EKS CA rotation shipped 20 August 2026 with a 10-year clock and auto-activation you cannot decline
Amazon EKS clusters built since 2018 carry a 10-year certificate authority. AWS now appends a successor 2 years out and activates it 6 months before expiry, ready or not.
