class Porkadot::Assets::Certs::Kubernetes

def kubelet_client_cert(refresh=false)
  return @kubelet_client_cert if defined?(@kubelet_client_cert)
  if File.file?(config.kubelet_client_cert_path) and !refresh
    self.logger.debug("--> Kubelet client cert already exists, skipping: #{config.kubelet_client_cert_path}")
    @kubelet_client_cert = OpenSSL::X509::Certificate.new(File.read(config.kubelet_client_cert_path))
  else
    @kubelet_client_cert = _client_cert(
      config.kubelet_client_cert_path,
      '/O=system:masters/CN=kube-kubelet-client',
      self.kubelet_client_key,
      self.ca_cert(false),
      self.ca_key
    )
  end
  return @kubelet_client_cert
end