activate_certificate_authority ¶

def activate_certificate_authority(
    self,
    cluster_name: "capo_eks.types.string.String",
    certificate_authority_id: "capo_eks.types.string.String",
    *,
    config_overrides: Optional[EKSClientConfig] = None,
    client_request_token: Optional["capo_eks.types.string.String"] = None,
) -> "capo_eks.types.activate_certificate_authority_response.ActivateCertificateAuthorityResponse":
    """<p>Activates a successor certificate authority (CA) as the signing certificate authority for your cluster, completing a CA rotation.</p> <p>When you activate a successor CA, Amazon EKS promotes it to be the cluster's signer (its <code>signingStatus</code> becomes <code>IN_USE</code>) and the outgoing CA is retired (<code>NOT_USED</code>). The outgoing CA remains in the cluster's trust bundle but no longer signs certificates. The successor CA you activate must already be present on the cluster and fully distributed (its <code>distributionStatus</code> must be <code>COMPLETE</code>). This is an asynchronous operation that returns an <code>update</code> object you can track with <a href="https://docs.aws.amazon.com/eks/latest/APIReference/API_DescribeUpdate.html"> <code>DescribeUpdate</code> </a>.</p> <p>Before you activate the successor CA, make sure the worker nodes you manage and your external clients have been updated to trust it, so they maintain connectivity to the API server after activation. For a limited period after activation, CA rollback is available to revert to the outgoing CA if needed. If you don't activate the successor CA yourself, Amazon EKS activates it automatically as the expiration deadline approaches. For more information, see <a href="https://docs.aws.amazon.com/eks/latest/userguide/certificate-authority-rotation.html">Rotate the Amazon EKS cluster certificate authority</a> in the <i>Amazon EKS User Guide</i>.</p>

    Args:
        cluster_name: <p>The name of your cluster.</p>
        certificate_authority_id: <p>The ID of the certificate authority to activate as the cluster's signing certificate authority. This certificate authority must already exist on the cluster and have a <code>distributionStatus</code> of <code>COMPLETE</code>.</p>
        client_request_token: <p>A unique, case-sensitive identifier that you provide to ensure the idempotency of the request.</p>

    Raises:
        capo_eks.errors.invalid_parameter_exception.InvalidParameterException: <p>The specified parameter is invalid. Review the available parameters for the API request.</p>
        capo_eks.errors.resource_not_found_exception.ResourceNotFoundException: <p>The specified resource could not be found. You can view your available clusters with <code>ListClusters</code>. You can view your available managed node groups with <code>ListNodegroups</code>. Amazon EKS clusters and node groups are Amazon Web Services Region specific.</p>
        capo_eks.errors.server_exception.ServerException: <p>These errors are usually caused by a server-side issue.</p>
        capo_eks.errors.service_unavailable_exception.ServiceUnavailableException: <p>The service is unavailable. Back off and retry the operation.</p>
        capo_eks.errors.UnknownServiceError: The service returned an error code this client does not model.
    """

    def _handler(
        req: "OperationRequest[capo_eks.types.activate_certificate_authority_request.ActivateCertificateAuthorityRequest]",
    ) -> OperationResponse[
        "capo_eks.types.activate_certificate_authority_response.ActivateCertificateAuthorityResponse"
    ]:
        import capo_eks._operations.aws_wesley_frontend.activate_certificate_authority

        output, http_response = (
            capo_eks._operations.aws_wesley_frontend.activate_certificate_authority.activate_certificate_authority(
                req.options, req.input
            )
        )
        return OperationResponse(output=output, response=http_response)

    interceptors_, options_ = self.operation_options(
        config_overrides, OperationLogging("ActivateCertificateAuthority")
    )
    input_: capo_eks.types.activate_certificate_authority_request.ActivateCertificateAuthorityRequest = {
        "cluster_name": cluster_name,
        "certificate_authority_id": certificate_authority_id,
    }
    if client_request_token is None:
        client_request_token = str(uuid.uuid4())
    input_["client_request_token"] = client_request_token

    response = execute_pipeline(
        OperationRequest(input=input_, options=options_),
        handler=_handler,
        interceptors=list(interceptors_),
    )
    response.response.close()
    return response.output