code: func WriteKubeConfigWithClientCert(out io.Writer, cfg *kubeadmapi.InitConfiguration, clientName string, organizations []string) error {
  
  	// creates the KubeConfigSpecs, actualized for the current InitConfiguration
  	caCert, caKey, err := pkiutil.TryLoadCertAndKeyFromDisk(cfg.CertificatesDir, kubeadmconstants.CACertAndKeyBaseName)
  	if err != nil {
  		return errors.Wrap(err, "couldn't create a kubeconfig; the CA files couldn't be loaded")
  	}
  
  	controlPlaneEndpoint, err := kubeadmutil.GetControlPlaneEndpoint(cfg.ControlPlaneEndpoint, &cfg.LocalAPIEndpoint)
  	if err != nil {
  		return err
  	}
  
  	spec := &kubeConfigSpec{
  		ClientName: clientName,
  		APIServer:  controlPlaneEndpoint,
  		CACert:     caCert,
  		ClientCertAuth: &clientCertAuth{
  			CAKey:         caKey,
  			Organizations: organizations,
  		},
  	}
  
  	return writeKubeConfigFromSpec(out, spec, cfg.ClusterName)
  }
docs: // WriteKubeConfigWithClientCert writes a kubeconfig file - with a client certificate as authentication info  - to the given writer.