code: func (k *KubeadmCert) CreateAsCA(ic *kubeadmapi.InitConfiguration) (*x509.Certificate, crypto.Signer, error) {
  	cfg, err := k.GetConfig(ic)
  	if err != nil {
  		return nil, nil, errors.Wrapf(err, "couldn't get configuration for %q CA certificate", k.Name)
  	}
  	caCert, caKey, err := pkiutil.NewCertificateAuthority(cfg)
  	if err != nil {
  		return nil, nil, errors.Wrapf(err, "couldn't generate %q CA certificate", k.Name)
  	}
  
  	err = writeCertificateAuthorithyFilesIfNotExist(
  		ic.CertificatesDir,
  		k.BaseName,
  		caCert,
  		caKey,
  	)
  	if err != nil {
  		return nil, nil, errors.Wrapf(err, "couldn't write out %q CA certificate", k.Name)
  	}
  
  	return caCert, caKey, nil
  }
docs: // CreateAsCA creates a certificate authority, writing the files to disk and also returning the created CA so it can be used to sign child certs.