kube-root-ca.crt configMap

• https://kubernetes.io/docs/tasks/tls/managing-tls-in-a-cluster/

Note:
Even though the custom CA certificate may be included in the filesystem (in the ConfigMap kube-root-ca.crt), you should not use that 
certificate authority for any purpose other than to verify internal Kubernetes endpoints. An example of an internal Kubernetes endpoint is the Service named kubernetes in the default namespace.

If you want to use a custom certificate authority for your workloads, you should generate that CA separately, and distribute its CA certificate using a ConfigMap that your pods have access to read.

See also

• TLS, mTLS: OpenSSL, LibreSSL, BoringSSL, WolfSSL, X.509, .pem, SNI, CT, OCSP, Mbed TLS, ALPN, your connection is not private, SSL Certificate Checker, Wildcard certificate, JA3 fingerprint, sslcan, TLS inspection
• Kubernetes cert-manager, kube-root-ca.crt