Repository: skupperproject/skupper
Pull request #1790 (2024-11-18 15:31:56)

rename tlsSecret to tlsCredentials


Patch:
diff --git a/cmd/bootstrap/PROVIDED_CERTIFICATES.md b/cmd/bootstrap/PROVIDED_CERTIFICATES.md
index 60a0c35e..630d7eba 100644
--- a/cmd/bootstrap/PROVIDED_CERTIFICATES.md
+++ b/cmd/bootstrap/PROVIDED_CERTIFICATES.md
@@ -13,15 +13,14 @@ The certificates generated by Skupper are stored under the namespace home direct
 file system, using the following tree:
 
 ```shell
-runtime/certs/
-├── ca
-├── client
-└── server
+runtime/
+├── certs
+└── issuers
 ```
 
-As the CA `skupper-site-ca` is generated, it will be stored under the `runtime/certs/ca` path
-as a directory named `skupper-site-ca`. Inside a certificate folder, the following files are
-expected: `tls.key`, `tls.crt` and `ca.crt` (when dealing with a CA, `ca.crt` and `tls.crt`
+As the CA `skupper-site-ca` is generated, it will be stored under the `runtime/issuers` path
+as a directory named `skupper-site-ca`. Inside the issuers or certs folder, the following files are
+expected: `tls.key`, `tls.crt` and `ca.crt` (when dealing with a CA or issuer, `ca.crt` and `tls.crt`
 have the same content).
 
 If a `RouterAccess` is defined as part of the non kube site definition, Skupper will also
@@ -29,7 +28,7 @@ generate a server certificate that is valid for the provided `RouterAccess.spec.
 for each entry in the `RouterAccess.spec.subjectAlternativeName` list. The respective certificate
 is signed by the CA mentioned earlier (skupper-site-ca) and it will be named according to the
 provided `spec.tlsCredentials` field, or when it is omitted, the certificate will be named as the
-RouterAccess and stored as a directory under `runtime/certs/server`.
+RouterAccess and stored as a directory under `runtime/certs`.
 
 A set of static links are also created for the provided `RouterAccess.spec.bindHost` and for each
 entry in the `RouterAccess.spec.subjectAlternativeName` list as separate YAML files.
@@ -38,7 +37,7 @@ These static links are composed by a `Link` and a `Secret`, which is basically t
 signed by `skupper-site-ca`, that will be used by other sites to establish Skupper links. The client
 certificate is also named based on the RouterAccess `spec.tlsCredentials` field or, when it is omitted,
 the certificate will be named as the RouterAccess, prefixed with `client-` and stored under
-`runtime/certs/client`.
+`runtime/certs`.
 
 After a site bundle has been produced, it contains the whole site definition that can be installed
 at a remote location. Thus, all certificates and static links are already part of the bundle and no
@@ -49,9 +48,9 @@ new certificate is signed at the moment a bundle is installed.
 You can provide your own certificates to be used by Skupper for site linking.
 
 The provided certificates must be placed in a similar directory tree, as shown before,
-but its path under the namespace home is located at `input/certs` instead.
+but its path under the namespace home is located at `input/issuers` and `input/certs` instead.
 
-Certificates placed under this path will be used by Skupper primarily and
+Certificates placed under these paths will be used by Skupper primarily and
 all the other certificates expected by Skupper, will be generated when not provided. 
 
 Depending on your goals, some certificates should be supplied at certain phases,
@@ -108,12 +107,11 @@ certificates used for site linking, you can simply create the following structur
 the namespace home of your choice, for example:
 
 ```shell
-${HOME}/.local/share/skupper/namespaces/default/input/certs/
-└── ca
-    └── skupper-site-ca
-        ├── ca.crt
-        ├── tls.crt
-        └── tls.key
+${HOME}/.local/share/skupper/namespaces/default/input/issuers/
+└── skupper-site-ca
+    ├── ca.crt
+    ├── tls.crt
+    └── tls.key
 ```
 
 With that, if you bootstrap a site to run in the default namespace, the CA certificates above will be
@@ -138,16 +136,14 @@ must be provided under the namespace home of your choice, for example:
 
 ```shell
 ${HOME}/.local/share/skupper/namespaces/default/input/certs/
-├── client
-│   └── client-my-router-access
-│       ├── ca.crt
-│       ├── tls.crt
-│       └── tls.key
-└── server
-    └── my-router-access
-        ├── ca.crt
-        ├── tls.crt
-        └── tls.key
+├── client-my-router-access
+│   ├── ca.crt
+│   ├── tls.crt
+│   └── tls.key
+└── my-router-access
+    ├── ca.crt
+    ├── tls.crt
+    └── tls.key
 ```
 
 At bootstrap or bundle installation times, you should see a message saying that the
diff --git a/cmd/controller/controller.go b/cmd/controller/controller.go
index f9d24d9a..c24c115e 100644
--- a/cmd/controller/controller.go
+++ b/cmd/controller/controller.go
@@ -5,6 +5,7 @@ import (
 	"fmt"
 	"io"
 	"log"
+	"log/slog"
 	"os"
 	"strings"
 
@@ -92,6 +93,8 @@ func NewController(cli internalclient.Clients, grantConfig *grants.GrantConfig,
 
 	controller.startGrantServer = grants.Initialise(controller.controller, currentNamespace, watchNamespace, grantConfig, controller.generateLinkConfig)
 
+	controller.controller.WatchConfigMaps(skupperLogConfig(), currentNamespace, controller.logConfigUpdate)
+
 	return controller, nil
 }
 
@@ -348,3 +351,41 @@ func extractSiteRecords(status network.NetworkStatusInfo) []skupperv2alpha1.Site
 	}
 	return records
 }
+
+func skupperLogConfig() internalinterfaces.TweakListOptionsFunc {
+	return func(options *metav1.ListOptions) {
+		options.FieldSelector = "metadata.name=skupper-log-config"
+	}
+}
+
+func convertLogLevel(logLevel string) slog.Level {
+	switch strings.ToLower(logLevel) {
+	case "debug":
+		return slog.LevelDebug
+	case "info":
+		return slog.LevelInfo
+	case "warn":
+		return slog.LevelWarn
+	case "error":
+		return slog.LevelError
+	}
+	return slog.LevelInfo
+}
+
+func (c *Controller) logConfigUpdate(key string, cm *corev1.ConfigMap) error {
+	const controllerLogLevelKey = "CONTROLLER_LOG_LEVEL"
+	var slogLevel slog.Level
+	if cm == nil {
+		// if configmap is deleted, then set log level to info
+		slogLevel = slog.LevelInfo
+	} else {
+		logLevel := cm.Data[controllerLogLevelKey]
+		slogLevel = convertLogLevel(logLevel)
+	}
+
+	if slogLevel != controllerLogLevel.Level() {
+		controllerLogLevel.Set(slogLevel)
+	}
+	slog.Info("Updating log level", slog.String("logLevel", slogLevel.String()))
+	return nil
+}
diff --git a/cmd/controller/main.go b/cmd/controller/main.go
index 0abb595b..80c3d3d9 100644
--- a/cmd/controller/main.go
+++ b/cmd/controller/main.go
@@ -18,8 +18,10 @@ import (
 	"github.com/skupperproject/skupper/pkg/version"
 )
 
+var controllerLogLevel = new(slog.LevelVar) // defaults to Info
+
 func init() {
-	logger := slog.New(slog.NewTextHandler(os.Stdout, nil))
+	logger := slog.New(slog.NewTextHandler(os.Stdout, &slog.HandlerOptions{Level: controllerLogLevel}))
 	slog.SetDefault(logger)
 }
 
diff --git a/cmd/network-console-collector/internal/api/types_gen.go b/cmd/network-console-collector/internal/api/types_gen.go
index bf88b08d..d5afe9ef 100644
--- a/cmd/network-console-collector/internal/api/types_gen.go
+++ b/cmd/network-console-collector/internal/api/types_gen.go
@@ -222,6 +222,8 @@ type ConnectorRecord struct {
 	Parent    string `json:"parent"`
 	ProcessId string `json:"processId"`
 	Protocol  string `json:"protocol"`
+	SiteId    string `json:"siteId"`
+	SiteName  string `json:"siteName"`
 
 	// StartTime The creation time in microseconds of the record in Unix timestamp format. The value 0 means that the record is not terminated
 	StartTime uint64  `json:"startTime"`
@@ -338,6 +340,8 @@ type ListenerRecord struct {
 	Name     string `json:"name"`
 	Parent   string `json:"parent"`
 	Protocol string `json:"protocol"`
+	SiteId   string `json:"siteId"`
+	SiteName string `json:"siteName"`
 
 	// StartTime The creation time in microseconds of the record in Unix timestamp format. The value 0 means that the record is not terminated
 	StartTime uint64 `json:"startTime"`
diff --git a/cmd/network-console-collector/internal/collector/connections.go b/cmd/network-console-collector/internal/collector/connections.go
index cbe8bbd6..42c1f4f9 100644
--- a/cmd/network-console-collector/internal/collector/connections.go
+++ b/cmd/network-console-collector/internal/collector/connections.go
@@ -330,7 +330,7 @@ func (c *connectionManager) reconcile(state transportState) (ConnectionRecord, r
 	sourceSiteID := lRouterNode.Parent().ID()
 	sourceSiteHost := dref(record.SourceHost)
 	if sourceSiteID != "" && sourceSiteHost != "" {
-		sourceNode = c.graph.ConnectorTarget(ConnectorTargetID(sourceSiteID, sourceSiteHost)).Process()
+		sourceNode = c.graph.SiteHost(SiteHostID(sourceSiteID, sourceSiteHost)).Process()
 	}
 	sourceproc, ok := c.processAttrs(sourceNode.ID())
 	if !ok {
diff --git a/cmd/network-console-collector/internal/collector/graph.go b/cmd/network-console-collector/internal/collector/graph.go
index b8077d50..3ad5c94a 100644
--- a/cmd/network-console-collector/internal/collector/graph.go
+++ b/cmd/network-console-collector/internal/collector/graph.go
@@ -21,7 +21,7 @@ import (
 type Graph interface {
 	Address(id string) Address
 	Connector(id string) Connector
-	ConnectorTarget(id string) ConnectorTarget
+	SiteHost(id string) SiteHost
 	Link(id string) Link
 	Listener(id string) Listener
 	Process(id string) Process
@@ -69,8 +69,8 @@ func (g *graph) Listener(id string) Listener {
 func (g *graph) Address(id string) Address {
 	return vertexByType[Address](g.dag, id)
 }
-func (g *graph) ConnectorTarget(id string) ConnectorTarget {
-	return vertexByType[ConnectorTarget](g.dag, id)
+func (g *graph) SiteHost(id string) SiteHost {
+	return vertexByType[SiteHost](g.dag, id)
 }
 
 func vertexByType[T Node](dag *dag.DAG, id string) T {
@@ -142,8 +142,8 @@ func (g *graph) Reindex(in vanflow.Record) {
 		g.ensureParents(id, edges)
 
 		if siteID, sourceHost := record.Parent, record.SourceHost; siteID != nil && sourceHost != nil {
-			ctID := ConnectorTargetID(*siteID, *sourceHost)
-			g.dag.AddVertex(ConnectorTarget{g.newBase(ctID)})
+			ctID := SiteHostID(*siteID, *sourceHost)
+			g.dag.AddVertex(SiteHost{g.newBase(ctID)})
 			g.ensureParents(ctID, []Node{processVtx})
 		}
 	case vanflow.ConnectorRecord:
@@ -158,11 +158,12 @@ func (g *graph) Reindex(in vanflow.Record) {
 		}
 		if record.ProcessID != nil {
 			edges = append(edges, Process{g.newBase(*record.ProcessID)})
-		} else if record.DestHost != nil && record.Parent != nil {
+		}
+		if record.DestHost != nil && record.Parent != nil {
 			// TODO(ck) Fix race - if a connector came in before its router parent record we'd miss this relation
 			snode := vertexByType[Router](g.dag, *record.Parent).Parent()
 			if snode.IsKnown() {
-				edges = append(edges, ConnectorTarget{g.newBase(ConnectorTargetID(snode.ID(), *record.DestHost))})
+				edges = append(edges, SiteHost{g.newBase(SiteHostID(snode.ID(), *record.DestHost))})
 			}
 		}
 		g.ensureParents(id, edges)
@@ -336,8 +337,8 @@ func (n Listener) GetRecord() (record vanflow.ListenerRecord, found bool) {
 	return getrecord[vanflow.ListenerRecord](n)
 }
 
-func (n Listener) Parent() Router { return parentOfType[Router](n.dag, n.identity) }
-func (n Listener) Address() Node  { return parentOfType[RoutingKey](n.dag, n.identity).Parent() }
+func (n Listener) Parent() Router   { return parentOfType[Router](n.dag, n.identity) }
+func (n Listener) Address() Address { return parentOfType[RoutingKey](n.dag, n.identity).Parent() }
 
 type Connector struct {
 	baseNode
@@ -351,10 +352,11 @@ func (n Connector) Address() Address {
 
 func (n Connector) Target() Process {
 	target := parentOfType[Process](n.dag, n.identity)
-	if target.IsKnown() {
+	if _, found := target.GetRecord(); found {
 		return target
 	}
-	return parentOfType[ConnectorTarget](n.dag, n.identity).Process()
+
+	return parentOfType[SiteHost](n.dag, n.identity).Process()
 }
 
 type Process struct {
@@ -368,7 +370,7 @@ func (n Process) Parent() Site         { return parentOfType[Site](n.dag, n.iden
 func (n Process) Addresses() []Address { return nil }
 func (n Process) Connectors() []Connector {
 	connectors := childrenByType[Connector](n.dag, n.identity)
-	for _, target := range childrenByType[ConnectorTarget](n.dag, n.identity) {
+	for _, target := range childrenByType[SiteHost](n.dag, n.identity) {
 		for _, cn := range target.Connectors() {
 			if cn.IsKnown() {
 				connectors = append(connectors, cn)
@@ -392,18 +394,20 @@ func (n RoutingKey) Connectors() []Connector {
 }
 func (n RoutingKey) Listeners() []Listener { return childrenByType[Listener](n.dag, n.identity) }
 
-func ConnectorTargetID(site, host string) string {
+func SiteHostID(site, host string) string {
 	return fmt.Sprintf("%s:%s", site, host)
 }
 
-type ConnectorTarget struct {
+// SiteHost references a siteID+Host combo. Serves as a relation between
+// network traffic and processes.
+type SiteHost struct {
 	baseNode
 }
 
-func (n ConnectorTarget) Connectors() []Connector {
+func (n SiteHost) Connectors() []Connector {
 	return childrenByType[Connector](n.dag, n.identity)
 }
-func (n ConnectorTarget) Process() Process { return parentOfType[Process](n.dag, n.identity) }
+func (n SiteHost) Process() Process { return parentOfType[Process](n.dag, n.identity) }
 
 type Address struct {
 	baseNode
diff --git a/cmd/network-console-collector/internal/server/query.go b/cmd/network-console-collector/internal/server/query.go
index 8ae7f309..ea352b8a 100644
--- a/cmd/network-console-collector/internal/server/query.go
+++ b/cmd/network-console-collector/internal/server/query.go
@@ -181,6 +181,16 @@ func (m fieldIndex[T]) Compare(x, y T) int {
 	case reflect.Int64:
 		xx, yy := vx.Int(), vy.Int()
 		return int(xx - yy)
+	case reflect.Bool:
+		xx, yy := vx.Bool(), vy.Bool()
+		switch {
+		case xx == yy:
+			return 0
+		case xx && !yy:
+			return 1
+		default:
+			return -1
+		}
 	}
 	return 0
 }
diff --git a/cmd/network-console-collector/internal/server/views/views.go b/cmd/network-console-collector/internal/server/views/views.go
index 2c622c08..c5ff952f 100644
--- a/cmd/network-console-collector/internal/server/views/views.go
+++ b/cmd/network-console-collector/internal/server/views/views.go
@@ -150,6 +150,10 @@ func NewListenerProvider(graph collector.Graph) func(vanflow.ListenerRecord) api
 		if addressID := node.Address().ID(); addressID != "" {
 			out.AddressId = &addressID
 		}
+		if site, ok := node.Parent().Parent().GetRecord(); ok {
+			out.SiteId = site.ID
+			setOpt(&out.SiteName, site.Name)
+		}
 		return out
 	}
 }
@@ -163,6 +167,8 @@ func defaultListener(id string) api.ListenerRecord {
 		Address:  unknownStr,
 		DestHost: unknownStr,
 		DestPort: unknownStr,
+		SiteId:   unknownStr,
+		SiteName: unknownStr,
 	}
 }
 
@@ -199,6 +205,11 @@ func NewConnectorProvider(graph collector.Graph) func(vanflow.ConnectorRecord) a
 		}
 		if proc, ok := node.Target().GetRecord(); ok {
 			out.Target = proc.Name
+			out.ProcessId = proc.ID
+		}
+		if site, ok := node.Parent().Parent().GetRecord(); ok {
+			out.SiteId = site.ID
+			setOpt(&out.SiteName, site.Name)
 		}
 		return out
 	}
@@ -213,6 +224,8 @@ func defaultConnector(id string) api.ConnectorRecord {
 		Address:  unknownStr,
 		DestHost: unknownStr,
 		DestPort: unknownStr,
+		SiteId:   unknownStr,
+		SiteName: unknownStr,
 	}
 }
 
diff --git a/cmd/network-console-collector/spec/openapi.yaml b/cmd/network-console-collector/spec/openapi.yaml
index a335c86c..cf6424ee 100644
--- a/cmd/network-console-collector/spec/openapi.yaml
+++ b/cmd/network-console-collector/spec/openapi.yaml
@@ -976,6 +976,8 @@ components:
             - destPort
             - protocol
             - address
+            - siteId
+            - siteName
           properties:
             parent:
               type: string
@@ -991,6 +993,10 @@ components:
               type: string
             addressId:
               type: string
+            siteId:
+              type: string
+            siteName:
+              type: string
     ConnectorRecord:
       allOf:
         - $ref: '#/components/schemas/baseRecord'
@@ -1004,6 +1010,8 @@ components:
             - address
             - processId
             - target
+            - siteId
+            - siteName
           properties:
             parent:
               type: string
@@ -1024,6 +1032,10 @@ components:
             target:
               type: string
               nullable: true
+            siteId:
+              type: string
+            siteName:
+              type: string
     AddressRecord:
       allOf:
         - $ref: '#/components/schemas/baseRecord'
diff --git a/internal/cmd/skupper/common/flags.go b/internal/cmd/skupper/common/flags.go
index 97e8cfe8..418b948e 100644
--- a/internal/cmd/skupper/common/flags.go
+++ b/internal/cmd/skupper/common/flags.go
@@ -29,8 +29,8 @@ for other Kubernetes flavors, loadbalancer is the default.`
 	FlagNameSubjectAlternativeNames = "subject-alternative-names"
 	FlagDescSubjectAlternativeNames = "Add subject alternative names for the router access in non kubernetes environments"
 
