code: func buildClientCertificateManager(certConfig, clientConfig *restclient.Config, certDir string, nodeName types.NodeName) (certificate.Manager, error) {
  	newClientFn := func(current *tls.Certificate) (certificatesclient.CertificateSigningRequestInterface, error) {
  		// If we have a valid certificate, use that to fetch CSRs. Otherwise use the bootstrap
  		// credentials. In the future it would be desirable to change the behavior of bootstrap
  		// to always fall back to the external bootstrap credentials when such credentials are
  		// provided by a fundamental trust system like cloud VM identity or an HSM module.
  		config := certConfig
  		if current != nil {
  			config = clientConfig
  		}
  		client, err := clientset.NewForConfig(config)
  		if err != nil {
  			return nil, err
  		}
  		return client.CertificatesV1beta1().CertificateSigningRequests(), nil
  	}
  
  	return kubeletcertificate.NewKubeletClientCertificateManager(
  		certDir,
  		nodeName,
  
  		// this preserves backwards compatibility with kubeadm which passes
  		// a high powered certificate to the kubelet as --kubeconfig and expects
  		// it to be rotated out immediately
  		clientConfig.CertData,
  		clientConfig.KeyData,
  
  		clientConfig.CertFile,
  		clientConfig.KeyFile,
  		newClientFn,
  	)
  }
docs: // buildClientCertificateManager creates a certificate manager that will use certConfig to request a client certificate
  // if no certificate is available, or the most recent clientConfig (which is assumed to point to the cert that the manager will
  // write out).