As I understand kube-api server acts as a client when communicating with ETCD and Kubelet. Both ETCD and Kubelet act as servers for kube-api. With secure environment (two way SSL authentication), kube-api server needs the ETCD and Kubelet certificates and the CA certificate. What I don't understand is why do we need to provide the private keys of ETCD (etcd-keyfile) and Kubelet (kubelet-client-key) while configuring kube-apiserver.yaml ?
Because etcd uses X.509 mutual TLS authentication in kubernetes, so the apiserver needs to be able to prove it has ownership over the client certificate that is presented to the server, and that happens via private key
There are other authentication options for etcd, but kubernetes doesn't use them, and it's unclear if the apiserver even offers a non-TLS authentication option for connecting to etcd, even if you wanted to