-	FlagNameTlsSecret          = "tls-secret"
-	FlagDescTlsSecret          = "the name of a Kubernetes secret containing the generated or externally-supplied TLS credentials."
+	FlagNameTlsCredentials     = "tls-credentials"
+	FlagDescTlsCredentials     = "the name of a Kubernetes secret containing the generated or externally-supplied TLS credentials."
 	FlagNameCost               = "cost"
 	FlagDescCost               = "the configured \"expense\" of sending traffic over the link."
 	FlagNameGenerateCredential = "generate-credential"
@@ -99,17 +99,17 @@ type CommandSiteDeleteFlags struct {
 }
 
 type CommandLinkGenerateFlags struct {
-	TlsSecret          string
+	TlsCredentials     string
 	Cost               string
 	Output             string
 	GenerateCredential bool
 	Timeout            time.Duration
 }
 type CommandLinkUpdateFlags struct {
-	TlsSecret string
-	Cost      string
-	Output    string
-	Timeout   time.Duration
+	TlsCredentials string
+	Cost           string
+	Output         string
+	Timeout        time.Duration
 }
 
 type CommandLinkDeleteFlags struct {
@@ -134,7 +134,7 @@ type CommandConnectorCreateFlags struct {
 	RoutingKey      string
 	Host            string
 	Selector        string
-	TlsSecret       string
+	TlsCredentials  string
 	ConnectorType   string
 	IncludeNotReady bool
 	Workload        string
@@ -145,7 +145,7 @@ type CommandConnectorCreateFlags struct {
 type CommandConnectorUpdateFlags struct {
 	RoutingKey      string
 	Host            string
-	TlsSecret       string
+	TlsCredentials  string
 	ConnectorType   string
 	Port            int
 	Workload        string
@@ -164,22 +164,22 @@ type CommandConnectorStatusFlags struct {
 }
 
 type CommandListenerCreateFlags struct {
-	RoutingKey   string
-	Host         string
-	TlsSecret    string
-	ListenerType string
-	Timeout      time.Duration
-	Output       string
+	RoutingKey     string
+	Host           string
+	TlsCredentials string
+	ListenerType   string
+	Timeout        time.Duration
+	Output         string
 }
 
 type CommandListenerUpdateFlags struct {
-	RoutingKey   string
-	Host         string
-	TlsSecret    string
-	ListenerType string
-	Timeout      time.Duration
-	Port         int
-	Output       string
+	RoutingKey     string
+	Host           string
+	TlsCredentials string
+	ListenerType   string
+	Timeout        time.Duration
+	Port           int
+	Output         string
 }
 
 type CommandListenerStatusFlags struct {
diff --git a/internal/cmd/skupper/connector/connector.go b/internal/cmd/skupper/connector/connector.go
index 7f8b2b24..900d276c 100644
--- a/internal/cmd/skupper/connector/connector.go
+++ b/internal/cmd/skupper/connector/connector.go
@@ -46,7 +46,7 @@ skupper connector create backend 8080 --workload deployment/backend`,
 
 	cmd.Flags().StringVarP(&cmdFlags.RoutingKey, common.FlagNameRoutingKey, "r", "", common.FlagDescRoutingKey)
 	cmd.Flags().StringVar(&cmdFlags.Host, common.FlagNameHost, "", common.FlagDescHost)
-	cmd.Flags().StringVar(&cmdFlags.TlsSecret, common.FlagNameTlsSecret, "", common.FlagDescTlsSecret)
+	cmd.Flags().StringVar(&cmdFlags.TlsCredentials, common.FlagNameTlsCredentials, "", common.FlagDescTlsCredentials)
 	cmd.Flags().StringVar(&cmdFlags.ConnectorType, common.FlagNameConnectorType, "tcp", common.FlagDescConnectorType)
 	cmd.Flags().BoolVarP(&cmdFlags.IncludeNotReady, common.FlagNameIncludeNotReady, "i", false, common.FlagDescIncludeNotRead)
 	cmd.Flags().StringVarP(&cmdFlags.Selector, common.FlagNameSelector, "s", "", common.FlagDescSelector)
@@ -110,7 +110,7 @@ func CmdConnectorUpdateFactory(configuredPlatform types.Platform) *cobra.Command
 
 	cmd.Flags().StringVarP(&cmdFlags.RoutingKey, common.FlagNameRoutingKey, "r", "", common.FlagDescRoutingKey)
 	cmd.Flags().StringVar(&cmdFlags.Host, common.FlagNameHost, "", common.FlagDescHost)
-	cmd.Flags().StringVar(&cmdFlags.TlsSecret, common.FlagNameTlsSecret, "", common.FlagDescTlsSecret)
+	cmd.Flags().StringVar(&cmdFlags.TlsCredentials, common.FlagNameTlsCredentials, "", common.FlagDescTlsCredentials)
 	cmd.Flags().StringVar(&cmdFlags.ConnectorType, common.FlagNameConnectorType, "tcp", common.FlagDescConnectorType)
 	cmd.Flags().BoolVarP(&cmdFlags.IncludeNotReady, common.FlagNameIncludeNotReady, "i", false, common.FlagDescIncludeNotRead)
 	cmd.Flags().StringVarP(&cmdFlags.Selector, common.FlagNameSelector, "s", "", common.FlagDescSelector)
diff --git a/internal/cmd/skupper/connector/kube/connector_create.go b/internal/cmd/skupper/connector/kube/connector_create.go
index c4055bc1..64f59517 100644
--- a/internal/cmd/skupper/connector/kube/connector_create.go
+++ b/internal/cmd/skupper/connector/kube/connector_create.go
@@ -30,7 +30,7 @@ type CmdConnectorCreate struct {
 	output          string
 	host            string
 	selector        string
-	tlsSecret       string
+	tlsCredentials  string
 	routingKey      string
 	connectorType   string
 	includeNotReady bool
@@ -103,9 +103,9 @@ func (cmd *CmdConnectorCreate) ValidateInput(args []string) []error {
 			validationErrors = append(validationErrors, fmt.Errorf("routing key is not valid: %s", err))
 		}
 	}
-	if cmd.Flags != nil && cmd.Flags.TlsSecret != "" {
+	if cmd.Flags != nil && cmd.Flags.TlsCredentials != "" {
 		// check that the secret exists
-		_, err := cmd.KubeClient.CoreV1().Secrets(cmd.namespace).Get(context.TODO(), cmd.Flags.TlsSecret, metav1.GetOptions{})
+		_, err := cmd.KubeClient.CoreV1().Secrets(cmd.namespace).Get(context.TODO(), cmd.Flags.TlsCredentials, metav1.GetOptions{})
 		if err != nil {
 			validationErrors = append(validationErrors, fmt.Errorf("tls-secret is not valid: does not exist"))
 		}
@@ -227,7 +227,7 @@ func (cmd *CmdConnectorCreate) InputToOptions() {
 		cmd.routingKey = cmd.Flags.RoutingKey
 	}
 	cmd.timeout = cmd.Flags.Timeout
-	cmd.tlsSecret = cmd.Flags.TlsSecret
+	cmd.tlsCredentials = cmd.Flags.TlsCredentials
 	cmd.connectorType = cmd.Flags.ConnectorType
 	cmd.output = cmd.Flags.Output
 	cmd.includeNotReady = cmd.Flags.IncludeNotReady
@@ -248,7 +248,7 @@ func (cmd *CmdConnectorCreate) Run() error {
 			Host:            cmd.host,
 			Port:            cmd.port,
 			RoutingKey:      cmd.routingKey,
-			TlsCredentials:  cmd.tlsSecret,
+			TlsCredentials:  cmd.tlsCredentials,
 			Type:            cmd.connectorType,
 			IncludeNotReady: cmd.includeNotReady,
 			Selector:        cmd.selector,
diff --git a/internal/cmd/skupper/connector/kube/connector_update.go b/internal/cmd/skupper/connector/kube/connector_update.go
index 62b6147b..eb8b278d 100644
--- a/internal/cmd/skupper/connector/kube/connector_update.go
+++ b/internal/cmd/skupper/connector/kube/connector_update.go
@@ -22,7 +22,7 @@ import (
 type ConnectorUpdates struct {
 	routingKey      string
 	host            string
-	tlsSecret       string
+	tlsCredentials  string
 	connectorType   string
 	port            int
 	workload        string
@@ -95,7 +95,7 @@ func (cmd *CmdConnectorUpdate) ValidateInput(args []string) []error {
 			// save existing values
 			cmd.resourceVersion = connector.ResourceVersion
 			cmd.newSettings.port = connector.Spec.Port
-			cmd.newSettings.tlsSecret = connector.Spec.TlsCredentials
+			cmd.newSettings.tlsCredentials = connector.Spec.TlsCredentials
 			cmd.newSettings.connectorType = connector.Spec.Type
 			cmd.newSettings.includeNotReady = connector.Spec.IncludeNotReady
 			cmd.newSettings.routingKey = connector.Spec.RoutingKey
@@ -113,12 +113,12 @@ func (cmd *CmdConnectorUpdate) ValidateInput(args []string) []error {
 			cmd.newSettings.routingKey = cmd.Flags.RoutingKey
 		}
 	}
-	if cmd.Flags != nil && cmd.Flags.TlsSecret != "" {
-		_, err := cmd.KubeClient.CoreV1().Secrets(cmd.namespace).Get(context.TODO(), cmd.Flags.TlsSecret, metav1.GetOptions{})
+	if cmd.Flags != nil && cmd.Flags.TlsCredentials != "" {
+		_, err := cmd.KubeClient.CoreV1().Secrets(cmd.namespace).Get(context.TODO(), cmd.Flags.TlsCredentials, metav1.GetOptions{})
 		if err != nil {
 			validationErrors = append(validationErrors, fmt.Errorf("tls-secret is not valid: does not exist"))
 		} else {
-			cmd.newSettings.tlsSecret = cmd.Flags.TlsSecret
+			cmd.newSettings.tlsCredentials = cmd.Flags.TlsCredentials
 		}
 	}
 	if cmd.Flags != nil && cmd.Flags.ConnectorType != "" {
@@ -254,7 +254,7 @@ func (cmd *CmdConnectorUpdate) Run() error {
 			Host:            cmd.newSettings.host,
 			Port:            cmd.newSettings.port,
 			RoutingKey:      cmd.newSettings.routingKey,
-			TlsCredentials:  cmd.newSettings.tlsSecret,
+			TlsCredentials:  cmd.newSettings.tlsCredentials,
 			Type:            cmd.newSettings.connectorType,
 			Selector:        cmd.newSettings.selector,
 			IncludeNotReady: cmd.newSettings.includeNotReady,
diff --git a/internal/cmd/skupper/connector/nonkube/connector_create.go b/internal/cmd/skupper/connector/nonkube/connector_create.go
index f3dcd4bc..e4075963 100644
--- a/internal/cmd/skupper/connector/nonkube/connector_create.go
+++ b/internal/cmd/skupper/connector/nonkube/connector_create.go
@@ -25,7 +25,7 @@ type CmdConnectorCreate struct {
 	host             string
 	routingKey       string
 	connectorType    string
-	tlsSecret        string
+	tlsCredentials   string
 }
 
 func NewCmdConnectorCreate() *CmdConnectorCreate {
@@ -111,8 +111,8 @@ func (cmd *CmdConnectorCreate) ValidateInput(args []string) []error {
 	} else {
 		validationErrors = append(validationErrors, fmt.Errorf("host name must be configured: an IP address or hostname is expected"))
 	}
-	if cmd.Flags.TlsSecret != "" {
-		// TBD what is valid TlsSecret
+	if cmd.Flags.TlsCredentials != "" {
+		// TBD what is valid TlsCredentials
 	}
 
 	return validationErrors
@@ -133,7 +133,7 @@ func (cmd *CmdConnectorCreate) InputToOptions() {
 	cmd.host = cmd.Flags.Host
 	cmd.connectorType = cmd.Flags.ConnectorType
 	cmd.output = cmd.Flags.Output
-	cmd.tlsSecret = cmd.Flags.TlsSecret
+	cmd.tlsCredentials = cmd.Flags.TlsCredentials
 }
 
 func (cmd *CmdConnectorCreate) Run() error {
@@ -150,7 +150,7 @@ func (cmd *CmdConnectorCreate) Run() error {
 			Host:           cmd.host,
 			Port:           cmd.port,
 			RoutingKey:     cmd.routingKey,
-			TlsCredentials: cmd.tlsSecret,
+			TlsCredentials: cmd.tlsCredentials,
 			Type:           cmd.connectorType,
 		},
 	}
diff --git a/internal/cmd/skupper/connector/nonkube/connector_update.go b/internal/cmd/skupper/connector/nonkube/connector_update.go
index 5358950d..c495dcdd 100644
--- a/internal/cmd/skupper/connector/nonkube/connector_update.go
+++ b/internal/cmd/skupper/connector/nonkube/connector_update.go
@@ -14,11 +14,11 @@ import (
 )
 
 type ConnectorUpdates struct {
-	routingKey    string
-	host          string
-	connectorType string
-	port          int
-	tlsSecret     string
+	routingKey     string
+	host           string
+	connectorType  string
+	port           int
+	tlsCredentials string
 }
 type CmdConnectorUpdate struct {
 	connectorHandler *fs.ConnectorHandler
@@ -85,7 +85,7 @@ func (cmd *CmdConnectorUpdate) ValidateInput(args []string) []error {
 			cmd.newSettings.host = connector.Spec.Host
 			cmd.newSettings.port = connector.Spec.Port
 			cmd.newSettings.connectorType = connector.Spec.Type
-			cmd.newSettings.tlsSecret = connector.Spec.TlsCredentials
+			cmd.newSettings.tlsCredentials = connector.Spec.TlsCredentials
 			cmd.newSettings.routingKey = connector.Spec.RoutingKey
 		}
 	}
@@ -156,7 +156,7 @@ func (cmd *CmdConnectorUpdate) Run() error {
 			Host:           cmd.newSettings.host,
 			Port:           cmd.newSettings.port,
 			RoutingKey:     cmd.newSettings.routingKey,
-			TlsCredentials: cmd.newSettings.tlsSecret,
+			TlsCredentials: cmd.newSettings.tlsCredentials,
 			Type:           cmd.newSettings.connectorType,
 		},
 	}
diff --git a/internal/cmd/skupper/link/kube/link_generate.go b/internal/cmd/skupper/link/kube/link_generate.go
index e8575e35..86a64cf5 100644
--- a/internal/cmd/skupper/link/kube/link_generate.go
+++ b/internal/cmd/skupper/link/kube/link_generate.go
@@ -29,7 +29,7 @@ type CmdLinkGenerate struct {
 	Flags              *common.CommandLinkGenerateFlags
 	linkName           string
 	Namespace          string
-	tlsSecret          string
+	tlsCredentials     string
 	cost               int
 	output             string
 	activeSite         *v2alpha1.Site
@@ -82,10 +82,10 @@ func (cmd *CmdLinkGenerate) ValidateInput(args []string) []error {
 		validationErrors = append(validationErrors, fmt.Errorf("arguments are not allowed in this command"))
 	}
 
-	if cmd.Flags.TlsSecret == "" && !cmd.Flags.GenerateCredential {
+	if cmd.Flags.TlsCredentials == "" && !cmd.Flags.GenerateCredential {
 		validationErrors = append(validationErrors, fmt.Errorf("the TLS secret name was not specified"))
-	} else if cmd.Flags.TlsSecret != "" {
-		ok, err := resourceStringValidator.Evaluate(cmd.Flags.TlsSecret)
+	} else if cmd.Flags.TlsCredentials != "" {
+		ok, err := resourceStringValidator.Evaluate(cmd.Flags.TlsCredentials)
 		if !ok {
 			validationErrors = append(validationErrors, fmt.Errorf("the name of the tls secret is not valid: %s", err))
 		}
@@ -129,10 +129,10 @@ func (cmd *CmdLinkGenerate) InputToOptions() {
 
 	cmd.linkName = generatedLinkName
 
-	if cmd.Flags.TlsSecret == "" {
-		cmd.tlsSecret = generatedLinkName
+	if cmd.Flags.TlsCredentials == "" {
+		cmd.tlsCredentials = generatedLinkName
 	} else {
-		cmd.tlsSecret = cmd.Flags.TlsSecret
+		cmd.tlsCredentials = cmd.Flags.TlsCredentials
 	}
 
 }
@@ -158,7 +158,7 @@ func (cmd *CmdLinkGenerate) Run() error {
 			Name: cmd.linkName,
 		},
 		Spec: v2alpha1.LinkSpec{
-			TlsCredentials: cmd.tlsSecret,
+			TlsCredentials: cmd.tlsCredentials,
 			Cost:           cmd.cost,
 			Endpoints:      cmd.activeSite.Status.Endpoints,
 		},
@@ -173,7 +173,7 @@ func (cmd *CmdLinkGenerate) Run() error {
 				Kind:       "Certificate",
 			},
 			ObjectMeta: metav1.ObjectMeta{
-				Name: cmd.tlsSecret,
+				Name: cmd.tlsCredentials,
 			},
 			Spec: v2alpha1.CertificateSpec{
 				Ca:      cmd.activeSite.Status.DefaultIssuer,
@@ -207,7 +207,7 @@ func (cmd *CmdLinkGenerate) WaitUntil() error {
 
 		err := pkgutils.RetryErrorWithContext(ctxWithTimeout, time.Second, func() error {
 
-			generatedSecret, err := cmd.KubeClient.CoreV1().Secrets(cmd.Namespace).Get(context.TODO(), cmd.tlsSecret, metav1.GetOptions{})
+			generatedSecret, err := cmd.KubeClient.CoreV1().Secrets(cmd.Namespace).Get(context.TODO(), cmd.tlsCredentials, metav1.GetOptions{})
 			if err != nil {
 				return err
 			}
@@ -220,7 +220,7 @@ func (cmd *CmdLinkGenerate) WaitUntil() error {
 						Kind:       "Secret",
 					},
 					ObjectMeta: metav1.ObjectMeta{
-						Name: cmd.tlsSecret,
+						Name: cmd.tlsCredentials,
 					},
 					Type: "kubernetes.io/tls",
 					Data: map[string][]byte{
@@ -237,7 +237,7 @@ func (cmd *CmdLinkGenerate) WaitUntil() error {
 		})
 
 		if err != nil {
-			return fmt.Errorf("TLS secret %q not ready yet, check the status for more information\n", cmd.tlsSecret)
+			return fmt.Errorf("TLS secret %q not ready yet, check the status for more information\n", cmd.tlsCredentials)
 		}
 
 	}
@@ -246,7 +246,7 @@ func (cmd *CmdLinkGenerate) WaitUntil() error {
 	printResources(resourcesToPrint, cmd.output)
 
 	if cmd.generateCredential {
-		_, err = cmd.Client.Certificates(cmd.Namespace).Get(context.TODO(), cmd.tlsSecret, metav1.GetOptions{})
+		_, err = cmd.Client.Certificates(cmd.Namespace).Get(context.TODO(), cmd.tlsCredentials, metav1.GetOptions{})
 		if err != nil {
 			return fmt.Errorf("there was an error trying to delete the generated certificate: %s", err)
 		}
diff --git a/internal/cmd/skupper/link/kube/link_update.go b/internal/cmd/skupper/link/kube/link_update.go
index 64d6e3e5..7378fcc9 100644
--- a/internal/cmd/skupper/link/kube/link_update.go
+++ b/internal/cmd/skupper/link/kube/link_update.go
@@ -20,16 +20,16 @@ import (
 )
 
 type CmdLinkUpdate struct {
-	Client     skupperv2alpha1.SkupperV2alpha1Interface
-	KubeClient kubernetes.Interface
-	CobraCmd   *cobra.Command
-	Flags      *common.CommandLinkUpdateFlags
-	linkName   string
-	Namespace  string
-	tlsSecret  string
-	cost       int
-	output     string
-	timeout    time.Duration
+	Client         skupperv2alpha1.SkupperV2alpha1Interface
+	KubeClient     kubernetes.Interface
+	CobraCmd       *cobra.Command
+	Flags          *common.CommandLinkUpdateFlags
+	linkName       string
+	Namespace      string
+	tlsCredentials string
+	cost           int
+	output         string
+	timeout        time.Duration
 }
 
 func NewCmdLinkUpdate() *CmdLinkUpdate {
@@ -70,10 +70,10 @@ func (cmd *CmdLinkUpdate) ValidateInput(args []string) []error {
 		cmd.linkName = args[0]
 	}
 
