Where In KubeSpray Playbook Is kubelet-client-certificate set?

Question

I am trying to learn details about how KubeSpray works. After KubeSpray runs, there is an kube-apiserver.yaml file with --kubelet-client-certificate