<p>I am trying to use my own CAs on k8s for internal https communication.</p>
<p>I read the documentation <a href="https://kubernetes.io/docs/tasks/administer-cluster/kubeadm/kubeadm-certs/" rel="nofollow noreferrer">Certificate Management with kubeadm</a> where I use on my conf file the paths as described:</p>
<pre class="lang-sh prettyprint-override"><code>apiVersion: kubeadm.k8s.io/v1beta2
kind: ClusterConfiguration
controllerManager:
  extraArgs:
    cluster-signing-cert-file: /etc/kubernetes/pki/ca.crt
    cluster-signing-key-file: /etc/kubernetes/pki/ca.key
</code></pre>
<p>When I launch the master prime node I get the following error:</p>
<pre class="lang-sh prettyprint-override"><code>error execution phase certs/apiserver: couldn't load CA certificate ca: ca certificate is not a certificate authority
</code></pre>
<p>I tried to find a way to define the authority and I found this <a href="https://kubernetes.io/docs/concepts/cluster-administration/certificates/" rel="nofollow noreferrer">Certificates</a>. I do think that this is what I am looking for as this is referring to how to produce your own self signed CAs.</p>
<p>The CAs that I want to apply are from an official authority.</p>
<p>Is there something that I am missing here and I can not figure out?</p>
<p>I am running on 1.19.2 version</p>
<pre class="lang-sh prettyprint-override"><code>$ kubectl version
Client Version: version.Info{Major:&quot;1&quot;, Minor:&quot;19&quot;, GitVersion:&quot;v1.19.2&quot;, GitCommit:&quot;f5743093fd1c663cb0cbc89748f730662345d44d&quot;, GitTreeState:&quot;clean&quot;, BuildDate:&quot;2020-09-16T13:41:02Z&quot;, GoVersion:&quot;go1.15&quot;, Compiler:&quot;gc&quot;, Platform:&quot;linux/amd64&quot;}
Server Version: version.Info{Major:&quot;1&quot;, Minor:&quot;19&quot;, GitVersion:&quot;v1.19.2&quot;, GitCommit:&quot;f5743093fd1c663cb0cbc89748f730662345d44d&quot;, GitTreeState:&quot;clean&quot;, BuildDate:&quot;2020-09-16T13:32:58Z&quot;, GoVersion:&quot;go1.15&quot;, Compiler:&quot;gc&quot;, Platform:&quot;linux/amd64&quot;}
</code></pre>

<p>You have got a private key and server certificate signed by an external CA with it's private key. You really do not have the CA's private key itself.</p>
<p>If you were using the <em>self signed CA</em> option then you actually got the private key of CA with you and kubeadm could use that to sign and generate all the server and client certificates for the control plane components.</p>
<p>You need to follow the <a href="https://kubernetes.io/docs/tasks/administer-cluster/kubeadm/kubeadm-certs/#external-ca-mode" rel="nofollow noreferrer">External CA mode</a> of kubeadm where in you just provide the <code>ca.crt</code> in <code>/etc/kubernetes/pki/ca.crt</code> location.</p>
<p>This will make use of the server certificate to host Kubernetes API Server over <code>https</code> which is what you are trying to achieve.</p>
<p>Please note the following</p>
<ol>
<li><p>In this case you will not be able to use kubernetes to issue certificate by approving <a href="https://kubernetes.io/docs/reference/access-authn-authz/certificate-signing-requests/" rel="nofollow noreferrer">certificate signing request </a> because you do not have the private key of the CA to sign a CSR.</p>
</li>
<li><p>Since kubeadm is running in external CA mode; all the certificates for the control plane components must be provided by the user, because kubeadm cannot generate them by itself.</p>
</li>
</ol>