-	if cmd.Flags.TlsSecret != "" {
-		secret, err := cmd.KubeClient.CoreV1().Secrets(cmd.Namespace).Get(context.TODO(), cmd.Flags.TlsSecret, metav1.GetOptions{})
+	if cmd.Flags.TlsCredentials != "" {
+		secret, err := cmd.KubeClient.CoreV1().Secrets(cmd.Namespace).Get(context.TODO(), cmd.Flags.TlsCredentials, metav1.GetOptions{})
 		if secret == nil || err != nil {
-			validationErrors = append(validationErrors, fmt.Errorf("the TLS secret %q is not available in the namespace: %s", cmd.Flags.TlsSecret, err))
+			validationErrors = append(validationErrors, fmt.Errorf("the TLS secret %q is not available in the namespace: %s", cmd.Flags.TlsCredentials, err))
 		}
 	}
 
@@ -104,7 +104,7 @@ func (cmd *CmdLinkUpdate) ValidateInput(args []string) []error {
 func (cmd *CmdLinkUpdate) InputToOptions() {
 
 	cmd.cost, _ = strconv.Atoi(cmd.Flags.Cost)
-	cmd.tlsSecret = cmd.Flags.TlsSecret
+	cmd.tlsCredentials = cmd.Flags.TlsCredentials
 	cmd.output = cmd.Flags.Output
 	cmd.timeout = cmd.Flags.Timeout
 
@@ -123,9 +123,9 @@ func (cmd *CmdLinkUpdate) Run() error {
 		updatedCost = cmd.cost
 	}
 
-	updatedTlsSecret := currentSite.Spec.TlsCredentials
-	if cmd.tlsSecret != "" {
-		updatedTlsSecret = cmd.tlsSecret
+	updatedTlsCredentials := currentSite.Spec.TlsCredentials
+	if cmd.tlsCredentials != "" {
+		updatedTlsCredentials = cmd.tlsCredentials
 	}
 
 	resource := v2alpha1.Link{
@@ -140,7 +140,7 @@ func (cmd *CmdLinkUpdate) Run() error {
 			ResourceVersion:   currentSite.ResourceVersion,
 		},
 		Spec: v2alpha1.LinkSpec{
-			TlsCredentials: updatedTlsSecret,
+			TlsCredentials: updatedTlsCredentials,
 			Cost:           updatedCost,
 		},
 	}
diff --git a/internal/cmd/skupper/link/link.go b/internal/cmd/skupper/link/link.go
index e6e6246a..38176bb7 100644
--- a/internal/cmd/skupper/link/link.go
+++ b/internal/cmd/skupper/link/link.go
@@ -41,7 +41,7 @@ output needs to be applied in the site in which we want to create the link.`,
 
 	cmd := common.ConfigureCobraCommand(configuredPlatform, cmdLinkGenerateDesc, kubeCommand, nonKubeCommand)
 	cmdFlags := common.CommandLinkGenerateFlags{}
-	cmd.Flags().StringVar(&cmdFlags.TlsSecret, common.FlagNameTlsSecret, "", common.FlagDescTlsSecret)
+	cmd.Flags().StringVar(&cmdFlags.TlsCredentials, common.FlagNameTlsCredentials, "", common.FlagDescTlsCredentials)
 	cmd.Flags().StringVar(&cmdFlags.Cost, common.FlagNameCost, "1", common.FlagDescCost)
 	cmd.Flags().StringVarP(&cmdFlags.Output, common.FlagNameOutput, "o", "yaml", common.FlagDescOutput)
 	cmd.Flags().BoolVar(&cmdFlags.GenerateCredential, common.FlagNameGenerateCredential, true, common.FlagDescGenerateCredential)
@@ -67,7 +67,7 @@ func CmdLinkUpdateFactory(configuredPlatform types.Platform) *cobra.Command {
 
 	cmd := common.ConfigureCobraCommand(configuredPlatform, cmdLinkUpdateDesc, kubeCommand, nonKubeCommand)
 	cmdFlags := common.CommandLinkUpdateFlags{}
-	cmd.Flags().StringVar(&cmdFlags.TlsSecret, common.FlagNameTlsSecret, "", common.FlagDescTlsSecret)
+	cmd.Flags().StringVar(&cmdFlags.TlsCredentials, common.FlagNameTlsCredentials, "", common.FlagDescTlsCredentials)
 	cmd.Flags().StringVar(&cmdFlags.Cost, common.FlagNameCost, "1", common.FlagDescCost)
 	cmd.Flags().DurationVar(&cmdFlags.Timeout, common.FlagNameTimeout, 60*time.Second, common.FlagDescTimeout)
 	cmd.Flags().StringVarP(&cmdFlags.Output, common.FlagNameOutput, "o", "", common.FlagDescOutput)
diff --git a/internal/cmd/skupper/listener/kube/listener_create.go b/internal/cmd/skupper/listener/kube/listener_create.go
index 5c1bff02..07b947c9 100644
--- a/internal/cmd/skupper/listener/kube/listener_create.go
+++ b/internal/cmd/skupper/listener/kube/listener_create.go
@@ -20,19 +20,19 @@ import (
 )
 
 type CmdListenerCreate struct {
-	client       skupperv2alpha1.SkupperV2alpha1Interface
-	CobraCmd     *cobra.Command
-	Flags        *common.CommandListenerCreateFlags
-	namespace    string
-	name         string
-	port         int
-	host         string
-	tlsSecret    string
-	listenerType string
-	routingKey   string
-	timeout      time.Duration
-	output       string
-	KubeClient   kubernetes.Interface
+	client         skupperv2alpha1.SkupperV2alpha1Interface
+	CobraCmd       *cobra.Command
+	Flags          *common.CommandListenerCreateFlags
+	namespace      string
+	name           string
+	port           int
+	host           string
+	tlsCredentials string
+	listenerType   string
+	routingKey     string
+	timeout        time.Duration
+	output         string
+	KubeClient     kubernetes.Interface
 }
 
 func NewCmdListenerCreate() *CmdListenerCreate {
@@ -101,9 +101,9 @@ func (cmd *CmdListenerCreate) ValidateInput(args []string) []error {
 		}
 	}
 
-	if cmd.Flags != nil && cmd.Flags.TlsSecret != "" {
+	if cmd.Flags != nil && cmd.Flags.TlsCredentials != "" {
 		// check that the secret exists
-		_, err := cmd.KubeClient.CoreV1().Secrets(cmd.namespace).Get(context.TODO(), cmd.Flags.TlsSecret, metav1.GetOptions{})
+		_, err := cmd.KubeClient.CoreV1().Secrets(cmd.namespace).Get(context.TODO(), cmd.Flags.TlsCredentials, metav1.GetOptions{})
 		if err != nil {
 			validationErrors = append(validationErrors, fmt.Errorf("tls-secret is not valid: does not exist"))
 		}
@@ -145,7 +145,7 @@ func (cmd *CmdListenerCreate) InputToOptions() {
 		cmd.routingKey = cmd.Flags.RoutingKey
 	}
 	cmd.timeout = cmd.Flags.Timeout
-	cmd.tlsSecret = cmd.Flags.TlsSecret
+	cmd.tlsCredentials = cmd.Flags.TlsCredentials
 	cmd.listenerType = cmd.Flags.ListenerType
 	cmd.output = cmd.Flags.Output
 }
@@ -165,7 +165,7 @@ func (cmd *CmdListenerCreate) Run() error {
 			Host:           cmd.host,
 			Port:           cmd.port,
 			RoutingKey:     cmd.routingKey,
-			TlsCredentials: cmd.tlsSecret,
+			TlsCredentials: cmd.tlsCredentials,
 			Type:           cmd.listenerType,
 		},
 	}
diff --git a/internal/cmd/skupper/listener/kube/listener_update.go b/internal/cmd/skupper/listener/kube/listener_update.go
index 696cf1d1..abb576df 100644
--- a/internal/cmd/skupper/listener/kube/listener_update.go
+++ b/internal/cmd/skupper/listener/kube/listener_update.go
@@ -19,13 +19,13 @@ import (
 )
 
 type ListenerUpdates struct {
-	routingKey   string
-	host         string
-	tlsSecret    string
-	listenerType string
-	port         int
-	timeout      time.Duration
-	output       string
+	routingKey     string
+	host           string
+	tlsCredentials string
+	listenerType   string
+	port           int
+	timeout        time.Duration
+	output         string
 }
 type CmdListenerUpdate struct {
 	client          skupperv2alpha1.SkupperV2alpha1Interface
@@ -86,7 +86,7 @@ func (cmd *CmdListenerUpdate) ValidateInput(args []string) []error {
 			cmd.resourceVersion = listener.ResourceVersion
 			cmd.newSettings.host = listener.Spec.Host
 			cmd.newSettings.port = listener.Spec.Port
-			cmd.newSettings.tlsSecret = listener.Spec.TlsCredentials
+			cmd.newSettings.tlsCredentials = listener.Spec.TlsCredentials
 			cmd.newSettings.listenerType = listener.Spec.Type
 		}
 	}
@@ -104,12 +104,12 @@ func (cmd *CmdListenerUpdate) ValidateInput(args []string) []error {
 	if cmd.Flags != nil && cmd.Flags.Host != "" {
 		cmd.newSettings.host = cmd.Flags.Host
 	}
-	if cmd.Flags != nil && cmd.Flags.TlsSecret != "" {
-		_, err := cmd.KubeClient.CoreV1().Secrets(cmd.namespace).Get(context.TODO(), cmd.Flags.TlsSecret, metav1.GetOptions{})
+	if cmd.Flags != nil && cmd.Flags.TlsCredentials != "" {
+		_, err := cmd.KubeClient.CoreV1().Secrets(cmd.namespace).Get(context.TODO(), cmd.Flags.TlsCredentials, metav1.GetOptions{})
 		if err != nil {
 			validationErrors = append(validationErrors, fmt.Errorf("tls-secret is not valid: does not exist"))
 		} else {
-			cmd.newSettings.tlsSecret = cmd.Flags.TlsSecret
+			cmd.newSettings.tlsCredentials = cmd.Flags.TlsCredentials
 		}
 	}
 	if cmd.Flags != nil && cmd.Flags.ListenerType != "" {
@@ -161,7 +161,7 @@ func (cmd *CmdListenerUpdate) Run() error {
 			Host:           cmd.newSettings.host,
 			Port:           cmd.newSettings.port,
 			RoutingKey:     cmd.newSettings.routingKey,
-			TlsCredentials: cmd.newSettings.tlsSecret,
+			TlsCredentials: cmd.newSettings.tlsCredentials,
 			Type:           cmd.newSettings.listenerType,
 		},
 	}
diff --git a/internal/cmd/skupper/listener/listener.go b/internal/cmd/skupper/listener/listener.go
index 5dd52088..bef9aa7c 100644
--- a/internal/cmd/skupper/listener/listener.go
+++ b/internal/cmd/skupper/listener/listener.go
@@ -45,7 +45,7 @@ func CmdListenerCreateFactory(configuredPlatform types.Platform) *cobra.Command
 
 	cmd.Flags().StringVarP(&cmdFlags.RoutingKey, common.FlagNameRoutingKey, "r", "", common.FlagDescRoutingKey)
 	cmd.Flags().StringVar(&cmdFlags.Host, common.FlagNameListenerHost, "", common.FlagDescListenerHost)
-	cmd.Flags().StringVarP(&cmdFlags.TlsSecret, common.FlagNameTlsSecret, "t", "", common.FlagDescTlsSecret)
+	cmd.Flags().StringVarP(&cmdFlags.TlsCredentials, common.FlagNameTlsCredentials, "t", "", common.FlagDescTlsCredentials)
 	cmd.Flags().StringVar(&cmdFlags.ListenerType, common.FlagNameListenerType, "tcp", common.FlagDescListenerType)
 	cmd.Flags().DurationVar(&cmdFlags.Timeout, common.FlagNameTimeout, 60*time.Second, common.FlagDescTimeout)
 	cmd.Flags().StringVarP(&cmdFlags.Output, common.FlagNameOutput, "o", "", common.FlagDescOutput)
@@ -76,7 +76,7 @@ func CmdListenerUpdateFactory(configuredPlatform types.Platform) *cobra.Command
 
 	cmd.Flags().StringVarP(&cmdFlags.RoutingKey, common.FlagNameRoutingKey, "r", "", common.FlagDescRoutingKey)
 	cmd.Flags().StringVar(&cmdFlags.Host, common.FlagNameListenerHost, "", common.FlagDescListenerHost)
-	cmd.Flags().StringVarP(&cmdFlags.TlsSecret, common.FlagNameTlsSecret, "t", "", common.FlagDescTlsSecret)
+	cmd.Flags().StringVarP(&cmdFlags.TlsCredentials, common.FlagNameTlsCredentials, "t", "", common.FlagDescTlsCredentials)
 	cmd.Flags().StringVar(&cmdFlags.ListenerType, common.FlagNameListenerType, "tcp", common.FlagDescListenerType)
 	cmd.Flags().DurationVar(&cmdFlags.Timeout, common.FlagNameTimeout, 60*time.Second, common.FlagDescTimeout)
 	cmd.Flags().IntVar(&cmdFlags.Port, common.FlagNameListenerPort, 0, common.FlagDescListenerPort)
diff --git a/internal/nonkube/bundle/install.sh.template b/internal/nonkube/bundle/install.sh.template
index f3f12cc1..ca36e1de 100644
--- a/internal/nonkube/bundle/install.sh.template
+++ b/internal/nonkube/bundle/install.sh.template
@@ -313,41 +313,33 @@ list_valid_certificates() {
     done
 }
 
-handle_provided_certificates() {
-    export USER_CERTIFICATES_PATH="${NAMESPACES_PATH}/${NAMESPACE}/input/certs"
-    [ ! -d "${USER_CERTIFICATES_PATH}" ] && return
-    cas=""
-    clients=""
-    servers=""
-    if [ -d "${USER_CERTIFICATES_PATH}/ca" ]; then
-        cas=$(list_valid_certificates "${USER_CERTIFICATES_PATH}/ca")
-    fi
-    if [ -d "${USER_CERTIFICATES_PATH}/client" ]; then
-        clients=$(list_valid_certificates "${USER_CERTIFICATES_PATH}/client")
-    fi
-    if [ -d "${USER_CERTIFICATES_PATH}/server" ]; then
-        servers=$(list_valid_certificates "${USER_CERTIFICATES_PATH}/server")
-    fi
-    if [ -z "${cas}" ] && [ -z "${clients}" ] && [ -z "${servers}" ]; then
+handle_provided_issuers() {
+    export USER_ISSUERS_PATH="${NAMESPACES_PATH}/${NAMESPACE}/input/issuers"
+    [ ! -d "${USER_ISSUERS_PATH}" ] && return
+    cas=$(list_valid_certificates "${USER_ISSUERS_PATH}")
+    if [ -z "${cas}" ]; then
         return
     fi
-    echo "User provided certificates found:"
+    echo "User provided issuers found:"
     if [ -n "${cas}" ]; then
-        echo "- CA certificates:"
         for ca in ${cas}; do
             echo "  - ${ca}"
         done
     fi
-    if [ -n "${clients}" ]; then
-        echo "- Client certificates:"
-        for client in ${clients}; do
-            echo "  - ${client}"
-        done
+    cp -r "${USER_ISSUERS_PATH}"/* "./${SOURCE_NAMESPACE}/runtime/issuers"
+}
+
+handle_provided_certificates() {
+    export USER_CERTIFICATES_PATH="${NAMESPACES_PATH}/${NAMESPACE}/input/certs"
+    [ ! -d "${USER_CERTIFICATES_PATH}" ] && return
+    certs=$(list_valid_certificates "${USER_CERTIFICATES_PATH}")
+    if [ -z "${certs}" ]; then
+        return
     fi
-    if [ -n "${servers}" ]; then
-        echo "- Server certificates:"
-        for server in ${servers}; do
-            echo "  - ${server}"
+    echo "User provided certificates found:"
+    if [ -n "${certs}" ]; then
+        for cert in ${certs}; do
+            echo "  - ${cert}"
         done
     fi
     cp -r "${USER_CERTIFICATES_PATH}"/* "./${SOURCE_NAMESPACE}/runtime/certs"
@@ -364,7 +356,7 @@ update_static_links() {
         ra_name=$(grep name: "${ra}" | grep -v '\- name:' | awk '{print $NF}' | sed 's/"//g')
         tls_credential=$(grep tlsCredentials: "${ra}" | awk '{print $NF}' | sed 's/"//g')
         bind_host=$(grep bindHost: "${ra}" | awk '{print $NF}' | sed 's/"//g')
-        client_cert_path="${USER_CERTIFICATES_PATH}/client/client-${tls_credential:-${ra_name}}"
+        client_cert_path="${USER_CERTIFICATES_PATH}/client-${tls_credential:-${ra_name}}"
 
         # no client certificate provided, skip
         [ ! -d "${client_cert_path}" ] && continue
@@ -409,7 +401,7 @@ generate_static_links_for_sans() {
         bind_host=$(grep bindHost: "${ra}" | awk '{print $NF}' | sed 's/"//g')
 
         # discovering SANS
-        server_cert="${DIR}/runtime/certs/server/${tls_credential:-${ra_name}}/tls.crt"
+        server_cert="${DIR}/runtime/certs/${tls_credential:-${ra_name}}/tls.crt"
         [ ! -f "${server_cert}" ] && continue
         subjects="$(openssl x509 -noout -ext subjectAltName -in "${server_cert}" |grep -v 'Subject Alternative Name:' | \
                     sed 's/ //g;s/,/\n/g' |  awk -F: '{if ($1 == "DNS" || $1 == "IPAddress") print $2}')"
@@ -436,6 +428,7 @@ main() {
         return
     fi
 
