Certificates in this OpenShift Cluster

Aggregated API Server Certificates

Used to secure connections between the kube-apiserver and aggregated API Servers.

MachineConfig Operator Certificates

TODO need to work out who and what.

Proxy Certificates

Used by the OpenShift platform to recognize the proxy. Other usages are side-effects which work by accident and not by principled design.

Service Serving Certificates

Used to secure inter-service communication on the local cluster.

etcd Certificates

Used to secure etcd internal communication and by apiservers to access etcd.

etcd Metrics Certificates

Used to access etcd metrics using mTLS.

kube-apiserver Client Certificates

Used by the kube-apiserver to recognize clients using mTLS.

kube-apiserver Serving Certificates

Used by kube-apiserver clients to recognize the kube-apiserver.