Default Kubernetes core components communication - is that and mTLS

General Discussions
1

image
Hi -
This is relating to Kubernetes core components communication. As I understand and shown in the diagram, there is a TLS based communication across these core components ex. KubeAPIServer → ETCD or Kubelet → KubeAPIServer. Below are some of my questions …

  1. As I see there are both client and server certificates in KubeAPIServer and Kubelet. Is this an mTLS communication ? (are both client and server validating each other with these certs)
  2. If it is not mTLS then do we need client certificates ?
  3. By default what secrets and service accounts are created when the cluster is configured. Is there a document that mentions those.

Thanks in advance …