+    handle_provided_issuers
     handle_provided_certificates
 
     if ${DUMP_TOKENS}; then
diff --git a/pkg/kube/site/bindings.go b/pkg/kube/site/bindings.go
index 6845df4b..c470b599 100644
--- a/pkg/kube/site/bindings.go
+++ b/pkg/kube/site/bindings.go
@@ -114,12 +114,12 @@ func (a *BindingAdaptor) updateBridgeConfigForConnector(siteId string, connector
 				site.UpdateBridgeConfigForConnectorToPod(siteId, connector, pod, config)
 			}
 		} else {
-			bindings_logger.Error("Error: not yet tracking pods for connector with selector set",
+			bindings_logger.Error("Not yet tracking pods for connector with selector set",
 				slog.String("namespace", connector.Namespace),
 				slog.String("name", connector.Name))
 		}
 	} else {
-		bindings_logger.Error("Error: connector %s/%s has neither host nor selector set",
+		bindings_logger.Error("Connector has neither host nor selector set",
 			slog.String("namespace", connector.Namespace),
 			slog.String("name", connector.Name))
 	}
diff --git a/pkg/nonkube/api/environment.go b/pkg/nonkube/api/environment.go
index 66951036..0b1fa705 100644
--- a/pkg/nonkube/api/environment.go
+++ b/pkg/nonkube/api/environment.go
@@ -12,22 +12,17 @@ type InternalPath string
 type InternalPathProvider func(namespace string, internalPath InternalPath) string
 
 const (
-	InputCertificatesBasePath   InternalPath = "input/certs"
-	InputCertificatesCaPath     InternalPath = "input/certs/ca"
-	InputCertificatesClientPath InternalPath = "input/certs/client"
-	InputCertificatesServerPath InternalPath = "input/certs/server"
-	InputSiteStatePath          InternalPath = "input/resources"
-	RouterConfigPath            InternalPath = "runtime/router"
-	CertificatesBasePath        InternalPath = "runtime/certs"
-	CertificatesCaPath          InternalPath = "runtime/certs/ca"
-	CertificatesClientPath      InternalPath = "runtime/certs/client"
-	CertificatesServerPath      InternalPath = "runtime/certs/server"
-	CertificatesLinkPath        InternalPath = "runtime/certs/link"
-	RuntimePath                 InternalPath = "runtime"
-	RuntimeSiteStatePath        InternalPath = "runtime/resources"
-	RuntimeTokenPath            InternalPath = "runtime/links"
-	LoadedSiteStatePath         InternalPath = "internal/snapshot"
-	ScriptsPath                 InternalPath = "internal/scripts"
+	InputIssuersPath      InternalPath = "input/issuers"
+	InputCertificatesPath InternalPath = "input/certs"
+	InputSiteStatePath    InternalPath = "input/resources"
+	RouterConfigPath      InternalPath = "runtime/router"
+	CertificatesPath      InternalPath = "runtime/certs"
+	IssuersPath           InternalPath = "runtime/issuers"
+	RuntimePath           InternalPath = "runtime"
+	RuntimeSiteStatePath  InternalPath = "runtime/resources"
+	RuntimeTokenPath      InternalPath = "runtime/links"
+	LoadedSiteStatePath   InternalPath = "internal/snapshot"
+	ScriptsPath           InternalPath = "internal/scripts"
 )
 
 type IdGetter func() int
diff --git a/pkg/nonkube/api/site_state.go b/pkg/nonkube/api/site_state.go
index 4d26b847..8a6522ce 100644
--- a/pkg/nonkube/api/site_state.go
+++ b/pkg/nonkube/api/site_state.go
@@ -239,7 +239,7 @@ func (s *SiteState) linkAccessMap() site.RouterAccessMap {
 func (s *SiteState) linkMap(sslProfileBasePath string) site.LinkMap {
 	linkMap := site.LinkMap{}
 	for name, link := range s.Links {
-		siteLink := site.NewLink(name, path.Join(sslProfileBasePath, string(CertificatesLinkPath)))
+		siteLink := site.NewLink(name, path.Join(sslProfileBasePath, string(CertificatesPath)))
 		link.SetConfigured(nil)
 		siteLink.Update(link)
 		linkMap[name] = siteLink
@@ -248,7 +248,7 @@ func (s *SiteState) linkMap(sslProfileBasePath string) site.LinkMap {
 }
 
 func (s *SiteState) bindings(sslProfileBasePath string) *site.Bindings {
-	b := site.NewBindings(path.Join(sslProfileBasePath, "certificates/bindings"))
+	b := site.NewBindings(path.Join(sslProfileBasePath, string(CertificatesPath)))
 	for name, connector := range s.Connectors {
 		connector.SetConfigured(nil)
 		_ = b.UpdateConnector(name, connector)
@@ -289,7 +289,7 @@ func (s *SiteState) ToRouterConfig(sslProfileBasePath string, platform string) q
 		routerConfig.SiteConfig.Platform = "{{.Platform}}"
 	}
 	// LinkAccess
-	s.linkAccessMap().DesiredConfig(nil, path.Join(sslProfileBasePath, string(CertificatesServerPath))).Apply(&routerConfig)
+	s.linkAccessMap().DesiredConfig(nil, path.Join(sslProfileBasePath, string(CertificatesPath))).Apply(&routerConfig)
 	// Link
 	s.linkMap(sslProfileBasePath).Apply(&routerConfig)
 	// Bindings
diff --git a/pkg/nonkube/bundle/site_state_renderer.go b/pkg/nonkube/bundle/site_state_renderer.go
index 37efe815..c3f8e728 100644
--- a/pkg/nonkube/bundle/site_state_renderer.go
+++ b/pkg/nonkube/bundle/site_state_renderer.go
@@ -117,7 +117,7 @@ func (s *SiteStateRenderer) prepareContainers() error {
 				Options:     []string{"z"},
 			},
 			{
-				Source:      path.Join("{{.NamespacesPath}}", "{{.Namespace}}", string(api.CertificatesBasePath)),
+				Source:      path.Join("{{.NamespacesPath}}", "{{.Namespace}}", string(api.CertificatesPath)),
 				Destination: "/etc/skupper-router/runtime/certs",
 				Options:     []string{"z"},
 			},
diff --git a/pkg/nonkube/common/fs_config_renderer.go b/pkg/nonkube/common/fs_config_renderer.go
index d0745792..2163ae62 100644
--- a/pkg/nonkube/common/fs_config_renderer.go
+++ b/pkg/nonkube/common/fs_config_renderer.go
@@ -22,13 +22,10 @@ import (
 var (
 	configurationDirectories = []api.InternalPath{
 		api.RouterConfigPath,
-		api.CertificatesCaPath,
-		api.CertificatesClientPath,
-		api.CertificatesServerPath,
-		api.CertificatesLinkPath,
-		api.InputCertificatesCaPath,
-		api.InputCertificatesClientPath,
-		api.InputCertificatesServerPath,
+		api.IssuersPath,
+		api.CertificatesPath,
+		api.InputIssuersPath,
+		api.InputCertificatesPath,
 		api.InputSiteStatePath,
 		api.LoadedSiteStatePath,
 		api.RuntimeSiteStatePath,
@@ -37,9 +34,7 @@ var (
 	}
 	reloadDirectories = []api.InternalPath{
 		api.RouterConfigPath,
-		api.CertificatesClientPath,
-		api.CertificatesServerPath,
-		api.CertificatesLinkPath,
+		api.CertificatesPath,
 		api.RuntimeSiteStatePath,
 		api.RuntimeTokenPath,
 		api.ScriptsPath,
@@ -52,6 +47,7 @@ type InputPathType string
 const (
 	InputPathResources InputPathType = "resources"
 	InputPathCerts     InputPathType = "certs"
+	InputPathIssuers   InputPathType = "issuers"
 )
 
 const (
@@ -384,7 +380,7 @@ func (c *FileSystemConfigurationRenderer) createTlsCertificates(siteState *api.S
 			secret = *userCaSecret
 			fmt.Printf("-> User provided CA found: %s\n", name)
 		}
-		caPath := path.Join(outputPath, string(api.CertificatesCaPath), name)
+		caPath := path.Join(outputPath, string(api.IssuersPath), name)
 		err = writeSecretFilesIgnore(caPath, &secret, ignoreExisting)
 		if err != nil {
 			return err
@@ -420,7 +416,7 @@ func (c *FileSystemConfigurationRenderer) createTlsCertificates(siteState *api.S
 			secret = *userSecret
 			fmt.Printf("-> User provided %s certificate found: %s\n", purpose, name)
 		}
-		certPath := path.Join(outputPath, string(api.CertificatesBasePath), purpose, name)
+		certPath := path.Join(outputPath, string(api.CertificatesPath), name)
 		err = writeSecretFiles(certPath, &secret)
 		if err != nil {
 			return err
@@ -433,7 +429,7 @@ func (c *FileSystemConfigurationRenderer) createTlsCertificates(siteState *api.S
 		if !ok {
 			return fmt.Errorf("secret %s not found", secretName)
 		}
-		certPath := path.Join(outputPath, string(api.CertificatesLinkPath), secretName+"-profile")
+		certPath := path.Join(outputPath, string(api.CertificatesPath), secretName+"-profile")
 		err = writeSecretFiles(certPath, secret)
 		if err != nil {
 			return err
@@ -484,12 +480,18 @@ func (c *FileSystemConfigurationRenderer) loadClientSecret(siteState *api.SiteSt
 }
 
 func (c *FileSystemConfigurationRenderer) loadCertAsSecret(siteState *api.SiteState, purpose, name string) (*corev1.Secret, error) {
-	outputPath := path.Join(c.GetOutputPath(siteState), string(api.CertificatesBasePath))
+	outputPath := path.Join(c.GetOutputPath(siteState), string(api.CertificatesPath))
+	if purpose == "ca" {
+		outputPath = path.Join(c.GetOutputPath(siteState), string(api.IssuersPath))
+	}
 	return c.loadCertAsSecretFrom(outputPath, siteState, purpose, name)
 }
 
 func (c *FileSystemConfigurationRenderer) loadUserCertAsSecret(siteState *api.SiteState, purpose, name string) (*corev1.Secret, error) {
 	userInputPath := path.Join(c.GetInputPath(siteState, InputPathCerts))
+	if purpose == "ca" {
+		userInputPath = path.Join(c.GetInputPath(siteState, InputPathIssuers))
+	}
 	secret, err := c.loadCertAsSecretFrom(userInputPath, siteState, purpose, name)
 	if err != nil {
 		if os.IsNotExist(err) {
@@ -514,7 +516,7 @@ func (c *FileSystemConfigurationRenderer) loadUserCertAsSecret(siteState *api.Si
 }
 
 func (c *FileSystemConfigurationRenderer) loadCertAsSecretFrom(basePath string, siteState *api.SiteState, purpose, name string) (*corev1.Secret, error) {
-	certPath := path.Join(basePath, purpose, name)
+	certPath := path.Join(basePath, name)
 	var secret *corev1.Secret
 	certDir, err := os.Open(certPath)
 	if err != nil {
diff --git a/pkg/nonkube/compat/site_state_renderer.go b/pkg/nonkube/compat/site_state_renderer.go
index cab9b754..f15bc349 100644
--- a/pkg/nonkube/compat/site_state_renderer.go
+++ b/pkg/nonkube/compat/site_state_renderer.go
@@ -217,7 +217,7 @@ func (s *SiteStateRenderer) prepareContainers() error {
 				Options:     []string{"z"},
 			},
 			{
-				Source:      path.Join(siteConfigPath, string(api.CertificatesBasePath)),
+				Source:      path.Join(siteConfigPath, string(api.CertificatesPath)),
 				Destination: "/etc/skupper-router/runtime/certs",
 				Options:     []string{"z"},
 			},


Test patch:
diff --git a/cmd/network-console-collector/internal/collector/graph_test.go b/cmd/network-console-collector/internal/collector/graph_test.go
new file mode 100644
index 00000000..2178008b
--- /dev/null
+++ b/cmd/network-console-collector/internal/collector/graph_test.go
@@ -0,0 +1,97 @@
+package collector
+
+import (
+	"testing"
+
+	"github.com/skupperproject/skupper/pkg/vanflow"
+	"github.com/skupperproject/skupper/pkg/vanflow/store"
+	"gotest.tools/assert"
+)
+
+func TestGraphRelations(t *testing.T) {
+	testCases := []struct {
+		Name    string
+		Records []vanflow.Record
+		Expect  func(t *testing.T, graf Graph)
+	}{
+		{
+			Name: "Connector::processID::Process",
+			Records: []vanflow.Record{
+				vanflow.ConnectorRecord{BaseRecord: vanflow.NewBase("c1"), ProcessID: ptrTo("p1")},
+				vanflow.ProcessRecord{BaseRecord: vanflow.NewBase("p1")},
+			},
+			Expect: func(t *testing.T, graf Graph) {
+				assert.Equal(t, graf.Connector("c1").Target().ID(), "p1")
+
+			},
+		}, {
+			Name: "Connector::SiteHost::Process",
+			Records: []vanflow.Record{
+				vanflow.SiteRecord{BaseRecord: vanflow.NewBase("s1")},
+				vanflow.RouterRecord{BaseRecord: vanflow.NewBase("r1"), Parent: ptrTo("s1")},
+				vanflow.ConnectorRecord{
+					BaseRecord: vanflow.NewBase("c1"),
+					DestHost:   ptrTo("10.x.x.1"),
+					Parent:     ptrTo("r1"), Protocol: ptrTo("test")},
+				vanflow.ProcessRecord{BaseRecord: vanflow.NewBase("p1"),
+					Parent: ptrTo("s1"), SourceHost: ptrTo("10.x.x.1")},
+			},
+			Expect: func(t *testing.T, graf Graph) {
+				assert.Equal(t, graf.Connector("c1").Target().ID(), "p1")
+				assert.Equal(t, graf.SiteHost(SiteHostID("s1", "10.x.x.1")).Process().ID(), "p1")
+				assert.Equal(t, len(graf.SiteHost(SiteHostID("s1", "10.x.x.1")).Connectors()), 1)
+			},
+		}, {
+			Name: "Connector::SiteHost::Process Ignores ProcessID",
+			Records: []vanflow.Record{
+				vanflow.SiteRecord{BaseRecord: vanflow.NewBase("s1")},
+				vanflow.RouterRecord{BaseRecord: vanflow.NewBase("r1"), Parent: ptrTo("s1")},
+				vanflow.ConnectorRecord{
+					BaseRecord: vanflow.NewBase("c1"),
+					ProcessID:  ptrTo("IGNORE_ME"),
+					DestHost:   ptrTo("10.x.x.1"),
+					Parent:     ptrTo("r1"), Protocol: ptrTo("test")},
+				vanflow.ProcessRecord{BaseRecord: vanflow.NewBase("p1"),
+					Parent: ptrTo("s1"), SourceHost: ptrTo("10.x.x.1")},
+			},
+			Expect: func(t *testing.T, graf Graph) {
+				assert.Equal(t, graf.Connector("c1").Target().ID(), "p1")
+				assert.Equal(t, graf.SiteHost(SiteHostID("s1", "10.x.x.1")).Process().ID(), "p1")
+				assert.Equal(t, len(graf.SiteHost(SiteHostID("s1", "10.x.x.1")).Connectors()), 1)
+			},
+		}, {
+			Name: "Listener::SiteHost::Process",
+			Records: []vanflow.Record{
+				vanflow.SiteRecord{BaseRecord: vanflow.NewBase("s1")},
+				vanflow.RouterRecord{BaseRecord: vanflow.NewBase("r1"), Parent: ptrTo("s1")},
+				vanflow.ListenerRecord{
+					BaseRecord: vanflow.NewBase("l1"),
+					Parent:     ptrTo("r1"), Protocol: ptrTo("test")},
+				vanflow.ProcessRecord{BaseRecord: vanflow.NewBase("p1"),
+					Parent: ptrTo("s1"), SourceHost: ptrTo("10.x.x.1")},
+				vanflow.ProcessRecord{BaseRecord: vanflow.NewBase("p2"),
+					Parent: ptrTo("OTHER_SITE"), SourceHost: ptrTo("10.x.x.1")},
+			},
+			Expect: func(t *testing.T, graf Graph) {
+				siteID := graf.Listener("l1").Parent().Parent().ID()
+				assert.Equal(t, siteID, "s1")
+				proc, ok := graf.SiteHost(SiteHostID(siteID, "10.x.x.1")).Process().GetRecord()
+				assert.Assert(t, ok)
+				assert.Equal(t, proc.ID, "p1")
+			},
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.Name, func(t *testing.T) {
+			stor := store.NewSyncMapStore(store.SyncMapStoreConfig{Indexers: RecordIndexers()})
+			stor.Replace(wrapRecords(tc.Records...))
+			graf := NewGraph(stor).(*graph)
+			graf.Reset()
+			for _, r := range stor.List() {
+				graf.Reindex(r.Record)
+			}
+			tc.Expect(t, graf)
+		})
+	}
+}
diff --git a/cmd/network-console-collector/internal/server/address_test.go b/cmd/network-console-collector/internal/server/address_test.go
index a4ae775d..c2e51a04 100644
--- a/cmd/network-console-collector/internal/server/address_test.go
+++ b/cmd/network-console-collector/internal/server/address_test.go
@@ -23,6 +23,7 @@ func TestAddresses(t *testing.T) {
 	begin := time.Now()
 	testcases := []struct {
 		Records              []store.Entry
+		Parameters           map[string][]string
 		ExpectOK             bool
 		ExpectCount          int
 		ExpectTimeRangeCount int
@@ -62,6 +63,42 @@ func TestAddresses(t *testing.T) {
 				t.Error("expected to find address record for addr-1")
 			},
 		},
+		{
+			Records: wrapRecords(
+				collector.AddressRecord{ID: "addr-1", Name: "pizza", Protocol: "tcp", Start: begin},
+				collector.AddressRecord{ID: "addr-2", Name: "icecream", Protocol: "tcp", Start: begin},
+				collector.AddressRecord{ID: "addr-3", Name: "waffles", Protocol: "tcp", Start: begin},
+				vanflow.ConnectorRecord{BaseRecord: vanflow.NewBase("c1"), Address: ptrTo("pizza"), Protocol: ptrTo("tcp")},
+				vanflow.ListenerRecord{BaseRecord: vanflow.NewBase("l1"), Address: ptrTo("pizza"), Protocol: ptrTo("tcp")},
+			),
+			Parameters: map[string][]string{
+				"sortBy": {"isBound.asc"},
+			},
+			ExpectOK:    true,
+			ExpectCount: 3,
+			ExpectResults: func(t *testing.T, results []api.AddressRecord) {
+				assert.Equal(t, results[2].Identity, "addr-1", "Expected addr-1 to be last with sortBy isBound.asc")
+				assert.Equal(t, results[2].IsBound, true, "Expected addr-1 to be bound")
+			},
+		},
+		{
+			Records: wrapRecords(
+				collector.AddressRecord{ID: "addr-1", Name: "pizza", Protocol: "tcp", Start: begin},
+				collector.AddressRecord{ID: "addr-2", Name: "icecream", Protocol: "tcp", Start: begin},
+				collector.AddressRecord{ID: "addr-3", Name: "waffles", Protocol: "tcp", Start: begin},
+				vanflow.ConnectorRecord{BaseRecord: vanflow.NewBase("c1"), Address: ptrTo("pizza"), Protocol: ptrTo("tcp")},
+				vanflow.ListenerRecord{BaseRecord: vanflow.NewBase("l1"), Address: ptrTo("pizza"), Protocol: ptrTo("tcp")},
+			),
+			Parameters: map[string][]string{
+				"sortBy": {"isBound.desc"},
+			},
+			ExpectOK:    true,
+			ExpectCount: 3,
+			ExpectResults: func(t *testing.T, results []api.AddressRecord) {
+				assert.Equal(t, results[0].Identity, "addr-1", "Expected addr-1 to be first with sortBy isBound.asc")
+				assert.Equal(t, results[0].IsBound, true, "Expected addr-1 to be bound")
+			},
+		},
 	}
 
 	for _, tc := range testcases {
@@ -71,7 +108,7 @@ func TestAddresses(t *testing.T) {
 			for _, r := range tc.Records {
 				graph.(reset).Reindex(r.Record)
 			}
-			resp, err := c.AddressesWithResponse(context.TODO())
+			resp, err := c.AddressesWithResponse(context.TODO(), withParameters(tc.Parameters))
 			assert.Check(t, err)
 			if tc.ExpectOK {
 				assert.Equal(t, resp.StatusCode(), 200)
diff --git a/cmd/network-console-collector/internal/server/connections_test.go b/cmd/network-console-collector/internal/server/connections_test.go
index c9b52198..6ab421e7 100644
--- a/cmd/network-console-collector/internal/server/connections_test.go
+++ b/cmd/network-console-collector/internal/server/connections_test.go
@@ -40,15 +40,7 @@ func TestConnections(t *testing.T) {
 		t0.Add(4 * time.Minute),
 	}
 
