<p>I am getting confused with all the certificates and keys in Kubernetes.  </p>

<p>Inside the master I have the following certificates and keys:  </p>

<pre><code>/etc/kubernetes/pki/apiserver.crt
/etc/kubernetes/pki/apiserver.key

/etc/kubernetes/pki/apiserver-kubelet-client.crt
/etc/kubernetes/pki/apiserver-kubelet-client.key

/var/lib/kubelet/pki/kubelet.crt
/var/lib/kubelet/pki/kubelet.key
</code></pre>

<p>The <code>apiserver-kubelet-client (crt\key)</code> is used for secure communication between the apiserver and the kubelet inside the Master.<br>
Why I have also the <code>kubelet (crt\key)</code>? Isn't the <code>apiserver-kubelet-client (crt\key)</code> is enough ?  </p>

<p>Why I need <code>apiserver (crt\key)</code> if I have <code>apiserver-kubelet-client (crt\key)</code>  ?  </p>

<p>Hope someone can make some order with this.  </p>

<p>I read <a href="https://jvns.ca/blog/2017/08/05/how-kubernetes-certificates-work" rel="nofollow noreferrer">this</a> article about Kubernetes PKI but I am still don't understand what is difference between the above certificates and keys.   </p>

E235
<p>I was also asking my self similar question.</p>
<p>The first thing u need to know is that both the kubelet and the api-server communicate with each other [0].</p>
<p>The second thing is that Kubernetes uses client certificates to authenticate a client identity to the server and a server certificate to authenticate the server’s identity to the client and establish an encrypted connection .</p>
<p>In case of <code>kubelet -&gt; api-server</code> kubelet needs a client certificate and api-server a server certificate and for <code>api-server -&gt; kubelet</code> then the otherway around.</p>
<p>you can check if a certificate is a server or client one using:</p>
<pre><code>openssl x509  -noout -text -in apiserver.crt
</code></pre>
<p>Now back to the question :</p>
<ul>
<li><code>/etc/kubernetes/pki/apiserver.crt</code> and <code>/var/lib/kubelet/pki/kubelet.crt</code> are server certificates</li>
<li><code>/etc/kubernetes/pki/apiserver-kubelet-client.crt</code> and <code>/var/lib/kubelet/pki/kubelet-client-current.pem</code> are client certificates</li>
</ul>
<ol start="0">
<li><a href="https://kubernetes.io/docs/concepts/architecture/control-plane-node-communication/" rel="nofollow noreferrer">https://kubernetes.io/docs/concepts/architecture/control-plane-node-communication/</a></li>
</ol>
