CKA - when to use client certificate to take a backup of etcd

Kubernetes
#1

In the mock exams [CKA course by Mumshad], I learned to use these when taking the backup of etcd: --cacert=/etc/kubernetes/pki/etcd/ca.crt --cert=/etc/kubernetes/pki/etcd/server.crt --key=/etc/kubernetes/pki/etcd/server.key.
What use case of etcd backup requires to use etcd-client.crt and etcd-client.key?

#2

I believe that the etcd-client key and certs are used by kube-apiserver to communicate with etcd, so they are not used for save and restore.

#3

Communication between etcdctl and etcd is by way of Mutual TLS (mTLS).
In mTLS, both ends of the connection must use certificates to negotiate a connection. The use of client certificates allows the client to prove to the server it is who it claims to be.

See https://github.com/kodekloudhub/community-faq/blob/main/docs/etcd-faq.md#what-are-all-the-certificates-used-for

#4

Thanks Rob and Alistair.