code: func UsingExternalFrontProxyCA(cfg *kubeadmapi.ClusterConfiguration) (bool, error) {
  
  	if err := validateCACert(certKeyLocation{cfg.CertificatesDir, kubeadmconstants.FrontProxyCACertAndKeyBaseName, "", "front-proxy CA"}); err != nil {
  		return false, err
  	}
  
  	frontProxyCAKeyPath := filepath.Join(cfg.CertificatesDir, kubeadmconstants.FrontProxyCAKeyName)
  	if _, err := os.Stat(frontProxyCAKeyPath); !os.IsNotExist(err) {
  		return false, nil
  	}
  
  	if err := validateSignedCert(certKeyLocation{cfg.CertificatesDir, kubeadmconstants.FrontProxyCACertAndKeyBaseName, kubeadmconstants.FrontProxyClientCertAndKeyBaseName, "front-proxy client"}); err != nil {
  		return true, err
  	}
  
  	return true, nil
  }
docs: // UsingExternalFrontProxyCA determines whether the user is relying on an external front-proxy CA.  We currently implicitly determine this is the case
  // when the front proxy CA Cert is present but the front proxy CA Key is not.
  // In case we are using an external front-proxy CA, the function validates the certificates signed by front-proxy CA that should be provided by the user.