-	testcases := []struct {
-		Records              []store.Entry
-		Flows                []store.Entry
-		Parameters           map[string][]string
-		ExpectOK             bool
-		ExpectCount          int
-		ExpectTimeRangeCount int
-		ExpectResults        func(t *testing.T, results []api.ConnectionRecord)
-	}{
+	testcases := []collectionTestCase[api.ConnectionRecord]{
 		{ExpectOK: true},
 		{
 			Records: wrapRecords(
@@ -159,7 +151,7 @@ func TestConnections(t *testing.T) {
 			for _, r := range tc.Records {
 				graph.(reset).Reindex(r.Record)
 			}
-			resp, err := c.ConnectionsWithResponse(context.TODO(), WithParameters(tc.Parameters))
+			resp, err := c.ConnectionsWithResponse(context.TODO(), withParameters(tc.Parameters))
 			assert.Check(t, err)
 			if tc.ExpectOK {
 				assert.Equal(t, resp.StatusCode(), 200)
diff --git a/cmd/network-console-collector/internal/server/connector_test.go b/cmd/network-console-collector/internal/server/connector_test.go
new file mode 100644
index 00000000..0c82f135
--- /dev/null
+++ b/cmd/network-console-collector/internal/server/connector_test.go
@@ -0,0 +1,124 @@
+package server
+
+import (
+	"context"
+	"log/slog"
+	"testing"
+
+	"github.com/skupperproject/skupper/cmd/network-console-collector/internal/api"
+	"github.com/skupperproject/skupper/cmd/network-console-collector/internal/collector"
+	"github.com/skupperproject/skupper/pkg/vanflow"
+	"github.com/skupperproject/skupper/pkg/vanflow/store"
+	"gotest.tools/assert"
+)
+
+func TestConnectors(t *testing.T) {
+	tlog := slog.Default()
+	stor := store.NewSyncMapStore(store.SyncMapStoreConfig{Indexers: collector.RecordIndexers()})
+	graph := collector.NewGraph(stor)
+	srv, c := requireTestClient(t, New(tlog, stor, graph))
+	defer srv.Close()
+	testcases := []collectionTestCase[api.ConnectorRecord]{
+		{ExpectOK: true},
+		{
+			ExpectOK: true,
+			Records: wrapRecords( // totally empty
+				vanflow.ConnectorRecord{
+					BaseRecord: vanflow.NewBase("c1"),
+				},
+			),
+			ExpectCount: 1,
+			ExpectResults: func(t *testing.T, results []api.ConnectorRecord) {
+				assert.Equal(t, len(results), 1)
+				result := results[0]
+				assert.DeepEqual(t, result, api.ConnectorRecord{
+					Identity: "c1", Name: "unknown", Parent: "unknown",
+					SiteName: "unknown", SiteId: "unknown",
+					Protocol: "unknown", Address: "unknown", DestHost: "unknown",
+					ProcessId: "", DestPort: "unknown",
+				})
+			},
+		}, {
+			Records: wrapRecords(
+				vanflow.SiteRecord{BaseRecord: vanflow.NewBase("s1"), Name: ptrTo("one")},
+				vanflow.RouterRecord{BaseRecord: vanflow.NewBase("r1"), Parent: ptrTo("s1")},
+				vanflow.ConnectorRecord{
+					BaseRecord: vanflow.NewBase("c1"), Name: ptrTo("conn-one"),
+					Parent:    ptrTo("r1"),
+					ProcessID: ptrTo("p1"),
+					Protocol:  ptrTo("tp"),
+					Address:   ptrTo("trombone"),
+					DestHost:  ptrTo("10.0.four.two"), DestPort: ptrTo("amqp"),
+				},
+				vanflow.ProcessRecord{BaseRecord: vanflow.NewBase("p1"), Name: ptrTo("proc-one")},
+				vanflow.ListenerRecord{
+					BaseRecord: vanflow.NewBase("l1"),
+					Protocol:   ptrTo("tp"),
+					Address:    ptrTo("trombone"),
+				},
+			),
+			ExpectOK:    true,
+			ExpectCount: 1,
+			ExpectResults: func(t *testing.T, results []api.ConnectorRecord) {
+				assert.Equal(t, len(results), 1)
+				result := results[0]
+				assert.DeepEqual(t, result, api.ConnectorRecord{
+					Identity: "c1", Name: "conn-one", Parent: "r1",
+					SiteName: "one", SiteId: "s1",
+					Protocol: "tp", Address: "trombone", DestHost: "10.0.four.two",
+					ProcessId: "p1", Target: ptrTo("proc-one"), DestPort: "amqp",
+				})
+			},
+		}, {
+			Records: wrapRecords(
+				vanflow.SiteRecord{BaseRecord: vanflow.NewBase("s1"), Name: ptrTo("one")},
+				vanflow.RouterRecord{BaseRecord: vanflow.NewBase("r1"), Parent: ptrTo("s1")},
+				vanflow.ConnectorRecord{
+					BaseRecord: vanflow.NewBase("c1"), Name: ptrTo("conn-one"),
+					Parent:    ptrTo("r1"),
+					ProcessID: ptrTo("does-not-exist"),
+					Protocol:  ptrTo("tp"),
+					Address:   ptrTo("trombone"),
+					DestHost:  ptrTo("10.0.four.two"), DestPort: ptrTo("amqp"),
+				},
+				vanflow.ProcessRecord{
+					BaseRecord: vanflow.NewBase("proc-site"),
+					Name:       ptrTo("my site service"),
+					Parent:     ptrTo("s1"),
+					SourceHost: ptrTo("10.0.four.two")},
+			),
+			ExpectOK:    true,
+			ExpectCount: 1,
+			ExpectResults: func(t *testing.T, results []api.ConnectorRecord) {
+				assert.Equal(t, len(results), 1)
+				result := results[0]
+				assert.Equal(t, result.ProcessId, "proc-site")
+				assert.DeepEqual(t, result.Target, ptrTo("my site service"))
+			},
+		},
+	}
+	for _, tc := range testcases {
+		t.Run("", func(t *testing.T) {
+			stor.Replace(tc.Records)
+			graph.(reset).Reset()
+			for _, r := range tc.Records {
+				graph.(reset).Reindex(r.Record)
+			}
+			resp, err := c.ConnectorsWithResponse(context.TODO(), withParameters(tc.Parameters))
+			assert.Check(t, err)
+			if tc.ExpectOK {
+				assert.Equal(t, resp.StatusCode(), 200)
+				assert.Equal(t, resp.JSON200.Count, int64(tc.ExpectCount))
+				assert.Equal(t, len(resp.JSON200.Results), tc.ExpectCount)
+				if tc.ExpectTimeRangeCount != 0 {
+					assert.Equal(t, resp.JSON200.TimeRangeCount, int64(tc.ExpectTimeRangeCount))
+				}
+				if tc.ExpectResults != nil {
+					tc.ExpectResults(t, resp.JSON200.Results)
+				}
+			} else {
+				assert.Check(t, resp.JSON400 != nil)
+			}
+		})
+	}
+}
diff --git a/cmd/network-console-collector/internal/server/links_test.go b/cmd/network-console-collector/internal/server/links_test.go
index ee44ff01..657aaa93 100644
--- a/cmd/network-console-collector/internal/server/links_test.go
+++ b/cmd/network-console-collector/internal/server/links_test.go
@@ -31,14 +31,7 @@ func TestRouterlinks(t *testing.T) {
 		vanflow.RouterAccessRecord{BaseRecord: vanflow.NewBase("routeraccess-b-2"), Name: ptrTo("routeraccess b.2"), Parent: ptrTo("router-b-2")},
 	}
 
-	testcases := []struct {
-		Records              []store.Entry
-		Parameters           map[string][]string
-		ExpectOK             bool
-		ExpectCount          int
-		ExpectTimeRangeCount int
-		ExpectResults        func(t *testing.T, results []api.RouterLinkRecord)
-	}{
+	testcases := []collectionTestCase[api.RouterLinkRecord]{
 		{ExpectOK: true},
 		{
 			ExpectOK: true,
@@ -96,7 +89,7 @@ func TestRouterlinks(t *testing.T) {
 			for _, r := range tc.Records {
 				graph.(reset).Reindex(r.Record)
 			}
-			resp, err := c.RouterlinksWithResponse(context.TODO(), WithParameters(tc.Parameters))
+			resp, err := c.RouterlinksWithResponse(context.TODO(), withParameters(tc.Parameters))
 			assert.Check(t, err)
 			if tc.ExpectOK {
 				assert.Equal(t, resp.StatusCode(), 200)
diff --git a/cmd/network-console-collector/internal/server/process_test.go b/cmd/network-console-collector/internal/server/process_test.go
index 45e3cc12..d9888f73 100644
--- a/cmd/network-console-collector/internal/server/process_test.go
+++ b/cmd/network-console-collector/internal/server/process_test.go
@@ -19,14 +19,7 @@ func TestProcesses(t *testing.T) {
 	srv, c := requireTestClient(t, New(tlog, stor, graph))
 	defer srv.Close()
 
-	testcases := []struct {
-		Records              []store.Entry
-		Parameters           map[string][]string
-		ExpectOK             bool
-		ExpectCount          int
-		ExpectTimeRangeCount int
-		ExpectResults        func(t *testing.T, results []api.ProcessRecord)
-	}{
+	testcases := []collectionTestCase[api.ProcessRecord]{
 		{ExpectOK: true},
 		{
 			Records: wrapRecords(
@@ -110,7 +103,7 @@ func TestProcesses(t *testing.T) {
 			for _, r := range tc.Records {
 				graph.(reset).Reindex(r.Record)
 			}
-			resp, err := c.ProcessesWithResponse(context.TODO(), WithParameters(tc.Parameters))
+			resp, err := c.ProcessesWithResponse(context.TODO(), withParameters(tc.Parameters))
 			assert.Check(t, err)
 			if tc.ExpectOK {
 				assert.Equal(t, resp.StatusCode(), 200)
diff --git a/cmd/network-console-collector/internal/server/processpairs_test.go b/cmd/network-console-collector/internal/server/processpairs_test.go
index af58eba7..77122f61 100644
--- a/cmd/network-console-collector/internal/server/processpairs_test.go
+++ b/cmd/network-console-collector/internal/server/processpairs_test.go
@@ -42,7 +42,7 @@ func TestProcessPairsByAddress(t *testing.T) {
 			for _, r := range tc.Records {
 				graph.(reset).Reindex(r.Record)
 			}
-			resp, err := c.ProcessPairsByAddressWithResponse(context.TODO(), tc.ID, WithParameters(tc.Parameters))
+			resp, err := c.ProcessPairsByAddressWithResponse(context.TODO(), tc.ID, withParameters(tc.Parameters))
 			assert.Check(t, err)
 			if tc.ExpectOK {
 				assert.Equal(t, resp.StatusCode(), 200)
diff --git a/cmd/network-console-collector/internal/server/router_test.go b/cmd/network-console-collector/internal/server/router_test.go
index 8473ef0e..240b7c06 100644
--- a/cmd/network-console-collector/internal/server/router_test.go
+++ b/cmd/network-console-collector/internal/server/router_test.go
@@ -30,14 +30,7 @@ func TestRouters(t *testing.T) {
 		vanflow.RouterRecord{BaseRecord: vanflow.NewBase("router-b-2"), Name: ptrTo("router b.2"), Parent: ptrTo("site-b")},
 	}
 
-	testcases := []struct {
-		Records              []store.Entry
-		Parameters           map[string][]string
-		ExpectOK             bool
-		ExpectCount          int
-		ExpectTimeRangeCount int
-		ExpectResults        func(t *testing.T, results []api.RouterRecord)
-	}{
+	testcases := []collectionTestCase[api.RouterRecord]{
 		{ExpectOK: true},
 		{
 			ExpectOK:    true,
@@ -73,7 +66,7 @@ func TestRouters(t *testing.T) {
 			for _, r := range tc.Records {
 				graph.(reset).Reindex(r.Record)
 			}
-			resp, err := c.RoutersWithResponse(context.TODO(), WithParameters(tc.Parameters))
+			resp, err := c.RoutersWithResponse(context.TODO(), withParameters(tc.Parameters))
 			assert.Check(t, err)
 			if tc.ExpectOK {
 				assert.Equal(t, resp.StatusCode(), 200)
diff --git a/cmd/network-console-collector/internal/server/shared_test.go b/cmd/network-console-collector/internal/server/shared_test.go
index 2131a631..a5223326 100644
--- a/cmd/network-console-collector/internal/server/shared_test.go
+++ b/cmd/network-console-collector/internal/server/shared_test.go
@@ -21,6 +21,17 @@ func requireTestClient(t *testing.T, impl api.ServerInterface) (*httptest.Server
 	return htsrv, client
 }
 
+type collectionTestCase[T api.Record] struct {
+	Records              []store.Entry
+	Flows                []store.Entry
+	Parameters           map[string][]string
+	ExpectOK             bool
+	ExpectCount          int
+	ExpectTimeRangeCount int
+	ExpectError          string
+	ExpectResults        func(t *testing.T, results []T)
+}
+
 func ptrTo[T any](c T) *T {
 	return &c
 }
@@ -38,7 +49,11 @@ type reset interface {
 	Reindex(vanflow.Record)
 }
 
-func WithParameters(params map[string][]string) func(context.Context, *http.Request) error {
+type statusCoder interface {
+	StatusCode() int
+}
+
+func withParameters(params map[string][]string) func(context.Context, *http.Request) error {
 	return func(ctx context.Context, r *http.Request) error {
 		values := r.URL.Query()
 		for k, vs := range params {
diff --git a/cmd/network-console-collector/internal/server/sites_test.go b/cmd/network-console-collector/internal/server/sites_test.go
index f7b2092e..fe87667f 100644
--- a/cmd/network-console-collector/internal/server/sites_test.go
+++ b/cmd/network-console-collector/internal/server/sites_test.go
@@ -20,15 +20,7 @@ func TestSites(t *testing.T) {
 	srv, c := requireTestClient(t, New(tlog, stor, graph))
 	defer srv.Close()
 
-	testcases := []struct {
-		Records              []store.Entry
-		Parameters           map[string][]string
-		ExpectOK             bool
-		ExpectCount          int
-		ExpectTimeRangeCount int
-		ExpectResults        func(t *testing.T, results []api.SiteRecord)
-		ExpectError          string
-	}{
+	testcases := []collectionTestCase[api.SiteRecord]{
 		{ExpectOK: true},
 		{
 			Records: wrapRecords(
@@ -79,7 +71,7 @@ func TestSites(t *testing.T) {
 		t.Run("", func(t *testing.T) {
 			stor.Replace(tc.Records)
 			graph.(reset).Reset()
-			resp, err := c.SitesWithResponse(context.TODO(), WithParameters(tc.Parameters))
+			resp, err := c.SitesWithResponse(context.TODO(), withParameters(tc.Parameters))
 			assert.Check(t, err)
 			if tc.ExpectOK {
 				assert.Equal(t, resp.StatusCode(), 200)
diff --git a/internal/cmd/skupper/connector/connector_test.go b/internal/cmd/skupper/connector/connector_test.go
index 854c8a9c..432c0de7 100644
--- a/internal/cmd/skupper/connector/connector_test.go
+++ b/internal/cmd/skupper/connector/connector_test.go
@@ -24,7 +24,7 @@ func TestCmdConnectorFactory(t *testing.T) {
 			expectedFlagsWithDefaultValue: map[string]interface{}{
 				common.FlagNameRoutingKey:      "",
 				common.FlagNameHost:            "",
-				common.FlagNameTlsSecret:       "",
+				common.FlagNameTlsCredentials:  "",
 				common.FlagNameConnectorType:   "tcp",
 				common.FlagNameIncludeNotReady: "false",
 				common.FlagNameSelector:        "",
@@ -39,7 +39,7 @@ func TestCmdConnectorFactory(t *testing.T) {
 			expectedFlagsWithDefaultValue: map[string]interface{}{
 				common.FlagNameRoutingKey:      "",
 				common.FlagNameHost:            "",
-				common.FlagNameTlsSecret:       "",
+				common.FlagNameTlsCredentials:  "",
 				common.FlagNameConnectorType:   "tcp",
 				common.FlagNameIncludeNotReady: "false",
 				common.FlagNameSelector:        "",
diff --git a/internal/cmd/skupper/connector/kube/connector_create_test.go b/internal/cmd/skupper/connector/kube/connector_create_test.go
index db361cf7..42e8d2bd 100644
--- a/internal/cmd/skupper/connector/kube/connector_create_test.go
+++ b/internal/cmd/skupper/connector/kube/connector_create_test.go
@@ -166,9 +166,9 @@ func TestCmdConnectorCreate_ValidateInput(t *testing.T) {
 			name: "tls-secret does not exist",
 			args: []string{"my-connector-tls", "8080"},
 			flags: common.CommandConnectorCreateFlags{
-				TlsSecret: "not-valid",
-				Timeout:   1 * time.Minute,
-				Selector:  "backend",
+				TlsCredentials: "not-valid",
+				Timeout:        1 * time.Minute,
+				Selector:       "backend",
 			},
 			expectedErrors: []string{"tls-secret is not valid: does not exist"},
 		},
@@ -565,51 +565,51 @@ func TestCmdConnectorCreate_ValidateWorkload(t *testing.T) {
 func TestCmdConnectorCreate_InputToOptions(t *testing.T) {
 
 	type test struct {
-		name                  string
-		flags                 common.CommandConnectorCreateFlags
-		Connectorname         string
-		expectedTlsSecret     string
-		expectedHost          string
-		expectedSelector      string
-		expectedRoutingKey    string
-		expectedConnectorType string
-		expectedOutput        string
-		expectedTimeout       time.Duration
+		name                   string
+		flags                  common.CommandConnectorCreateFlags
+		Connectorname          string
+		expectedTlsCredentials string
+		expectedHost           string
+		expectedSelector       string
+		expectedRoutingKey     string
+		expectedConnectorType  string
+		expectedOutput         string
+		expectedTimeout        time.Duration
 	}
 
 	testTable := []test{
 		{
-			name:                  "test1",
-			flags:                 common.CommandConnectorCreateFlags{"backend", "", "app=backend", "secret", "tcp", true, "", 20 * time.Second, "json"},
-			expectedTlsSecret:     "secret",
-			expectedHost:          "",
-			expectedRoutingKey:    "backend",
-			expectedTimeout:       20 * time.Second,
-			expectedConnectorType: "tcp",
-			expectedOutput:        "json",
-			expectedSelector:      "app=backend",
-		},
-		{
-			name:                  "test2",
-			flags:                 common.CommandConnectorCreateFlags{"backend", "backend", "", "secret", "tcp", true, "", 20 * time.Second, "json"},
-			expectedTlsSecret:     "secret",
-			expectedHost:          "backend",
-			expectedRoutingKey:    "backend",
-			expectedTimeout:       20 * time.Second,
-			expectedConnectorType: "tcp",
-			expectedOutput:        "json",
-			expectedSelector:      "",
-		},
-		{
-			name:                  "test3",
-			flags:                 common.CommandConnectorCreateFlags{"", "", "", "secret", "tcp", false, "", 30 * time.Second, "yaml"},
-			expectedTlsSecret:     "secret",
-			expectedHost:          "",
-			expectedRoutingKey:    "test3",
-			expectedTimeout:       30 * time.Second,
-			expectedConnectorType: "tcp",
-			expectedOutput:        "yaml",
-			expectedSelector:      "app=test3",
+			name:                   "test1",
+			flags:                  common.CommandConnectorCreateFlags{"backend", "", "app=backend", "secret", "tcp", true, "", 20 * time.Second, "json"},
+			expectedTlsCredentials: "secret",
+			expectedHost:           "",
+			expectedRoutingKey:     "backend",
+			expectedTimeout:        20 * time.Second,
+			expectedConnectorType:  "tcp",
+			expectedOutput:         "json",
+			expectedSelector:       "app=backend",
+		},
+		{
+			name:                   "test2",
+			flags:                  common.CommandConnectorCreateFlags{"backend", "backend", "", "secret", "tcp", true, "", 20 * time.Second, "json"},
+			expectedTlsCredentials: "secret",
+			expectedHost:           "backend",
+			expectedRoutingKey:     "backend",
+			expectedTimeout:        20 * time.Second,
+			expectedConnectorType:  "tcp",
+			expectedOutput:         "json",
+			expectedSelector:       "",
+		},
+		{
+			name:                   "test3",
+			flags:                  common.CommandConnectorCreateFlags{"", "", "", "secret", "tcp", false, "", 30 * time.Second, "yaml"},
+			expectedTlsCredentials: "secret",
+			expectedHost:           "",
+			expectedRoutingKey:     "test3",
+			expectedTimeout:        30 * time.Second,
+			expectedConnectorType:  "tcp",
+			expectedOutput:         "yaml",
+			expectedSelector:       "app=test3",
 		},
 	}
 
