digraph "OpenShift Certificates" {
  // Node definitions.
  0 [
    label="certkeypair/kube-controller-manager-csr-signer-signer\n\nsecret/csr-signer-signer -nopenshift-kube-controller-manager-operator\n"
    style=filled
    fillcolor="#c7bfff"
  ];
  1 [
    label="certkeypair/kubelet-bootstrap-kubeconfig-signer\n\n\n"
    style=filled
    fillcolor=white
  ];
  2 [
    label="certkeypair/kube-apiserver-to-kubelet-signer\n\nsecret/kube-apiserver-to-kubelet-signer -nopenshift-kube-apiserver-operator\n"
    style=filled
    fillcolor="#c7bfff"
  ];
  3 [
    label="certkeypair/kube-apiserver-to-kubelet-client\n\nsecret/kubelet-client -nopenshift-kube-apiserver\n    file:///etc/kubernetes/static-pod-resources/kube-apiserver-certs/secrets/kubelet-client/tls.crt/tls.crt,file:///etc/kubernetes/static-pod-resources/kube-apiserver-certs/secrets/kubelet-client/tls.crt/tls.key\n"
    style=filled
    fillcolor="#c8fbcd"
  ];
  4 [
    label="certkeypair/kube-control-plane-signer\n\nsecret/kube-control-plane-signer -nopenshift-kube-apiserver-operator\n"
    style=filled
    fillcolor="#c7bfff"
  ];
  5 [
    label="certkeypair/kube-apiserver-check-endpoints\n\nsecret/check-endpoints-client-cert-key -nopenshift-kube-apiserver\n    file:///etc/kubernetes/static-pod-resources/kube-apiserver-certs/secrets/check-endpoints-client-cert-key/tls.crt/tls.crt,file:///etc/kubernetes/static-pod-resources/kube-apiserver-certs/secrets/check-endpoints-client-cert-key/tls.crt/tls.key\n"
    style=filled
    fillcolor="#c8fbcd"
  ];
  6 [
    label="certkeypair/kube-scheduler-client\n\nsecret/kube-scheduler-client-cert-key -nopenshift-config-managed\n    secret/kube-scheduler-client-cert-key -nopenshift-kube-scheduler\n    file:///etc/kubernetes/static-pod-resources/kube-scheduler-certs/secrets/kube-scheduler-client-cert-key/tls.crt/tls.crt,file:///etc/kubernetes/static-pod-resources/kube-scheduler-certs/secrets/kube-scheduler-client-cert-key/tls.crt/tls.key\n"
    style=filled
    fillcolor="#c8fbcd"
  ];
  7 [
    label="certkeypair/kube-controller-manager-client\n\nsecret/kube-controller-manager-client-cert-key -nopenshift-config-managed\n    secret/kube-controller-manager-client-cert-key -nopenshift-kube-controller-manager\n    file:///etc/kubernetes/static-pod-resources/kube-controller-manager-certs/secrets/kube-controller-manager-client-cert-key/tls.crt/tls.crt,file:///etc/kubernetes/static-pod-resources/kube-controller-manager-certs/secrets/kube-controller-manager-client-cert-key/tls.crt/tls.key\n"
    style=filled
    fillcolor="#c8fbcd"
  ];
  8 [
    label="certkeypair/system:control-plane-node-admin::182205478911801730\n\nsecret/control-plane-node-admin-client-cert-key -nopenshift-kube-apiserver\n    file:///etc/kubernetes/static-pod-resources/kube-apiserver-certs/secrets/control-plane-node-admin-client-cert-key/tls.crt/tls.crt,file:///etc/kubernetes/static-pod-resources/kube-apiserver-certs/secrets/control-plane-node-admin-client-cert-key/tls.crt/tls.key\n"
    style=filled
    fillcolor="#c8fbcd"
  ];
  9 [
    label="certkeypair/admin-kubeconfig-signer::7981521128360560540\n\nfile:///etc/kubernetes/kubelet-ca.crt/kubelet-ca.crt,file://\n"
    style=filled
    fillcolor="#c7bfff"
  ];
  10 [
    label="certkeypair/system:serviceaccount:openshift-oauth-apiserver:openshift-authenticator::130808046015838906557527779576925463776\n\nsecret/openshift-authenticator-certs -nopenshift-oauth-apiserver\n"
    style=filled
    fillcolor="#c8fbcd"
  ];
  11 [
    label="certkeypair/system:serviceaccount:openshift-monitoring:prometheus-k8s::221866075839644692910412558908513329039\n\nsecret/metrics-client-certs -nopenshift-monitoring\n"
    style=filled
    fillcolor="#c8fbcd"
  ];
  12 [
    label="certkeypair/kube-controller-manager-csr-signer\n\nsecret/csr-signer -nopenshift-kube-controller-manager\n    secret/csr-signer -nopenshift-kube-controller-manager-operator\n    file:///etc/kubernetes/static-pod-resources/kube-controller-manager-certs/secrets/csr-signer/tls.crt/tls.crt,file:///etc/kubernetes/static-pod-resources/kube-controller-manager-certs/secrets/csr-signer/tls.crt/tls.key\n"
