<p>I am new to kubernetes. here I have some confusions about the CA certificates used in a kubernetes cluster. As far as I know there are several CA certificates in kubernetes, but still not clear what each  functionality of them. Here is my understanding of them, but still not sure of them. </p>

<ol>
<li><p>Root CA also know as  serving CA, </p>

<ul>
<li>it signs the apiserver certwhich are configured in the apiserver with --tls-cert-file and --tls-private-key-file. </li>
<li>this CA certificate is configured in kube-controller-manager with --root-ca-file </li>
</ul></li>
<li><p>Client CA </p>

<ul>
<li>this CA certificate can be a intermediate CA certificate signed by ROOT CA certificate. </li>
<li>which is used to sign the individual components in cluster, help to identify their identities when RBAC and NODE authorization are enabled. for example, sign the kube-controller-manager, kube-scheduler, kube-proxy, kubelet.</li>
<li>can be configured in apiserver with --client-ca-file</li>
</ul></li>
<li>requestheader client ca 

<ul>
<li>this CA certificate can also be a intermediate CA certificate signed by ROOT CA certificate. </li>
<li>Still not understand what this CA is used for ? what scenario of the CA file, just found that if metric server is deployed, it will ask for  requestheader related certificates and keys</li>
<li>for --proxy-client-cert-file and  --proxy-client-key-file in kube-apiserver, what the value of these parameter? can kubelet certificates and keys be used? </li>
</ul></li>
</ol>

<p>Besides these CA certificates, some other certificates relative confusions are also encountered. </p>

<ol>
<li>--service-account-key-file parameter in kube-apiserver and kube-controller-manager, which file can be configured? is the apiserver key file or ROOT CA key file ?</li>
<li>what can be set to<br>
--cluster-signing-cert-file and --cluster-signing-key-file  in kube-controller-manager? can we use client ca and client ca key file? </li>
</ol>

<p>A good summary is at <a href="https://github.com/kubernetes/kubernetes/issues/54665#issuecomment-340960398" rel="nofollow noreferrer">https://github.com/kubernetes/kubernetes/issues/54665#issuecomment-340960398</a></p>

<p>The request header CA is used to verify a client cert presented by an authenticating proxy along with user info set in request headers. The proxy authenticated the user, proxies the request, and sets username/groups in headers. The API server verifies the client cert before trusting user info in any headers. </p>