@@ -626,7 +626,7 @@ func TestCmdConnectorCreate_InputToOptions(t *testing.T) {
 
 			assert.Check(t, cmd.routingKey == test.expectedRoutingKey)
 			assert.Check(t, cmd.output == test.expectedOutput)
-			assert.Check(t, cmd.tlsSecret == test.expectedTlsSecret)
+			assert.Check(t, cmd.tlsCredentials == test.expectedTlsCredentials)
 			assert.Check(t, cmd.host == test.expectedHost)
 			assert.Check(t, cmd.timeout == test.expectedTimeout)
 			assert.Check(t, cmd.selector == test.expectedSelector)
@@ -655,7 +655,7 @@ func TestCmdConnectorCreate_Run(t *testing.T) {
 			flags: common.CommandConnectorCreateFlags{
 				ConnectorType:   "tcp",
 				RoutingKey:      "keyname",
-				TlsSecret:       "secretname",
+				TlsCredentials:  "secretname",
 				IncludeNotReady: true,
 				Selector:        "app=backend",
 				Timeout:         10 * time.Second,
@@ -669,7 +669,7 @@ func TestCmdConnectorCreate_Run(t *testing.T) {
 				ConnectorType:   "tcp",
 				Host:            "hostname",
 				RoutingKey:      "keyname",
-				TlsSecret:       "secretname",
+				TlsCredentials:  "secretname",
 				IncludeNotReady: true,
 				Timeout:         10 * time.Second,
 				Output:          "json",
diff --git a/internal/cmd/skupper/connector/kube/connector_update_test.go b/internal/cmd/skupper/connector/kube/connector_update_test.go
index 8b982ff6..dc3c5eed 100644
--- a/internal/cmd/skupper/connector/kube/connector_update_test.go
+++ b/internal/cmd/skupper/connector/kube/connector_update_test.go
@@ -117,8 +117,8 @@ func TestCmdConnectorUpdate_ValidateInput(t *testing.T) {
 			name: "tls-secret is not valid",
 			args: []string{"my-connector-tls"},
 			flags: common.CommandConnectorUpdateFlags{
-				TlsSecret: "test-tls",
-				Timeout:   50 * time.Second,
+				TlsCredentials: "test-tls",
+				Timeout:        50 * time.Second,
 			},
 			skupperObjects: []runtime.Object{
 				&v2alpha1.Connector{
@@ -365,7 +365,7 @@ func TestCmdConnectorUpdate_ValidateInput(t *testing.T) {
 			args: []string{"my-connector-flags"},
 			flags: common.CommandConnectorUpdateFlags{
 				RoutingKey:      "routingkeyname",
-				TlsSecret:       "secretname",
+				TlsCredentials:  "secretname",
 				Port:            1234,
 				ConnectorType:   "tcp",
 				IncludeNotReady: false,
@@ -942,7 +942,7 @@ func TestCmdConnectorUpdate_Run(t *testing.T) {
 				connectorType:   "tcp",
 				host:            "hostname",
 				routingKey:      "keyname",
-				tlsSecret:       "secretname",
+				tlsCredentials:  "secretname",
 				includeNotReady: true,
 				workload:        "deployment/backend",
 				selector:        "backend",
@@ -975,7 +975,7 @@ func TestCmdConnectorUpdate_Run(t *testing.T) {
 				connectorType:   "tcp",
 				host:            "hostname",
 				routingKey:      "keyname",
-				tlsSecret:       "secretname",
+				tlsCredentials:  "secretname",
 				includeNotReady: true,
 				workload:        "deployment/backend",
 				selector:        "backend",
diff --git a/internal/cmd/skupper/connector/nonkube/connector_create_test.go b/internal/cmd/skupper/connector/nonkube/connector_create_test.go
index 7b407551..228b8707 100644
--- a/internal/cmd/skupper/connector/nonkube/connector_create_test.go
+++ b/internal/cmd/skupper/connector/nonkube/connector_create_test.go
@@ -110,11 +110,11 @@ func TestNonKubeCmdConnectorCreate_ValidateInput(t *testing.T) {
 			name: "flags all valid",
 			args: []string{"my-connector-flags", "8080"},
 			flags: &common.CommandConnectorCreateFlags{
-				RoutingKey:    "routingkeyname",
-				TlsSecret:     "secretname",
-				ConnectorType: "tcp",
-				Output:        "json",
-				Host:          "1.2.3.4",
+				RoutingKey:     "routingkeyname",
+				TlsCredentials: "secretname",
+				ConnectorType:  "tcp",
+				Output:         "json",
+				Host:           "1.2.3.4",
 			},
 			expectedErrors: []string{},
 		},
@@ -148,51 +148,51 @@ func TestNonKubeCmdConnectorCreate_ValidateInput(t *testing.T) {
 func TestNonKubeCmdConnectorCreate_InputToOptions(t *testing.T) {
 
 	type test struct {
-		name                  string
-		args                  []string
-		namespace             string
-		flags                 common.CommandConnectorCreateFlags
-		expectedNamespace     string
-		Connectorname         string
-		expectedTlsSecret     string
-		expectedHost          string
-		expectedRoutingKey    string
-		expectedConnectorType string
-		expectedOutput        string
+		name                   string
+		args                   []string
+		namespace              string
+		flags                  common.CommandConnectorCreateFlags
+		expectedNamespace      string
+		Connectorname          string
+		expectedTlsCredentials string
+		expectedHost           string
+		expectedRoutingKey     string
+		expectedConnectorType  string
+		expectedOutput         string
 	}
 
 	testTable := []test{
 		{
-			name:                  "test1",
-			flags:                 common.CommandConnectorCreateFlags{"backend", "", "", "secret", "tcp", false, "", 0, "json"},
-			expectedTlsSecret:     "secret",
-			expectedHost:          "",
-			expectedRoutingKey:    "backend",
-			expectedConnectorType: "tcp",
-			expectedOutput:        "json",
-			expectedNamespace:     "default",
+			name:                   "test1",
+			flags:                  common.CommandConnectorCreateFlags{"backend", "", "", "secret", "tcp", false, "", 0, "json"},
+			expectedTlsCredentials: "secret",
+			expectedHost:           "",
+			expectedRoutingKey:     "backend",
+			expectedConnectorType:  "tcp",
+			expectedOutput:         "json",
+			expectedNamespace:      "default",
 		},
 		{
-			name:                  "test2",
-			namespace:             "test",
-			flags:                 common.CommandConnectorCreateFlags{"backend", "1.2.3.4", "", "secret", "tcp", false, "", 0, "json"},
-			expectedTlsSecret:     "secret",
-			expectedHost:          "1.2.3.4",
-			expectedRoutingKey:    "backend",
-			expectedConnectorType: "tcp",
-			expectedOutput:        "json",
-			expectedNamespace:     "test",
+			name:                   "test2",
+			namespace:              "test",
+			flags:                  common.CommandConnectorCreateFlags{"backend", "1.2.3.4", "", "secret", "tcp", false, "", 0, "json"},
+			expectedTlsCredentials: "secret",
+			expectedHost:           "1.2.3.4",
+			expectedRoutingKey:     "backend",
+			expectedConnectorType:  "tcp",
+			expectedOutput:         "json",
+			expectedNamespace:      "test",
 		},
 		{
-			name:                  "test3",
-			namespace:             "test",
-			flags:                 common.CommandConnectorCreateFlags{"", "", "", "secret", "tcp", false, "", 0, "yaml"},
-			expectedTlsSecret:     "secret",
-			expectedHost:          "",
-			expectedRoutingKey:    "my-Connector",
-			expectedConnectorType: "tcp",
-			expectedOutput:        "yaml",
-			expectedNamespace:     "test",
+			name:                   "test3",
+			namespace:              "test",
+			flags:                  common.CommandConnectorCreateFlags{"", "", "", "secret", "tcp", false, "", 0, "yaml"},
+			expectedTlsCredentials: "secret",
+			expectedHost:           "",
+			expectedRoutingKey:     "my-Connector",
+			expectedConnectorType:  "tcp",
+			expectedOutput:         "yaml",
+			expectedNamespace:      "test",
 		},
 	}
 
@@ -207,7 +207,7 @@ func TestNonKubeCmdConnectorCreate_InputToOptions(t *testing.T) {
 			cmd.InputToOptions()
 
 			assert.Check(t, cmd.routingKey == test.expectedRoutingKey)
-			assert.Check(t, cmd.tlsSecret == test.expectedTlsSecret)
+			assert.Check(t, cmd.tlsCredentials == test.expectedTlsCredentials)
 			assert.Check(t, cmd.host == test.expectedHost)
 			assert.Check(t, cmd.connectorType == test.expectedConnectorType)
 			assert.Check(t, cmd.output == test.expectedOutput)
@@ -228,7 +228,7 @@ func TestNonKubeCmdConnectorCreate_Run(t *testing.T) {
 		output         string
 		errorMessage   string
 		routingKey     string
-		tlsSecret      string
+		tlsCredentials string
 		connectorType  string
 		connectorPort  int
 	}
@@ -243,7 +243,7 @@ func TestNonKubeCmdConnectorCreate_Run(t *testing.T) {
 			connectorPort:  8080,
 			connectorType:  "tcp",
 			routingKey:     "keyname",
-			tlsSecret:      "secretname",
+			tlsCredentials: "secretname",
 			host:           "1.2.3.4",
 		},
 		{
diff --git a/internal/cmd/skupper/connector/nonkube/connector_update_test.go b/internal/cmd/skupper/connector/nonkube/connector_update_test.go
index 8f0be13a..3250969a 100644
--- a/internal/cmd/skupper/connector/nonkube/connector_update_test.go
+++ b/internal/cmd/skupper/connector/nonkube/connector_update_test.go
@@ -105,12 +105,12 @@ func TestCmdConnectorUpdate_ValidateInput(t *testing.T) {
 			name: "flags all valid",
 			args: []string{"my-connector"},
 			flags: &common.CommandConnectorUpdateFlags{
-				RoutingKey:    "routingkeyname",
-				TlsSecret:     "secretname",
-				Port:          1234,
-				ConnectorType: "tcp",
-				Output:        "json",
-				Host:          "1.2.3.4",
+				RoutingKey:     "routingkeyname",
+				TlsCredentials: "secretname",
+				Port:           1234,
+				ConnectorType:  "tcp",
+				Output:         "json",
+				Host:           "1.2.3.4",
 			},
 			expectedErrors: []string{},
 		},
@@ -174,31 +174,31 @@ func TestCmdConnectorUpdate_Run(t *testing.T) {
 		host                string
 		output              string
 		routingKey          string
-		tlsSecret           string
+		tlsCredentials      string
 		connectorType       string
 		port                int
 	}
 
 	testTable := []test{
 		{
-			name:          "runs ok",
-			namespace:     "test",
-			connectorName: "my-connector",
-			port:          8080,
-			connectorType: "tcp",
-			host:          "hostname",
-			routingKey:    "keyname",
-			tlsSecret:     "secretname",
+			name:           "runs ok",
+			namespace:      "test",
+			connectorName:  "my-connector",
+			port:           8080,
+			connectorType:  "tcp",
+			host:           "hostname",
+			routingKey:     "keyname",
+			tlsCredentials: "secretname",
 		},
 		{
-			name:          "run output json",
-			connectorName: "my-connector",
-			port:          8181,
-			connectorType: "tcp",
-			host:          "hostname",
-			routingKey:    "keyname",
-			tlsSecret:     "secretname",
-			output:        "json",
+			name:           "run output json",
+			connectorName:  "my-connector",
+			port:           8181,
+			connectorType:  "tcp",
+			host:           "hostname",
+			routingKey:     "keyname",
+			tlsCredentials: "secretname",
+			output:         "json",
 		},
 	}
 
@@ -210,7 +210,7 @@ func TestCmdConnectorUpdate_Run(t *testing.T) {
 		command.newSettings.port = test.port
 		command.newSettings.host = test.host
 		command.newSettings.routingKey = test.routingKey
-		command.newSettings.tlsSecret = test.tlsSecret
+		command.newSettings.tlsCredentials = test.tlsCredentials
 		command.namespace = test.namespace
 		command.connectorHandler = fs.NewConnectorHandler(command.namespace)
 		defer command.connectorHandler.Delete("my-connector")
diff --git a/internal/cmd/skupper/link/kube/link_generate_test.go b/internal/cmd/skupper/link/kube/link_generate_test.go
index e43ef8ba..a56f56bb 100644
--- a/internal/cmd/skupper/link/kube/link_generate_test.go
+++ b/internal/cmd/skupper/link/kube/link_generate_test.go
@@ -29,7 +29,7 @@ func TestCmdLinkGenerate_ValidateInput(t *testing.T) {
 		{
 			name:           "link yaml is not generated because there is no site in the namespace.",
 			expectedErrors: []string{"there is no skupper site in this namespace", "there is no active skupper site in this namespace"},
-			flags:          common.CommandLinkGenerateFlags{Cost: "1", TlsSecret: "secret", Timeout: time.Minute},
+			flags:          common.CommandLinkGenerateFlags{Cost: "1", TlsCredentials: "secret", Timeout: time.Minute},
 		},
 		{
 			name: "arguments were specified and they are not needed",
@@ -81,7 +81,7 @@ func TestCmdLinkGenerate_ValidateInput(t *testing.T) {
 					},
 				},
 			},
-			flags:          common.CommandLinkGenerateFlags{Cost: "1", TlsSecret: "secret", Timeout: time.Minute},
+			flags:          common.CommandLinkGenerateFlags{Cost: "1", TlsCredentials: "secret", Timeout: time.Minute},
 			expectedErrors: []string{"arguments are not allowed in this command"},
 		},
 		{
@@ -185,7 +185,7 @@ func TestCmdLinkGenerate_ValidateInput(t *testing.T) {
 					},
 				},
 			},
-			flags:          common.CommandLinkGenerateFlags{Cost: "one", TlsSecret: "secret", Timeout: time.Minute},
+			flags:          common.CommandLinkGenerateFlags{Cost: "one", TlsCredentials: "secret", Timeout: time.Minute},
 			expectedErrors: []string{"link cost is not valid: strconv.Atoi: parsing \"one\": invalid syntax"},
 		},
 		{
@@ -237,7 +237,7 @@ func TestCmdLinkGenerate_ValidateInput(t *testing.T) {
 					},
 				},
 			},
-			flags: common.CommandLinkGenerateFlags{Cost: "-4", TlsSecret: "secret", Timeout: time.Minute},
+			flags: common.CommandLinkGenerateFlags{Cost: "-4", TlsCredentials: "secret", Timeout: time.Minute},
 			expectedErrors: []string{
 				"link cost is not valid: value is not positive",
 			},
@@ -291,7 +291,7 @@ func TestCmdLinkGenerate_ValidateInput(t *testing.T) {
 					},
 				},
 			},
-			flags: common.CommandLinkGenerateFlags{Cost: "1", TlsSecret: "secret", Output: "not-valid", Timeout: time.Minute},
+			flags: common.CommandLinkGenerateFlags{Cost: "1", TlsCredentials: "secret", Output: "not-valid", Timeout: time.Minute},
 			expectedErrors: []string{
 				"output type is not valid: value not-valid not allowed. It should be one of this options: [json yaml]",
 			},
@@ -345,7 +345,7 @@ func TestCmdLinkGenerate_ValidateInput(t *testing.T) {
 					},
 				},
 			},
-			flags: common.CommandLinkGenerateFlags{Cost: "1", TlsSecret: "tls secret", Timeout: time.Minute},
+			flags: common.CommandLinkGenerateFlags{Cost: "1", TlsCredentials: "tls secret", Timeout: time.Minute},
 			expectedErrors: []string{
 				"the name of the tls secret is not valid: value does not match this regular expression: ^[a-z0-9]([-a-z0-9]*[a-z0-9])*(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])*)*$",
 			},
@@ -399,7 +399,7 @@ func TestCmdLinkGenerate_ValidateInput(t *testing.T) {
 					},
 				},
 			},
-			flags: common.CommandLinkGenerateFlags{Cost: "1", TlsSecret: "secret", Timeout: time.Second * 0},
+			flags: common.CommandLinkGenerateFlags{Cost: "1", TlsCredentials: "secret", Timeout: time.Second * 0},
 			expectedErrors: []string{
 				"timeout is not valid: duration must not be less than 10s; got 0s",
 			},
@@ -431,7 +431,7 @@ func TestCmdLinkGenerate_InputToOptions(t *testing.T) {
 		flags                       common.CommandLinkGenerateFlags
 		activeSite                  *v2alpha1.Site
 		expectedLinkname            string
-		expectedTlsSecret           string
+		expectedTlsCredentials      string
 		expectedCost                int
 		expectedOutput              string
 		expectedGenerateCredentials bool
@@ -442,7 +442,7 @@ func TestCmdLinkGenerate_InputToOptions(t *testing.T) {
 			name:                        "check options",
 			flags:                       common.CommandLinkGenerateFlags{"secret", "1", "json", false, time.Minute},
 			expectedCost:                1,
-			expectedTlsSecret:           "secret",
+			expectedTlsCredentials:      "secret",
 			expectedOutput:              "json",
 			expectedGenerateCredentials: false,
 		},
@@ -472,7 +472,7 @@ func TestCmdLinkGenerate_InputToOptions(t *testing.T) {
 			},
 			expectedLinkname:            "link-the-site",
 			expectedCost:                1,
-			expectedTlsSecret:           "link-the-site",
+			expectedTlsCredentials:      "link-the-site",
 			expectedOutput:              "json",
 			expectedGenerateCredentials: true,
 		},
@@ -491,7 +491,7 @@ func TestCmdLinkGenerate_InputToOptions(t *testing.T) {
 
