instruction: Create a Dockerfile for cluster
output: ```dockerfile
  from the previous tables
  you need to provide if you are generating all of your own keys and certificates:
  /etc/kubernetes/pki/etcd/ca.key
  /etc/kubernetes/pki/etcd/ca.crt
  /etc/kubernetes/pki/apiserver-etcd-client.key
  /etc/kubernetes/pki/apiserver-etcd-client.crt
  /etc/kubernetes/pki/ca.key
  /etc/kubernetes/pki/ca.crt
  /etc/kubernetes/pki/apiserver.key
  /etc/kubernetes/pki/apiserver.crt
  /etc/kubernetes/pki/apiserver-kubelet-client.key
  /etc/kubernetes/pki/apiserver-kubelet-client.crt
  /etc/kubernetes/pki/front-proxy-ca.key
  /etc/kubernetes/pki/front-proxy-ca.crt
  /etc/kubernetes/pki/front-proxy-client.key
  /etc/kubernetes/pki/front-proxy-client.crt
  /etc/kubernetes/pki/etcd/server.key
  /etc/kubernetes/pki/etcd/server.crt
  /etc/kubernetes/pki/etcd/peer.key
  /etc/kubernetes/pki/etcd/peer.crt
  /etc/kubernetes/pki/etcd/healthcheck-client.key
  /etc/kubernetes/pki/etcd/healthcheck-client.crt
  /etc/kubernetes/pki/sa.key
  /etc/kubernetes/pki/sa.pub
  Configure certificates for user accounts
  You must manually configure these administrator account and service accounts:
  
  filename
  credential name
  Default CN
  O (in Subject)
  
  admin.conf
  default-admin
  kubernetes-admin
  <admin-group>
  
  super-admin.conf
  default-super-admin
  kubernetes-super-admin
  system:masters
  
  kubelet.conf
  default-auth
  system:node:<nodeName> (see note)
  system:nodes
  
  controller-manager.conf
  default-controller-manager
  system:kube-controller-manager
  
  scheduler.conf
  default-scheduler
  system:kube-scheduler
  
  Note:The value of <nodeName> for kubelet.conf must match precisely the value of the node name
  provided by the kubelet as it registers with the apiserver. For further details, read the
  Node Authorization.
  Note:In the above example <admin-group> is implementation specific. Some tools sign the
  certificate in the default admin.conf to be part of the system:masters group.
  system:masters is a break-glass, super user group can bypass the authorization
  layer of Kubernetes, such as RBAC. Also some tools do not generate a separate
  super-admin.conf with a certificate bound to this super user group.
  kubeadm generates two separate administrator certificates in kubeconfig files.
  One is in admin.conf and has Subject: O = kubeadm:cluster-admins, CN = kubernetes-admin.
  kubeadm:cluster-admins is a custom group bound to the cluster-admin ClusterRole.
  This file is generated on all kubeadm managed control plane machines.
  Another is in super-admin.conf that has Subject: O = system:masters, CN = kubernetes-super-admin.
  This file is generated only on the node where kubeadm init was called.
  
  For each config, generate an x509 cert/key pair with the given CN and O.
  
  Run kubectl as follows for each config:
  
  KUBECONFIG=<filename> kubectl config set-cluster default-cluster --server=https://<host ip>:6443 --certificate-authority <path-to-kubernetes-ca> --embed-certs
  KUBECONFIG=<filename> kubectl config set-credentials <credential-name> --client-key <path-to-key>.pem --client-certificate <path-to-cert>.pem --embed-certs
  KUBECONFIG=<filename> kubectl config set-context default-system --cluster default-cluster --user <credential-name>
  KUBECONFIG=<filename> kubectl config use-context default-system
  These files are used as follows:
  
  filename
  command
  comment
  
  admin.conf
  kubectl
  Configures administrator user for the cluster
  
  super-admin.conf
  kubectl
  Configures super administrator user for the cluster
  
  kubelet.conf
  kubelet
  One required for each node in the cluster.
  
  controller-manager.conf
  kube-controller-manager
  Must be added to manifest in manifests/kube-controller-manager.yaml
  
  scheduler.conf
  kube-scheduler
  Must be added to manifest in manifests/kube-scheduler.yaml
  
  The following files illustrate full paths to the files listed in the previous table:
  /etc/kubernetes/admin.conf
  /etc/kubernetes/super-admin.conf
  /etc/kubernetes/kubelet.conf
  /etc/kubernetes/controller-manager.conf
  /etc/kubernetes/scheduler.conf
  
  Feedback
  Was this page helpful?
  Yes
  No
  
   Thanks for the feedback. If you have a specific, answerable question about how to use Kubernetes, ask it on
  
   Stack Overflow.
   Open an issue in the GitHub Repository if you want to
  
   report a problem
   or
  
   suggest an improvement.
  
   Last modified November 10, 2023 at 2:27 PM PST: certificates.md: add note about system:masters in apiserver cert (ddb784aab1)
  
    Create child page
   Create an issue
   Print entire section
  
  How certificates are used by your cluster
  Where certificates are stored
  Configure certificates manually
  
  Single root CA
  All certificates
  Certificate paths
  
  Configure certificates for user accounts
  
  Documentation
  Blog
  Training
  Partners
  Community
  Case Studies
  
  © 2025 The Kubernetes Authors | Documentation Distributed under CC BY 4.0
  
  ICP license: 京ICP备17074266号-3
  ```