code: func writeCertificateAuthorithyFilesIfNotExist(pkiDir string, baseName string, caCert *x509.Certificate, caKey crypto.Signer) error {
  
  	// If cert or key exists, we should try to load them
  	if pkiutil.CertOrKeyExist(pkiDir, baseName) {
  
  		// Try to load .crt and .key from the PKI directory
  		caCert, _, err := pkiutil.TryLoadCertAndKeyFromDisk(pkiDir, baseName)
  		if err != nil {
  			return errors.Wrapf(err, "failure loading %s certificate", baseName)
  		}
  
  		// Check if the existing cert is a CA
  		if !caCert.IsCA {
  			return errors.Errorf("certificate %s is not a CA", baseName)
  		}
  
  		// kubeadm doesn't validate the existing certificate Authority more than this;
  		// Basically, if we find a certificate file with the same path; and it is a CA
  		// kubeadm thinks those files are equal and doesn't bother writing a new file
  		fmt.Printf("[certs] Using the existing %q certificate and key\n", baseName)
  	} else {
  		// Write .crt and .key files to disk
  		fmt.Printf("[certs] Generating %q certificate and key\n", baseName)
  
  		if err := pkiutil.WriteCertAndKey(pkiDir, baseName, caCert, caKey); err != nil {
  			return errors.Wrapf(err, "failure while saving %s certificate and key", baseName)
  		}
  	}
  	return nil
  }
docs: // writeCertificateAuthorithyFilesIfNotExist write a new certificate Authority to the given path.
  // If there already is a certificate file at the given path; kubeadm tries to load it and check if the values in the
  // existing and the expected certificate equals. If they do; kubeadm will just skip writing the file as it's up-to-date,
  // otherwise this function returns an error.