to return. This token should be treated as an opaque identifier
            that is used only to retrieve the next items in a list and not for other programmatic purposes.
    ResourceInUseException:
      type: object
      properties:
        clusterName:
          type: string
          description: The Amazon EKS cluster associated with the exception.
        nodegroupName:
          type: string
          description: The Amazon EKS managed node group associated with the exception.
        addonName:
          type: string
          description: The specified add-on name is in use.
        message:
          type: string
          description: The Amazon EKS message associated with the exception.
    ResourceNotFoundException:
      type: object
      properties:
        clusterName:
          type: string
          description: The Amazon EKS cluster associated with the exception.
        nodegroupName:
          type: string
          description: The Amazon EKS managed node group associated with the exception.
        fargateProfileName:
          type: string
          description: The Fargate profile associated with the exception.
        addonName:
          type: string
          description: The Amazon EKS add-on name associated with the exception.
        subscriptionId:
          type: string
          description: The Amazon EKS subscription ID with the exception.
        message:
          type: string
          description: The Amazon EKS message associated with the exception.
    ServerException:
      type: object
      properties:
        clusterName:
          type: string
          description: The Amazon EKS cluster associated with the exception.
        nodegroupName:
          type: string
          description: The Amazon EKS managed node group associated with the exception.
        addonName:
          type: string
          description: The Amazon EKS add-on name associated with the exception.
        subscriptionId:
          type: string
          description: The Amazon EKS subscription ID with the exception.
        message:
          type: string
          description: These errors are usually caused by a server-side issue.
    ServiceUnavailableException:
      type: object
      properties:
        message:
          type: string
          description: The request has failed due to a temporary failure of the server.
    Update:
      type: object
      properties:
        id:
          type: string
          description: A UUID that is used to track the update.
        status:
          type: string
          enum:
          - InProgress
          - Failed
          - Cancelled
          - Successful
          description: The current status of the update.
        type:
          type: string
          enum:
          - VersionUpdate
          - EndpointAccessUpdate
          - LoggingUpdate
          - ConfigUpdate
          - AssociateIdentityProviderConfig
          - DisassociateIdentityProviderConfig
          - AssociateEncryptionConfig
          - AddonUpdate
          - VpcConfigUpdate
          - AccessConfigUpdate
          - UpgradePolicyUpdate
          - ZonalShiftConfigUpdate
          - AutoModeUpdate
          - RemoteNetworkConfigUpdate
          - DeletionProtectionUpdate
          - CapabilityUpdate
          - ControlPlaneScalingConfigUpdate
          - VendedLogsUpdate
          - ControlPlaneEgressUpdate
          - VersionRollback
          - ControlPlaneComponentConfigUpdate
          - CertificateAuthorityUpdate
          description: The type of the update.
        params:
          type: array
          items:
            $ref: '#/components/schemas/UpdateParam'
          description: A key-value map that contains the parameters associated with the update.
        createdAt:
          type: string
          format: date-time
          description: The Unix epoch timestamp at object creation.
        errors:
          type: array
          items:
            $ref: '#/components/schemas/ErrorDetail'
          description: Any errors associated with a Failed update.
        cancellation:
          $ref: '#/components/schemas/Cancellation'
    UpdateParam:
      type: object
      properties:
        type:
          type: string
          enum:
          - Version
          - PlatformVersion
          - EndpointPrivateAccess
          - EndpointPublicAccess
          - ClusterLogging
          - DesiredSize
          - LabelsToAdd
          - LabelsToRemove
          - TaintsToAdd
          - TaintsToRemove
          - MaxSize
          - MinSize
          - ReleaseVersion
          - PublicAccessCidrs
          - LaunchTemplateName
          - LaunchTemplateVersion
          - IdentityProviderConfig
          - EncryptionConfig
          - AddonVersion
          - ServiceAccountRoleArn
          - ResolveConflicts
          - MaxUnavailable
          - MaxUnavailablePercentage
          - NodeRepairEnabled
          - UpdateStrategy
          - ConfigurationValues
          - SecurityGroups
          - Subnets
          - AuthenticationMode
          - PodIdentityAssociations
          - UpgradePolicy
          - ZonalShiftConfig
          - ComputeConfig
          - StorageConfig
          - KubernetesNetworkConfig
          - RemoteNetworkConfig
          - DeletionProtection
          - NodeRepairConfig
          - RoleArn
          - RoleMappingsToAddOrUpdate
          - RoleMappingsToRemove
          - NetworkAccess
          - VendedLogs
          - UpdatedTier
          - PreviousTier
          - EnableCrossNamespace
          - DisabledServices
          - WarmPoolEnabled
          - WarmPoolMaxGroupPreparedCapacity
          - WarmPoolMinSize
          - WarmPoolState
          - WarmPoolReuseOnScaleIn
          - ControlPlaneEgressMode
          - KubeApiServerConfig
          - KubeSchedulerConfig
          - KubeControllerManagerConfig
          - ActiveCertificateAuthority
          - TrustedCertificateAuthorities
          - CertificateAuthorityId
          - SigningStatus
          description: The keys associated with an update request.
        value:
          type: string
          description: The value of the keys submitted as part of an update request.
x-provenance:
  method: harvested
  publisher: Amazon Web Services
  source: https://raw.githubusercontent.com/aws/api-models-aws/582e55931c45b944739742a2c1620b6026dd2d13/models/eks/service/2017-11-01/eks-2017-11-01.json
  note: converted by smithy-to-openapi.py from AWS's Smithy model (roadmap#1001)