<p>I have certain questions regarding importing the existing certificates.</p>

<ol>
<li><p>How are certificates used internally in Kubernetes (e.g. between api server and workers, master controller, etc.)?
Is there a CA in Kubernetes?  (how) does it generate certificates for internal use?</p></li>
<li><p>What certificates are required at each layer?</p></li>
</ol>

<p>Certificates in Kubernetes are primarily used to secure communication from and to the API server. Taken from the <a href="https://kubernetes.io/docs/tasks/tls/managing-tls-in-a-cluster/" rel="nofollow noreferrer">official Kubernetes documentation</a>:</p>

<blockquote>
  <p>Every Kubernetes cluster has a cluster root Certificate Authority
  (CA). The CA is generally used by cluster components to validate the
  API server’s certificate, by the API server to validate kubelet client
  certificates, etc. To support this, the CA certificate bundle is
  distributed to every node in the cluster and is distributed as a
  secret attached to default service accounts. Optionally, your
  workloads can use this CA to establish trust. Your application can
  request a certificate signing using the certificates.k8s.io API using
  a protocol that is similar to the ACME draft.</p>
</blockquote>

<p>When creating a cluster with <a href="https://kubernetes.io/docs/setup/independent/create-cluster-kubeadm/" rel="nofollow noreferrer">kubeadm</a>, the tool at first creates a CA in <code>/etc/kubernetes/pki</code> and signs all following certificates with its private key. The ca is later distributed on all nodes for verification and also found base64 encoded in <code>/etc/kubernetes/admin.conf</code> for verification of the api server via <code>kubectl</code>. </p>

<p>It is possible to use your own CA for cluster creation by placing it and your private key as <code>ca.crt</code> and <code>ca.key</code> in <code>/etc/kubernetes/pki</code> before invoking <code>kubeadm init</code> or any folder later specified with <code>--cert-dir</code>.</p>

<p>There are many other ways to install Kubernetes but they all essentially create a CA before any actual Kubernetes code runs or require one to exist beforehand.</p>
