Certificate key when adding node to Kubernetes control plane

Question

So I know how to add a worker node to an existing Kubernetes 1.14 cluster (that was set up with kubeadm): kubeadm token create --print-join-command will print a valid kubeadm join command with correct values for arguments --token and --discovery-token-ca-cert-hash.

I currently understand that for adding another node to the control plane (master node) kubeadm join requires the additional arguments --experimental-control-plane (w/o value) and --certificate-key. This is for stacked control plane and etcd nodes.

How (in which file) can I obtain the correct value for --certificate-key for an existing cluster?

UPDATE My first (and currently only) master node was created without the argument --experimental-upload-certs to kubeadm init (but by kubeadm init --pod-network-cidr=10.244.0.0/16 instead). Therefore manual certificate distribution should apply and a possible sequence of steps could thus be:

1. copy certificates and keys in /etc/kubernetes/pki/{ca.*,sa.*,front-proxy-sa.*,etcd/ca.*} from the first to the new master node
2. run kubeadm token create --print-join-command on the first master node
3. run printed kubeadm join command with the additional argument --experimental-control-plane on the new master node

Is this the correct procedure?

Answer 1

An alternative to answers given is to use kubeadm to manage certificates by uploading the certificates as a secret to kube-system (it will expire in 2 hours). There is no need to pass a certificate key in the init phase

So you can do

kubeadm init --control-plane-endpoint "LOAD_BALANCER_DNS:LOAD_BALANCER_PORT"

And then at a later time

kubeadm init phase upload-certs --upload-certs

That command will output the certificate key you can use for the secret created

kubeadm join LOAD_BALANCER_DNS:LOAD_BALANCER_PORT --token <token> \     
--discovery-token-ca-cert-hash <hash> \
--control-plane \
--certificate-key <key from previous commmand>