Bootstrap certificates

In that process, the kubelet generates a CSR while communicating over the bootstrap channel. The controller manager signs the CSR, resulting in a certificate that the kubelet manages.

This bootstrap CA is valid for 10 years.

You cannot customize the bootstrap certificates.