Which kube-apiserver flag makes the API server validate the certificate a kubelet presents?

Answer: B. --kubelet-certificate-authority

--kubelet-certificate-authority supplies the CA bundle used to verify the kubelet's serving certificate. --kubelet-client-certificate is how the API server identifies itself to the kubelet, which is the opposite direction.

Source: Communication between Nodes and the Control Plane (Kubernetes) — Control plane to node › API server to kubelet