NewKubeletClientCertificateManager sets up a certificate manager without a client that can be used to sign new certificates (or rotate).

NewKubeletServerCertificateManager creates a certificate manager for the kubelet when retrieving a server certificate or returns an error.

UpdateTransport instruments a restconfig with a transport that dynamically uses certificates provided by the manager for TLS client auth.