 			assert.Check(t, cmd.linkName == test.expectedLinkname)
 			assert.Check(t, cmd.output == test.expectedOutput)
-			assert.Check(t, cmd.tlsSecret == test.expectedTlsSecret)
+			assert.Check(t, cmd.tlsCredentials == test.expectedTlsCredentials)
 			assert.Check(t, cmd.cost == test.expectedCost)
 			assert.Check(t, cmd.generateCredential == test.expectedGenerateCredentials)
 		})
@@ -512,7 +512,7 @@ func TestCmdLinkGenerate_Run(t *testing.T) {
 			setUpMock: func(command *CmdLinkGenerate) {
 				command.linkName = "my-link"
 				command.cost = 1
-				command.tlsSecret = "secret"
+				command.tlsCredentials = "secret"
 				command.output = "yaml"
 				command.generateCredential = true
 				command.activeSite = &v2alpha1.Site{
@@ -557,7 +557,7 @@ func TestCmdLinkGenerate_Run(t *testing.T) {
 			setUpMock: func(command *CmdLinkGenerate) {
 				command.linkName = "my-link"
 				command.cost = 1
-				command.tlsSecret = "secret"
+				command.tlsCredentials = "secret"
 				command.output = "yaml"
 				command.generateCredential = false
 				command.activeSite = &v2alpha1.Site{
@@ -602,7 +602,7 @@ func TestCmdLinkGenerate_Run(t *testing.T) {
 			setUpMock: func(command *CmdLinkGenerate) {
 				command.linkName = "my-link"
 				command.cost = 1
-				command.tlsSecret = "secret"
+				command.tlsCredentials = "secret"
 				command.output = ""
 				command.generateCredential = true
 				command.activeSite = &v2alpha1.Site{
@@ -648,7 +648,7 @@ func TestCmdLinkGenerate_Run(t *testing.T) {
 			setUpMock: func(command *CmdLinkGenerate) {
 				command.linkName = "my-link"
 				command.cost = 1
-				command.tlsSecret = "secret"
+				command.tlsCredentials = "secret"
 				command.output = "unsupported"
 				command.generateCredential = true
 				command.activeSite = &v2alpha1.Site{
@@ -694,7 +694,7 @@ func TestCmdLinkGenerate_Run(t *testing.T) {
 			setUpMock: func(command *CmdLinkGenerate) {
 				command.linkName = "my-link"
 				command.cost = 1
-				command.tlsSecret = "secret"
+				command.tlsCredentials = "secret"
 				command.output = "yaml"
 				command.generateCredential = false
 				command.activeSite = &v2alpha1.Site{
@@ -726,7 +726,7 @@ func TestCmdLinkGenerate_Run(t *testing.T) {
 			setUpMock: func(command *CmdLinkGenerate) {
 				command.linkName = "my-link"
 				command.cost = 1
-				command.tlsSecret = "secret"
+				command.tlsCredentials = "secret"
 				command.output = "yaml"
 				command.generateCredential = false
 				command.activeSite = nil
@@ -738,7 +738,7 @@ func TestCmdLinkGenerate_Run(t *testing.T) {
 			setUpMock: func(command *CmdLinkGenerate) {
 				command.linkName = "my-link"
 				command.cost = 1
-				command.tlsSecret = "secret"
+				command.tlsCredentials = "secret"
 				command.output = "yaml"
 				command.generateCredential = true
 				command.activeSite = &v2alpha1.Site{
@@ -806,7 +806,7 @@ func TestCmdLinkGenerate_WaitUntil(t *testing.T) {
 		generateCredential bool
 		generatedLink      v2alpha1.Link
 		outputType         string
-		tlsSecret          string
+		tlsCredentials     string
 		timeout            time.Duration
 		k8sObjects         []runtime.Object
 		skupperObjects     []runtime.Object
@@ -819,7 +819,7 @@ func TestCmdLinkGenerate_WaitUntil(t *testing.T) {
 			name:               "secret is not returned",
 			outputType:         "yaml",
 			timeout:            time.Second,
-			tlsSecret:          "linkSecret",
+			tlsCredentials:     "linkSecret",
 			generateCredential: true,
 			expectError:        true,
 		},
@@ -842,7 +842,7 @@ func TestCmdLinkGenerate_WaitUntil(t *testing.T) {
 			generateCredential: true,
 			outputType:         "yaml",
 			timeout:            time.Second,
-			tlsSecret:          "link-test",
+			tlsCredentials:     "link-test",
 			k8sObjects: []runtime.Object{
 				&corev1.Secret{
 					TypeMeta: metav1.TypeMeta{
@@ -876,7 +876,7 @@ func TestCmdLinkGenerate_WaitUntil(t *testing.T) {
 			generateCredential: true,
 			outputType:         "yaml",
 			timeout:            time.Second,
-			tlsSecret:          "link-test",
+			tlsCredentials:     "link-test",
 			k8sObjects: []runtime.Object{
 				&corev1.Secret{
 					TypeMeta: metav1.TypeMeta{
@@ -907,7 +907,7 @@ func TestCmdLinkGenerate_WaitUntil(t *testing.T) {
 
 			command.output = test.outputType
 			command.generateCredential = test.generateCredential
-			command.tlsSecret = test.tlsSecret
+			command.tlsCredentials = test.tlsCredentials
 			command.timeout = test.timeout
 
 			err := command.WaitUntil()
diff --git a/internal/cmd/skupper/link/kube/link_update_test.go b/internal/cmd/skupper/link/kube/link_update_test.go
index c64942a8..c5f83361 100644
--- a/internal/cmd/skupper/link/kube/link_update_test.go
+++ b/internal/cmd/skupper/link/kube/link_update_test.go
@@ -207,7 +207,7 @@ func TestCmdLinkUpdate_ValidateInput(t *testing.T) {
 		{
 			name:  "tls secret not available",
 			args:  []string{"my-link"},
-			flags: common.CommandLinkUpdateFlags{Cost: "1", TlsSecret: "secret", Timeout: time.Minute},
+			flags: common.CommandLinkUpdateFlags{Cost: "1", TlsCredentials: "secret", Timeout: time.Minute},
 			skupperObjects: []runtime.Object{
 				&v2alpha1.SiteList{
 					Items: []v2alpha1.Site{
@@ -233,7 +233,7 @@ func TestCmdLinkUpdate_ValidateInput(t *testing.T) {
 		{
 			name:  "Timeout value is 0",
 			args:  []string{"my-link"},
-			flags: common.CommandLinkUpdateFlags{Cost: "1", TlsSecret: "secret", Timeout: time.Second * 0},
+			flags: common.CommandLinkUpdateFlags{Cost: "1", TlsCredentials: "secret", Timeout: time.Second * 0},
 			k8sObjects: []runtime.Object{
 				&v12.Secret{
 					ObjectMeta: v1.ObjectMeta{
@@ -287,24 +287,24 @@ func TestCmdLinkUpdate_ValidateInput(t *testing.T) {
 func TestCmdLinkUpdate_InputToOptions(t *testing.T) {
 
 	type test struct {
-		name              string
-		args              []string
-		flags             common.CommandLinkUpdateFlags
-		expectedTlsSecret string
-		expectedCost      int
-		expectedOutput    string
-		expectedTimeout   time.Duration
+		name                   string
+		args                   []string
+		flags                  common.CommandLinkUpdateFlags
+		expectedTlsCredentials string
+		expectedCost           int
+		expectedOutput         string
+		expectedTimeout        time.Duration
 	}
 
 	testTable := []test{
 		{
-			name:              "check options",
-			args:              []string{"my-link"},
-			flags:             common.CommandLinkUpdateFlags{"secret", "1", "json", time.Minute},
-			expectedCost:      1,
-			expectedTlsSecret: "secret",
-			expectedOutput:    "json",
-			expectedTimeout:   time.Minute,
+			name:                   "check options",
+			args:                   []string{"my-link"},
+			flags:                  common.CommandLinkUpdateFlags{"secret", "1", "json", time.Minute},
+			expectedCost:           1,
+			expectedTlsCredentials: "secret",
+			expectedOutput:         "json",
+			expectedTimeout:        time.Minute,
 		},
 	}
 
@@ -318,7 +318,7 @@ func TestCmdLinkUpdate_InputToOptions(t *testing.T) {
 			cmd.InputToOptions()
 
 			assert.Check(t, cmd.output == test.expectedOutput)
-			assert.Check(t, cmd.tlsSecret == test.expectedTlsSecret)
+			assert.Check(t, cmd.tlsCredentials == test.expectedTlsCredentials)
 			assert.Check(t, cmd.cost == test.expectedCost)
 			assert.Check(t, cmd.timeout == test.expectedTimeout)
 		})
@@ -333,17 +333,17 @@ func TestCmdLinkUpdate_Run(t *testing.T) {
 		linkName            string
 		Cost                int
 		output              string
-		tlsSecret           string
+		tlsCredentials      string
 		errorMessage        string
 		skupperErrorMessage string
 	}
 
 	testTable := []test{
 		{
-			name:      "runs ok",
-			linkName:  "my-link",
-			Cost:      1,
-			tlsSecret: "secret",
+			name:           "runs ok",
+			linkName:       "my-link",
+			Cost:           1,
+			tlsCredentials: "secret",
 			skupperObjects: []runtime.Object{
 				&v2alpha1.Link{
 					ObjectMeta: v1.ObjectMeta{
@@ -399,7 +399,7 @@ func TestCmdLinkUpdate_Run(t *testing.T) {
 
 		cmd.linkName = test.linkName
 		cmd.output = test.output
-		cmd.tlsSecret = test.tlsSecret
+		cmd.tlsCredentials = test.tlsCredentials
 		cmd.cost = test.Cost
 
 		t.Run(test.name, func(t *testing.T) {
diff --git a/internal/cmd/skupper/link/link_test.go b/internal/cmd/skupper/link/link_test.go
index 9ddc563c..6d0f21e0 100644
--- a/internal/cmd/skupper/link/link_test.go
+++ b/internal/cmd/skupper/link/link_test.go
@@ -22,7 +22,7 @@ func TestCmdLinkFactory(t *testing.T) {
 		{
 			name: "CmdLinkGenerateFactory",
 			expectedFlagsWithDefaultValue: map[string]interface{}{
-				common.FlagNameTlsSecret:          "",
+				common.FlagNameTlsCredentials:     "",
 				common.FlagNameCost:               "1",
 				common.FlagNameOutput:             "yaml",
 				common.FlagNameGenerateCredential: "true",
@@ -33,10 +33,10 @@ func TestCmdLinkFactory(t *testing.T) {
 		{
 			name: "CmdLinkUpdateFactory",
 			expectedFlagsWithDefaultValue: map[string]interface{}{
-				common.FlagNameTlsSecret: "",
-				common.FlagNameCost:      "1",
-				common.FlagNameOutput:    "",
-				common.FlagNameTimeout:   "1m0s",
+				common.FlagNameTlsCredentials: "",
+				common.FlagNameCost:           "1",
+				common.FlagNameOutput:         "",
+				common.FlagNameTimeout:        "1m0s",
 			},
 			command: CmdLinkUpdateFactory(types.PlatformKubernetes),
 		},
diff --git a/internal/cmd/skupper/listener/kube/listener_create_test.go b/internal/cmd/skupper/listener/kube/listener_create_test.go
index fd0105f0..ed58e98c 100644
--- a/internal/cmd/skupper/listener/kube/listener_create_test.go
+++ b/internal/cmd/skupper/listener/kube/listener_create_test.go
@@ -133,8 +133,8 @@ func TestCmdListenerCreate_ValidateInput(t *testing.T) {
 			name: "tls-secret does not exist",
 			args: []string{"my-listener-tls", "8080"},
 			flags: common.CommandListenerCreateFlags{
-				Timeout:   1 * time.Minute,
-				TlsSecret: "not-valid",
+				Timeout:        1 * time.Minute,
+				TlsCredentials: "not-valid",
 			},
 			expectedErrors: []string{"tls-secret is not valid: does not exist"},
 		},
@@ -158,12 +158,12 @@ func TestCmdListenerCreate_ValidateInput(t *testing.T) {
 			name: "flags all valid",
 			args: []string{"my-listener-flags", "8080"},
 			flags: common.CommandListenerCreateFlags{
-				Host:         "hostname",
-				RoutingKey:   "routingkeyname",
-				TlsSecret:    "secretname",
-				ListenerType: "tcp",
-				Timeout:      1 * time.Minute,
-				Output:       "json",
+				Host:           "hostname",
+				RoutingKey:     "routingkeyname",
+				TlsCredentials: "secretname",
+				ListenerType:   "tcp",
+				Timeout:        1 * time.Minute,
+				Output:         "json",
 			},
 			skupperObjects: []runtime.Object{
 				&v2alpha1.Listener{
@@ -216,37 +216,37 @@ func TestCmdListenerCreate_ValidateInput(t *testing.T) {
 func TestCmdListenerCreate_InputToOptions(t *testing.T) {
 
 	type test struct {
-		name                 string
-		flags                common.CommandListenerCreateFlags
-		Listenername         string
-		expectedTlsSecret    string
-		expectedHost         string
-		expectedRoutingKey   string
-		expectedListenerType string
-		expectedOutput       string
-		expectedTimeout      time.Duration
+		name                   string
+		flags                  common.CommandListenerCreateFlags
+		Listenername           string
+		expectedTlsCredentials string
+		expectedHost           string
+		expectedRoutingKey     string
+		expectedListenerType   string
+		expectedOutput         string
+		expectedTimeout        time.Duration
 	}
 
 	testTable := []test{
 		{
-			name:                 "test1",
-			flags:                common.CommandListenerCreateFlags{"backend", "backend", "secret", "tcp", 20 * time.Second, "json"},
-			expectedTlsSecret:    "secret",
-			expectedHost:         "backend",
-			expectedRoutingKey:   "backend",
-			expectedTimeout:      20 * time.Second,
-			expectedListenerType: "tcp",
-			expectedOutput:       "json",
+			name:                   "test1",
+			flags:                  common.CommandListenerCreateFlags{"backend", "backend", "secret", "tcp", 20 * time.Second, "json"},
+			expectedTlsCredentials: "secret",
+			expectedHost:           "backend",
+			expectedRoutingKey:     "backend",
+			expectedTimeout:        20 * time.Second,
+			expectedListenerType:   "tcp",
+			expectedOutput:         "json",
 		},
 		{
-			name:                 "test2",
-			flags:                common.CommandListenerCreateFlags{"", "", "secret", "tcp", 30 * time.Second, "yaml"},
-			expectedTlsSecret:    "secret",
-			expectedHost:         "test2",
-			expectedRoutingKey:   "test2",
-			expectedTimeout:      30 * time.Second,
-			expectedListenerType: "tcp",
-			expectedOutput:       "yaml",
+			name:                   "test2",
+			flags:                  common.CommandListenerCreateFlags{"", "", "secret", "tcp", 30 * time.Second, "yaml"},
+			expectedTlsCredentials: "secret",
+			expectedHost:           "test2",
+			expectedRoutingKey:     "test2",
+			expectedTimeout:        30 * time.Second,
+			expectedListenerType:   "tcp",
+			expectedOutput:         "yaml",
 		},
 	}
 
