<p>As per the k8s official docs <a href="https://kubernetes.io/docs/reference/command-line-tools-reference/kubelet-tls-bootstrapping/" rel="nofollow noreferrer">link</a>-</p>

<blockquote>
  <p>The kubelet requires the following configuration to bootstrap:</p>
  
  <p>A path to store the key and certificate it generates (optional, can
  use default)</p>
</blockquote>

<p>What's the default path and where and how can I change the path where keys and certs generated for the kubelet  are stored?</p>

Naxi
<p>It is in <code>/var/run/secrets/kubernetes.io/serviceaccount</code> by default.</p>

<p>You can run </p>

<pre><code>kubectl exec POD_NAME -it -- ls /var/run/secrets/kubernetes.io/serviceaccount
</code></pre>

<p>And you will get :</p>

<pre><code>ca.crt  namespace  token
</code></pre>

<p>It is defined in spec.volumeMounts.mountPath</p>

<p>Example :</p>

<pre><code>    apiVersion: v1
    kind: Pod
    ...
    spec:
      containers:
     ...
        volumeMounts:
        - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
          name: my-pod-token-ctmvg
          readOnly: true
  ...
      volumes:
      - name: my-pod-token-ctmvg
        secret:
          defaultMode: 420
          secretName: my-pod-token-ctmvg
</code></pre>

<p>In other words it's mounted to Pod's volume.</p>
