<p>I was going through Control Plane Security in Google cloud(GKE) course and referring to 'certificate authority and cluster trust' in the link below and have these questions. Can someone clarify these ?. </p>

<p><a href="https://cloud.google.com/kubernetes-engine/docs/concepts/control-plane-security" rel="nofollow noreferrer">https://cloud.google.com/kubernetes-engine/docs/concepts/control-plane-security</a></p>

<ol>
<li>Learnt that every cluster has its on CA that would issue certificates, this part is fine.. there is also a mention on <strong>etcd having seperate CA</strong>...  does it mean a cluster has two CAs, one for rest of the components and one for etcd Or is it just one CA for whole control plane ? </li>
<li>It also says, each cluster has its own 'root' CA..I know what CA is, what does <em>root Certificate Authority</em> mean ?</li>
</ol>

<p>Thanks in advance...</p>

<p>1.- That's correct. There is one certificate for masters and nodes components, and another one for etcd. <a href="https://cloud.google.com/kubernetes-engine/docs/concepts/cluster-trust#root_of_trust" rel="nofollow noreferrer">This</a> article explains is better. Note that it's a GKE approach, not Kubernetes.</p>

<p>2.- The article I passed also explains this second points. Indeed there are two CAs. I quote  "In GKE, the master API certificate is signed by the cluster root CA. Each cluster runs its own CA, so that if one cluster's CA were to be compromised, no other cluster CA would be affected".</p>
