instruction: Create a Dockerfile for cluster
output: ```dockerfile
  from the previous tables
  you need to provide if you are generating all of your own keys and certificates:/etc/kubernetes/pki/etcd/ca.key
  /etc/kubernetes/pki/etcd/ca.crt
  /etc/kubernetes/pki/apiserver-etcd-client.key
  /etc/kubernetes/pki/apiserver-etcd-client.crt
  /etc/kubernetes/pki/ca.key
  /etc/kubernetes/pki/ca.crt
  /etc/kubernetes/pki/apiserver.key
  /etc/kubernetes/pki/apiserver.crt
  /etc/kubernetes/pki/apiserver-kubelet-client.key
  /etc/kubernetes/pki/apiserver-kubelet-client.crt
  /etc/kubernetes/pki/front-proxy-ca.key
  /etc/kubernetes/pki/front-proxy-ca.crt
  /etc/kubernetes/pki/front-proxy-client.key
  /etc/kubernetes/pki/front-proxy-client.crt
  /etc/kubernetes/pki/etcd/server.key
  /etc/kubernetes/pki/etcd/server.crt
  /etc/kubernetes/pki/etcd/peer.key
  /etc/kubernetes/pki/etcd/peer.crt
  /etc/kubernetes/pki/etcd/healthcheck-client.key
  /etc/kubernetes/pki/etcd/healthcheck-client.crt
  /etc/kubernetes/pki/sa.key
  /etc/kubernetes/pki/sa.pub
  Configure certificates for user accountsYou must manually configure these administrator accounts and service accounts:FilenameCredential nameDefault CNO (in Subject)admin.confdefault-adminkubernetes-admin<admin-group>super-admin.confdefault-super-adminkubernetes-super-adminsystem:masterskubelet.confdefault-authsystem:node:<nodeName> (see note)system:nodescontroller-manager.confdefault-controller-managersystem:kube-controller-managerscheduler.confdefault-schedulersystem:kube-schedulerNote:The value of <nodeName> for kubelet.conf must match precisely the value of the node name
  provided by the kubelet as it registers with the apiserver. For further details, read the
  Node Authorization.Note:In the above example <admin-group> is implementation specific. Some tools sign the
  certificate in the default admin.conf to be part of the system:masters group.
  system:masters is a break-glass, super user group can bypass the authorization
  layer of Kubernetes, such as RBAC. Also some tools do not generate a separate
  super-admin.conf with a certificate bound to this super user group.kubeadm generates two separate administrator certificates in kubeconfig files.
  One is in admin.conf and has Subject: O = kubeadm:cluster-admins, CN = kubernetes-admin.
  kubeadm:cluster-admins is a custom group bound to the cluster-admin ClusterRole.
  This file is generated on all kubeadm managed control plane machines.Another is in super-admin.conf that has Subject: O = system:masters, CN = kubernetes-super-admin.
  This file is generated only on the node where kubeadm init was called.For each configuration, generate an x509 certificate/key pair with the
  given Common Name (CN) and Organization (O).Run kubectl as follows for each configuration:KUBECONFIG=<filename> kubectl config set-cluster default-cluster --server=https://<host ip>:6443 --certificate-authority <path-to-kubernetes-ca> --embed-certs
  KUBECONFIG=<filename> kubectl config set-credentials <credential-name> --client-key <path-to-key>.pem --client-certificate <path-to-cert>.pem --embed-certs
  KUBECONFIG=<filename> kubectl config set-context default-system --cluster default-cluster --user <credential-name>
  KUBECONFIG=<filename> kubectl config use-context default-system
  These files are used as follows:FilenameCommandCommentadmin.confkubectlConfigures administrator user for the clustersuper-admin.confkubectlConfigures super administrator user for the clusterkubelet.confkubeletOne required for each node in the cluster.controller-manager.confkube-controller-managerMust be added to manifest in manifests/kube-controller-manager.yamlscheduler.confkube-schedulerMust be added to manifest in manifests/kube-scheduler.yamlThe following files illustrate full paths to the files listed in the previous table:/etc/kubernetes/admin.conf
  /etc/kubernetes/super-admin.conf
  /etc/kubernetes/kubelet.conf
  /etc/kubernetes/controller-manager.conf
  /etc/kubernetes/scheduler.conf
  any other IP or DNS name you contact your cluster on (as used by kubeadm
  the load balancer stable IP and/or DNS name, kubernetes, kubernetes.default, kubernetes.default.svc,
  kubernetes.default.svc.cluster, kubernetes.default.svc.cluster.local) ↩︎FeedbackWas this page helpful?Yes
  NoThanks for the feedback. If you have a specific, answerable question about how to use Kubernetes, ask it on
  Stack Overflow.
  Open an issue in the GitHub Repository if you want to
  report a problem
  or
  suggest an improvement.Last modified October 17, 2024 at 6:09 PM PST: Clean up best-practices: certificates and node-conformance (1d24167b04)  Create child page
   Create an issue
   Print entire sectionHow certificates are used by your clusterServer certificatesClient certificatesKubelet's server and client certificatesWhere certificates are storedConfigure certificates manuallySingle root CAAll certificatesCertificate pathsConfigure certificates for user accounts© 2025 The Kubernetes Authors | Documentation Distributed under CC BY 4.0© 2025 The Linux Foundation ®. ```