    style=filled
    fillcolor="#c7bfff"
  ];
  13 [
    label="certkeypair/per-master-debugging-signer\n\nsecret/node-system-admin-signer -nopenshift-kube-apiserver-operator\n"
    style=filled
    fillcolor="#c7bfff"
  ];
  14 [
    label="certkeypair/per-master-debugging-client\n\nsecret/node-system-admin-client -nopenshift-kube-apiserver-operator\n"
    style=filled
    fillcolor="#c8fbcd"
  ];
  15 [
    label="cabundle/kube-controller-manager-csr-signer-signer-ca\n\nconfigmaps/csr-controller-signer-ca -nopenshift-kube-controller-manager-operator\n"
    style=filled
    fillcolor="#fda172"
  ];
  16 [
    label="cabundle/kube-apiserver-from-installer-client-ca\n\nconfigmaps/initial-kube-apiserver-server-ca -nopenshift-config\n"
    style=filled
    fillcolor="#fda172"
  ];
  17 [
    label="cabundle/kubelet-bootstrap-kubeconfig-signer\n\nconfigmaps/kubelet-bootstrap-kubeconfig -nopenshift-config-managed\n"
    style=filled
    fillcolor="#fda172"
  ];
  18 [
    label="cabundle/kubelet-to-recognize-kube-apiserver-client-ca\n\nconfigmaps/kube-apiserver-to-kubelet-client-ca -nopenshift-kube-apiserver-operator\n"
    style=filled
    fillcolor="#fda172"
  ];
  19 [
    label="cabundle/kube-apiserver-kcm-and-ks-client-ca\n\nconfigmaps/kube-control-plane-signer-ca -nopenshift-kube-apiserver-operator\n"
    style=filled
    fillcolor="#fda172"
  ];
  20 [
    label="cabundle/kube-apiserver-admin-kubeconfig-client-ca\n\nconfigmaps/admin-kubeconfig-client-ca -nopenshift-config\n"
    style=filled
    fillcolor="#fda172"
  ];
  21 [
    label="cabundle/kube-apiserver-total-client-ca\n\nconfigmaps/kube-apiserver-client-ca -nopenshift-config-managed\n    configmaps/client-ca -nopenshift-controller-manager\n    configmaps/client-ca -nopenshift-kube-apiserver\n    configmaps/client-ca -nopenshift-kube-controller-manager\n    file:///etc/kubernetes/static-pod-resources/kube-apiserver-certs/configmaps/client-ca/ca-bundle.crt/ca-bundle.crt\n    file:///etc/kubernetes/static-pod-resources/kube-controller-manager-certs/configmaps/client-ca/ca-bundle.crt/ca-bundle.crt\n"
    style=filled
    fillcolor="#fda172"
  ];
  22 [
    label="cabundle/kube-apiserver-per-master-debugging-client-ca\n\nconfigmaps/node-system-admin-ca -nopenshift-kube-apiserver-operator\n"
    style=filled
    fillcolor="#fda172"
  ];
  23 [
    label="cabundle/kube-controller-manager-csr-ca\n\nconfigmaps/csr-controller-ca -nopenshift-config-managed\n    configmaps/kubelet-serving-ca -nopenshift-config-managed\n    configmaps/kubelet-serving-ca -nopenshift-kube-apiserver\n    configmaps/kubelet-serving-ca-3 -nopenshift-kube-apiserver\n    configmaps/kubelet-serving-ca-4 -nopenshift-kube-apiserver\n    configmaps/kubelet-serving-ca-5 -nopenshift-kube-apiserver\n    configmaps/kubelet-serving-ca-6 -nopenshift-kube-apiserver\n    configmaps/kubelet-serving-ca-7 -nopenshift-kube-apiserver\n    configmaps/csr-controller-ca -nopenshift-kube-controller-manager-operator\n    configmaps/csr-signer-ca -nopenshift-kube-controller-manager-operator\n    configmaps/kubelet-serving-ca-bundle -nopenshift-monitoring\n    file:///etc/kubernetes/static-pod-resources/kube-apiserver-pod-3/configmaps/kubelet-serving-ca/ca-bundle.crt/ca-bundle.crt\n    file:///etc/kubernetes/static-pod-resources/kube-apiserver-pod-7/configmaps/kubelet-serving-ca/ca-bundle.crt/ca-bundle.crt\n"
    style=filled
    fillcolor="#fda172"
  ];

  // Edge definitions.
  0 -> 10;
  0 -> 11;
  0 -> 12;
  0 -> 15;
  0 -> 16;
  0 -> 21;
  0 -> 23;
  1 -> 16;
  1 -> 17;
  1 -> 21;
  2 -> 3;
  2 -> 16;
  2 -> 18;
  2 -> 21;
  4 -> 5;
  4 -> 6;
  4 -> 7;
  4 -> 8;
  4 -> 16;
  4 -> 19;
  4 -> 21;
  9 -> 16;
  9 -> 20;
  9 -> 21;
  12 -> 21;
  12 -> 23;
  13 -> 14;
  13 -> 21;
  13 -> 22;
}