@@ -263,7 +263,7 @@ func TestCmdListenerCreate_InputToOptions(t *testing.T) {
 
 			assert.Check(t, cmd.routingKey == test.expectedRoutingKey)
 			assert.Check(t, cmd.output == test.expectedOutput)
-			assert.Check(t, cmd.tlsSecret == test.expectedTlsSecret)
+			assert.Check(t, cmd.tlsCredentials == test.expectedTlsCredentials)
 			assert.Check(t, cmd.host == test.expectedHost)
 			assert.Check(t, cmd.timeout == test.expectedTimeout)
 			assert.Check(t, cmd.output == test.expectedOutput)
@@ -290,10 +290,10 @@ func TestCmdListenerCreate_Run(t *testing.T) {
 			listenerName: "run-listener",
 			listenerPort: 8080,
 			flags: common.CommandListenerCreateFlags{
-				ListenerType: "tcp",
-				Host:         "hostname",
-				RoutingKey:   "keyname",
-				TlsSecret:    "secretname",
+				ListenerType:   "tcp",
+				Host:           "hostname",
+				RoutingKey:     "keyname",
+				TlsCredentials: "secretname",
 			},
 		},
 		{
@@ -301,11 +301,11 @@ func TestCmdListenerCreate_Run(t *testing.T) {
 			listenerName: "run-listener",
 			listenerPort: 8080,
 			flags: common.CommandListenerCreateFlags{
-				ListenerType: "tcp",
-				Host:         "hostname",
-				RoutingKey:   "keyname",
-				TlsSecret:    "secretname",
-				Output:       "yaml",
+				ListenerType:   "tcp",
+				Host:           "hostname",
+				RoutingKey:     "keyname",
+				TlsCredentials: "secretname",
+				Output:         "yaml",
 			},
 		},
 	}
diff --git a/internal/cmd/skupper/listener/kube/listener_update_test.go b/internal/cmd/skupper/listener/kube/listener_update_test.go
index fe3c6cd0..5194ac1e 100644
--- a/internal/cmd/skupper/listener/kube/listener_update_test.go
+++ b/internal/cmd/skupper/listener/kube/listener_update_test.go
@@ -115,8 +115,8 @@ func TestCmdListenerUpdate_ValidateInput(t *testing.T) {
 			name: "tls-secret is not valid",
 			args: []string{"my-listener-tls"},
 			flags: common.CommandListenerUpdateFlags{
-				TlsSecret: ":not-valid",
-				Timeout:   50 * time.Minute,
+				TlsCredentials: ":not-valid",
+				Timeout:        50 * time.Minute,
 			},
 			skupperObjects: []runtime.Object{
 				&v2alpha1.Listener{
@@ -221,13 +221,13 @@ func TestCmdListenerUpdate_ValidateInput(t *testing.T) {
 			name: "flags all valid",
 			args: []string{"my-listener-flags"},
 			flags: common.CommandListenerUpdateFlags{
-				Host:         "hostname",
-				RoutingKey:   "routingkeyname",
-				TlsSecret:    "secretname",
-				Port:         1234,
-				ListenerType: "tcp",
-				Timeout:      10 * time.Second,
-				Output:       "json",
+				Host:           "hostname",
+				RoutingKey:     "routingkeyname",
+				TlsCredentials: "secretname",
+				Port:           1234,
+				ListenerType:   "tcp",
+				Timeout:        10 * time.Second,
+				Output:         "json",
 			},
 			skupperObjects: []runtime.Object{
 				&v2alpha1.Listener{
@@ -294,12 +294,12 @@ func TestCmdListenerUpdate_Run(t *testing.T) {
 			name:         "runs ok",
 			listenerName: "run-listener",
 			flags: common.CommandListenerUpdateFlags{
-				ListenerType: "tcp",
-				Host:         "hostname",
-				RoutingKey:   "keyname",
-				TlsSecret:    "secretname",
-				Output:       "yaml",
-				Timeout:      1 * time.Minute,
+				ListenerType:   "tcp",
+				Host:           "hostname",
+				RoutingKey:     "keyname",
+				TlsCredentials: "secretname",
+				Output:         "yaml",
+				Timeout:        1 * time.Minute,
 			},
 			skupperObjects: []runtime.Object{
 				&v2alpha1.Listener{
diff --git a/internal/cmd/skupper/listener/listener_test.go b/internal/cmd/skupper/listener/listener_test.go
index 1160b2ed..eb7e3417 100644
--- a/internal/cmd/skupper/listener/listener_test.go
+++ b/internal/cmd/skupper/listener/listener_test.go
@@ -22,25 +22,25 @@ func TestCmdLinkFactory(t *testing.T) {
 		{
 			name: "CmdListenerCreateFactory",
 			expectedFlagsWithDefaultValue: map[string]interface{}{
-				common.FlagNameRoutingKey:   "",
-				common.FlagNameListenerHost: "",
-				common.FlagNameTlsSecret:    "",
-				common.FlagNameListenerType: "tcp",
-				common.FlagNameOutput:       "",
-				common.FlagNameTimeout:      "1m0s",
+				common.FlagNameRoutingKey:     "",
+				common.FlagNameListenerHost:   "",
+				common.FlagNameTlsCredentials: "",
+				common.FlagNameListenerType:   "tcp",
+				common.FlagNameOutput:         "",
+				common.FlagNameTimeout:        "1m0s",
 			},
 			command: CmdListenerCreateFactory(types.PlatformKubernetes),
 		},
 		{
 			name: "CmdListenerUpdateFactory",
 			expectedFlagsWithDefaultValue: map[string]interface{}{
-				common.FlagNameRoutingKey:   "",
-				common.FlagNameListenerHost: "",
-				common.FlagNameTlsSecret:    "",
-				common.FlagNameListenerType: "tcp",
-				common.FlagNameOutput:       "",
-				common.FlagNameTimeout:      "1m0s",
-				common.FlagNameListenerPort: "0",
+				common.FlagNameRoutingKey:     "",
+				common.FlagNameListenerHost:   "",
+				common.FlagNameTlsCredentials: "",
+				common.FlagNameListenerType:   "tcp",
+				common.FlagNameOutput:         "",
+				common.FlagNameTimeout:        "1m0s",
+				common.FlagNameListenerPort:   "0",
 			},
 			command: CmdListenerUpdateFactory(types.PlatformKubernetes),
 		},
diff --git a/pkg/kube/site/bindings_test.go b/pkg/kube/site/bindings_test.go
new file mode 100644
index 00000000..b54d0267
--- /dev/null
+++ b/pkg/kube/site/bindings_test.go
@@ -0,0 +1,398 @@
+package site
+
+import (
+	"testing"
+
+	skupperv2alpha1 "github.com/skupperproject/skupper/pkg/apis/skupper/v2alpha1"
+	"github.com/skupperproject/skupper/pkg/qdr"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+	"gotest.tools/assert"
+)
+
+type MockBindingContext struct {
+	selectors map[string]TargetSelection
+}
+
+func NewMockBindingContext(selectors map[string]TargetSelection) *MockBindingContext {
+	return &MockBindingContext{
+		selectors: selectors,
+	}
+}
+
+func (m *MockBindingContext) Select(connector *skupperv2alpha1.Connector) TargetSelection {
+	if selector, ok := m.selectors[connector.Name]; ok {
+		return selector
+	}
+	return nil
+}
+
+func (m *MockBindingContext) Expose(ports *ExposedPortSet) {
+}
+
+func (m *MockBindingContext) Unexpose(host string) {
+}
+
+type MockTargetSelection struct {
+	selector   string
+	podDetails []skupperv2alpha1.PodDetails
+}
+
+func NewMockTargetSelection(selector string, podDetails []skupperv2alpha1.PodDetails) *MockTargetSelection {
+	return &MockTargetSelection{
+		selector:   selector,
+		podDetails: podDetails,
+	}
+}
+
+func (m *MockTargetSelection) Selector() string {
+	return m.selector
+}
+
+func (m *MockTargetSelection) Close() {
+}
+
+func (m *MockTargetSelection) List() []skupperv2alpha1.PodDetails {
+	return m.podDetails
+}
+
+func TestBindingAdaptor_ConnectorUpdated(t *testing.T) {
+	type fields struct {
+		context   BindingContext
+		mapping   *qdr.PortMapping
+		exposed   ExposedPorts
+		selectors map[string]TargetSelection
+	}
+	type args struct {
+		connector *skupperv2alpha1.Connector
+	}
+	tests := []struct {
+		name   string
+		fields fields
+		args   args
+		want   bool
+	}{
+		{
+			name: "connector selector not populated, no matching pods",
+			args: args{
+				connector: &skupperv2alpha1.Connector{
+					ObjectMeta: v1.ObjectMeta{
+						Name:      "backend",
+						Namespace: "test",
+						UID:       "8a96ffdf-403b-4e4a-83a8-97d3d459adb6",
+					},
+				},
+			},
+			want: true,
+		},
+		{
+			name: "connector selector populated, no matching pods",
+			fields: fields{
+				context:   NewMockBindingContext(nil),
+				selectors: map[string]TargetSelection{},
+			},
+			args: args{
+				connector: &skupperv2alpha1.Connector{
+					ObjectMeta: v1.ObjectMeta{
+						Name:      "backend",
+						Namespace: "test",
+						UID:       "8a96ffdf-403b-4e4a-83a8-97d3d459adb6",
+					},
+					Spec: skupperv2alpha1.ConnectorSpec{
+						Selector: "app=backend",
+					},
+				},
+			},
+			want: false,
+		},
+		{
+			name: "connector selector populated, pods match selector",
+			fields: fields{
+				context: NewMockBindingContext(map[string]TargetSelection{
+					"backend": &TargetSelectionImpl{
+						selector: "app=backend",
+					},
+				}),
+				selectors: map[string]TargetSelection{
+					"backend": &TargetSelectionImpl{
+						selector: "app=backend",
+					},
+				},
+			},
+			args: args{
+				connector: &skupperv2alpha1.Connector{
+					ObjectMeta: v1.ObjectMeta{
+						Name:      "backend",
+						Namespace: "test",
+						UID:       "8a96ffdf-403b-4e4a-83a8-97d3d459adb6",
+					},
+					Spec: skupperv2alpha1.ConnectorSpec{
+						Selector: "app=backend",
+					},
+				},
+			},
+			want: true,
+		},
+		{
+			name: "connector selector changed to empty",
+			fields: fields{
+				context: NewMockBindingContext(map[string]TargetSelection{
+					"backend": &TargetSelectionImpl{
+						selector: "app=backend",
+					},
+				}),
+				selectors: map[string]TargetSelection{
+					"backend": NewMockTargetSelection("app=backend", []skupperv2alpha1.PodDetails{}),
+				},
+			},
+			args: args{
+				connector: &skupperv2alpha1.Connector{
+					ObjectMeta: v1.ObjectMeta{
+						Name:      "backend",
+						Namespace: "test",
+						UID:       "8a96ffdf-403b-4e4a-83a8-97d3d459adb6",
+					},
+					Spec: skupperv2alpha1.ConnectorSpec{},
+				},
+			},
+			want: true,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			a := &BindingAdaptor{
+				context:   tt.fields.context,
+				mapping:   tt.fields.mapping,
+				exposed:   tt.fields.exposed,
+				selectors: tt.fields.selectors,
+			}
+			if got := a.ConnectorUpdated(tt.args.connector); got != tt.want {
+				t.Errorf("BindingAdaptor.ConnectorUpdated() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestBindingAdaptor_ConnectorDeleted(t *testing.T) {
+	type fields struct {
+		context   BindingContext
+		mapping   *qdr.PortMapping
+		exposed   ExposedPorts
+		selectors map[string]TargetSelection
+	}
+	type args struct {
+		connector *skupperv2alpha1.Connector
+	}
+	type expected struct {
+		selectors map[string]TargetSelection
+	}
+	tests := []struct {
+		name     string
+		fields   fields
+		args     args
+		expected expected
+	}{
+		{
+			name: "connector deleted",
+			fields: fields{
+				context: NewMockBindingContext(map[string]TargetSelection{}),
+				selectors: map[string]TargetSelection{
+					"backend": NewMockTargetSelection("app=backend", []skupperv2alpha1.PodDetails{}),
+				},
+			},
+			args: args{
+				connector: &skupperv2alpha1.Connector{
+					ObjectMeta: v1.ObjectMeta{
+						Name:      "backend",
+						Namespace: "test",
+						UID:       "8a96ffdf-403b-4e4a-83a8-97d3d459adb6",
+					},
+				},
+			},
+			expected: expected{
+				// expected behavior: ConnectorDeleted deletes
+				// "backend" from selectors map
+				selectors: map[string]TargetSelection{},
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			a := &BindingAdaptor{
+				context:   tt.fields.context,
+				mapping:   tt.fields.mapping,
+				exposed:   tt.fields.exposed,
+				selectors: tt.fields.selectors,
+			}
+			a.ConnectorDeleted(tt.args.connector)
+
+			assert.DeepEqual(t, a.selectors, tt.expected.selectors)
+		})
+	}
+}
+
+func TestBindingAdaptor_updateBridgeConfigForConnector(t *testing.T) {
+	type fields struct {
+		context   BindingContext
+		mapping   *qdr.PortMapping
+		exposed   ExposedPorts
+		selectors map[string]TargetSelection
+	}
+	type args struct {
+		siteId    string
+		connector *skupperv2alpha1.Connector
+		config    qdr.BridgeConfig
+	}
+	type expected struct {
+		config qdr.BridgeConfig
+	}
+	tests := []struct {
+		name     string
+		fields   fields
+		args     args
+		expected expected
+	}{
+		{
+			name: "connector spec host populated",
+			fields: fields{
+				context:   NewMockBindingContext(map[string]TargetSelection{}),
+				selectors: map[string]TargetSelection{},
+			},
+			args: args{
+				siteId: "00000000-0000-0000-0000-000000000001",
+				connector: &skupperv2alpha1.Connector{
+					ObjectMeta: v1.ObjectMeta{
+						Name:      "backend",
+						Namespace: "test",
+						UID:       "8a96ffdf-403b-4e4a-83a8-97d3d459adb6",
+					},
+					Spec: skupperv2alpha1.ConnectorSpec{
+						Host: "192.168.1.1",
+						Port: 8080,
+					},
+				},
+				config: qdr.NewBridgeConfig(),
+			},
+			expected: expected{
+				config: qdr.BridgeConfig{
+					TcpListeners: map[string]qdr.TcpEndpoint{},
+					TcpConnectors: map[string]qdr.TcpEndpoint{
+						"backend-192.168.1.1": qdr.TcpEndpoint{
+							Name:   "backend-192.168.1.1",
+							Host:   "192.168.1.1",
+							Port:   "8080",
+							SiteId: "00000000-0000-0000-0000-000000000001",
+						},
+					},
+				},
+			},
+		},
+		{
+			name: "connector spec selector populated, tracking pods",
+			fields: fields{
+				context: NewMockBindingContext(map[string]TargetSelection{}),
+				selectors: map[string]TargetSelection{
+					"backend": NewMockTargetSelection("app=backend",
+						[]skupperv2alpha1.PodDetails{
+							{UID: "30af5279-be83-41e4-86fe-cc45396786f4",
+								Name: "backend-8485574c8b-254ms",
+								IP:   "10.244.0.9"},
+						}),
+				},
+			},
+			args: args{
+				siteId: "00000000-0000-0000-0000-000000000001",
+				connector: &skupperv2alpha1.Connector{
+					ObjectMeta: v1.ObjectMeta{
+						Name:      "backend",
+						Namespace: "test",
+						UID:       "8a96ffdf-403b-4e4a-83a8-97d3d459adb6",
+					},
+					Spec: skupperv2alpha1.ConnectorSpec{
+						Selector: "app=backend",
+					},
+				},
+				config: qdr.NewBridgeConfig(),
+			},
+			expected: expected{
+				config: qdr.BridgeConfig{
+					TcpListeners: map[string]qdr.TcpEndpoint{},
+					TcpConnectors: map[string]qdr.TcpEndpoint{
+						"backend-10.244.0.9": qdr.TcpEndpoint{
+							Name:      "backend-10.244.0.9",
+							Host:      "10.244.0.9",
+							Port:      "0",
+							SiteId:    "00000000-0000-0000-0000-000000000001",
+							ProcessID: "30af5279-be83-41e4-86fe-cc45396786f4",
+						},
+					},
+				},
+			},
+		},
+		{
+			name: "connector spec selector populated, not tracking pods yet",
+			fields: fields{
+				context:   NewMockBindingContext(map[string]TargetSelection{}),
+				selectors: map[string]TargetSelection{},
+			},
+			args: args{
+				siteId: "00000000-0000-0000-0000-000000000001",
+				connector: &skupperv2alpha1.Connector{
+					ObjectMeta: v1.ObjectMeta{
+						Name:      "backend",
+						Namespace: "test",
+						UID:       "8a96ffdf-403b-4e4a-83a8-97d3d459adb6",
+					},
+					Spec: skupperv2alpha1.ConnectorSpec{
+						Selector: "app=backend",
+					},
+				},
+				config: qdr.NewBridgeConfig(),
+			},
+			expected: expected{
+				config: qdr.BridgeConfig{
+					TcpListeners:  map[string]qdr.TcpEndpoint{},
+					TcpConnectors: map[string]qdr.TcpEndpoint{},
+				},
+			},
+		},
+		{
+			name: "Error: connector has neither host nor selector set",
+			fields: fields{
+				context:   NewMockBindingContext(map[string]TargetSelection{}),
+				selectors: map[string]TargetSelection{},
+			},
+			args: args{
+				siteId: "00000000-0000-0000-0000-000000000001",
+				connector: &skupperv2alpha1.Connector{
+					ObjectMeta: v1.ObjectMeta{
+						Name:      "backend",
+						Namespace: "test",
+						UID:       "8a96ffdf-403b-4e4a-83a8-97d3d459adb6",
+					},
+					Spec: skupperv2alpha1.ConnectorSpec{},
+				},
+				config: qdr.NewBridgeConfig(),
+			},
+			expected: expected{
+				config: qdr.BridgeConfig{
+					TcpListeners:  map[string]qdr.TcpEndpoint{},
+					TcpConnectors: map[string]qdr.TcpEndpoint{},
+				},
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			a := &BindingAdaptor{
+				context:   tt.fields.context,
+				mapping:   tt.fields.mapping,
+				exposed:   tt.fields.exposed,
+				selectors: tt.fields.selectors,
+			}
+			a.updateBridgeConfigForConnector(tt.args.siteId, tt.args.connector, &tt.args.config)
+
+			assert.DeepEqual(t, tt.args.config, tt.expected.config)
+		})
+	}
+}
diff --git a/pkg/nonkube/common/fs_config_renderer_test.go b/pkg/nonkube/common/fs_config_renderer_test.go
index 519d3ae4..e34d6c77 100644
--- a/pkg/nonkube/common/fs_config_renderer_test.go
+++ b/pkg/nonkube/common/fs_config_renderer_test.go
@@ -51,28 +51,28 @@ func testFileSystemConfigurationRendererRender(t *testing.T, addInputCertificate
 	}
 	expectedFiles := []string{
 		string(api.RouterConfigPath) + "/skrouterd.json",
-		string(api.CertificatesCaPath) + "/skupper-site-ca/tls.crt",
-		string(api.CertificatesCaPath) + "/skupper-site-ca/tls.key",
-		string(api.CertificatesCaPath) + "/skupper-service-ca/tls.crt",
-		string(api.CertificatesCaPath) + "/skupper-service-ca/tls.key",
-		string(api.CertificatesClientPath) + "/client-link-access-one/tls.crt",
-		string(api.CertificatesClientPath) + "/client-link-access-one/tls.key",
-		string(api.CertificatesClientPath) + "/client-link-access-one/ca.crt",
-		string(api.CertificatesServerPath) + "/link-access-one/tls.crt",
-		string(api.CertificatesServerPath) + "/link-access-one/tls.key",
-		string(api.CertificatesServerPath) + "/link-access-one/ca.crt",
-		string(api.CertificatesServerPath) + "/listener-one-credentials/tls.crt",
-		string(api.CertificatesServerPath) + "/listener-one-credentials/tls.key",
-		string(api.CertificatesServerPath) + "/listener-one-credentials/ca.crt",
-		string(api.CertificatesServerPath) + "/listener-two-credentials/tls.crt",
-		string(api.CertificatesServerPath) + "/listener-two-credentials/tls.key",
-		string(api.CertificatesServerPath) + "/listener-two-credentials/ca.crt",
-		string(api.CertificatesServerPath) + "/connector-one-credentials/tls.key",
-		string(api.CertificatesServerPath) + "/connector-one-credentials/ca.crt",
-		string(api.CertificatesServerPath) + "/connector-one-credentials/tls.crt",
-		string(api.CertificatesLinkPath) + "/link-one-profile/ca.crt",
-		string(api.CertificatesLinkPath) + "/link-one-profile/tls.crt",
-		string(api.CertificatesLinkPath) + "/link-one-profile/tls.key",
+		string(api.IssuersPath) + "/skupper-site-ca/tls.crt",
+		string(api.IssuersPath) + "/skupper-site-ca/tls.key",
+		string(api.IssuersPath) + "/skupper-service-ca/tls.crt",
+		string(api.IssuersPath) + "/skupper-service-ca/tls.key",
+		string(api.CertificatesPath) + "/client-link-access-one/tls.crt",
+		string(api.CertificatesPath) + "/client-link-access-one/tls.key",
+		string(api.CertificatesPath) + "/client-link-access-one/ca.crt",
+		string(api.CertificatesPath) + "/link-access-one/tls.crt",
+		string(api.CertificatesPath) + "/link-access-one/tls.key",
+		string(api.CertificatesPath) + "/link-access-one/ca.crt",
+		string(api.CertificatesPath) + "/listener-one-credentials/tls.crt",
+		string(api.CertificatesPath) + "/listener-one-credentials/tls.key",
+		string(api.CertificatesPath) + "/listener-one-credentials/ca.crt",
+		string(api.CertificatesPath) + "/listener-two-credentials/tls.crt",
+		string(api.CertificatesPath) + "/listener-two-credentials/tls.key",
+		string(api.CertificatesPath) + "/listener-two-credentials/ca.crt",
+		string(api.CertificatesPath) + "/connector-one-credentials/tls.key",
+		string(api.CertificatesPath) + "/connector-one-credentials/ca.crt",
+		string(api.CertificatesPath) + "/connector-one-credentials/tls.crt",
+		string(api.CertificatesPath) + "/link-one-profile/ca.crt",
+		string(api.CertificatesPath) + "/link-one-profile/tls.crt",
+		string(api.CertificatesPath) + "/link-one-profile/tls.key",
 		string(api.RuntimePath) + "/platform.yaml",
 		string(api.RuntimeTokenPath) + "/link-link-access-one-127.0.0.1.yaml",
 	}
@@ -95,12 +95,12 @@ func testFileSystemConfigurationRendererRender(t *testing.T, addInputCertificate
 }
 
 func compareCertificates(t *testing.T, customOutputPath string) {
-	caPath := path.Join(customOutputPath, string(api.CertificatesCaPath), "skupper-site-ca")
-	serverPath := path.Join(customOutputPath, string(api.CertificatesServerPath), "link-access-one")
-	clientPath := path.Join(customOutputPath, string(api.CertificatesClientPath), "client-link-access-one")
-	inputCaPath := path.Join(customOutputPath, string(api.InputCertificatesCaPath), "skupper-site-ca")
-	inputServerPath := path.Join(customOutputPath, string(api.InputCertificatesServerPath), "link-access-one")
-	inputClientPath := path.Join(customOutputPath, string(api.InputCertificatesClientPath), "client-link-access-one")
+	caPath := path.Join(customOutputPath, string(api.IssuersPath), "skupper-site-ca")
+	serverPath := path.Join(customOutputPath, string(api.CertificatesPath), "link-access-one")
+	clientPath := path.Join(customOutputPath, string(api.CertificatesPath), "client-link-access-one")
+	inputCaPath := path.Join(customOutputPath, string(api.InputIssuersPath), "skupper-site-ca")
+	inputServerPath := path.Join(customOutputPath, string(api.InputCertificatesPath), "link-access-one")
+	inputClientPath := path.Join(customOutputPath, string(api.InputCertificatesPath), "client-link-access-one")
 	pathsToCompare := map[string]string{
 		caPath:     inputCaPath,
 		serverPath: inputServerPath,
@@ -128,9 +128,9 @@ func createInputCertificates(t *testing.T, customOutputPath string) {
 	client := certs.GenerateSecret("fake-client-cert", "fake-client-cert", "", &ca)
 
 	// paths for each provided certificate
-	caPath := path.Join(customOutputPath, "namespaces/default", string(api.InputCertificatesCaPath), "skupper-site-ca")
-	serverPath := path.Join(customOutputPath, "namespaces/default", string(api.InputCertificatesServerPath), "link-access-one")
-	clientPath := path.Join(customOutputPath, "namespaces/default", string(api.InputCertificatesClientPath), "client-link-access-one")
+	caPath := path.Join(customOutputPath, "namespaces/default", string(api.InputIssuersPath), "skupper-site-ca")
+	serverPath := path.Join(customOutputPath, "namespaces/default", string(api.InputCertificatesPath), "link-access-one")
+	clientPath := path.Join(customOutputPath, "namespaces/default", string(api.InputCertificatesPath), "client-link-access-one")
 	certsMap := map[string]corev1.Secret{
 		caPath:     ca,
 		serverPath: server,