Repository: kumahq/kuma
Pull request #9897 (2024-04-10 14:33:53)

fix(helm): revert add possibily to rely on secret for caBundle (#9342)
This reverts commit 7ad16bc1837b3c8abeb30805c4176f303a3b4198.

It broke the CI.

### Checklist prior to review

<!--
Each of these sections need to be filled by the author when opening the PR.

If something doesn't apply please check the box and add a justification after the `--`
-->

- [ ] [Link to relevant issue][1] as well as docs and UI issues --
- [ ] This will not break child repos: it doesn't hardcode values (.e.g "kumahq" as a image registry) and it will work on Windows, system specific functions like `syscall.Mkfifo` have equivalent implementation on the other OS --
- [ ] Tests (Unit test, E2E tests, manual test on universal and k8s) --
  - Don't forget `ci/` labels to run additional/fewer tests
- [ ] Do you need to update [`UPGRADE.md`](../blob/master/UPGRADE.md)? --
- [ ] Does it need to be backported according to the [backporting policy](../blob/master/CONTRIBUTING.md#backporting)? ([this](https://github.com/kumahq/kuma/actions/workflows/auto-backport.yaml) GH action will add "backport" label based on these [file globs](https://github.com/kumahq/kuma/blob/master/.github/workflows/auto-backport.yaml#L6), if you want to prevent it from adding the "backport" label use [no-backport-autolabel](https://github.com/kumahq/kuma/blob/master/.github/workflows/auto-backport.yaml#L8) label) --

<!--
> Changelog: skip
-->
<!--
Uncomment the above section to explicitly set a [`> Changelog:` entry here](https://github.com/kumahq/kuma/blob/master/CONTRIBUTING.md#submitting-a-patch)?
-->

[1]: https://docs.github.com/en/issues/tracking-your-work-with-issues/linking-a-pull-request-to-an-issue#linking-a-pull-request-to-an-issue-using-a-keyword



Patch:
diff --git a/deployments/charts/kuma/README.md b/deployments/charts/kuma/README.md
index 72e468534..aecbfb4be 100644
--- a/deployments/charts/kuma/README.md
+++ b/deployments/charts/kuma/README.md
@@ -70,7 +70,6 @@ A Helm chart for the Kuma Control Plane
 | controlPlane.tls.general.secretName | string | `""` | Secret that contains tls.crt, tls.key [and ca.crt when no controlPlane.tls.general.caSecretName specified] for protecting Kuma in-cluster communication |
 | controlPlane.tls.general.caSecretName | string | `""` | Secret that contains ca.crt that was used to sign cert for protecting Kuma in-cluster communication (ca.crt present in this secret have precedence over the one provided in the controlPlane.tls.general.secretName) |
 | controlPlane.tls.general.caBundle | string | `""` | Base64 encoded CA certificate (the same as in controlPlane.tls.general.secret#ca.crt) |
-| controlPlane.tls.general.useSystemCA | bool | `false` | Don't use a CA bundle for the control plane's TLS, use the system one |
 | controlPlane.tls.apiServer.secretName | string | `""` | Secret that contains tls.crt, tls.key for protecting Kuma API on HTTPS |
 | controlPlane.tls.apiServer.clientCertsSecretName | string | `""` | Secret that contains list of .pem certificates that can access admin endpoints of Kuma API on HTTPS |
 | controlPlane.tls.kdsGlobalServer.secretName | string | `""` | Name of the K8s TLS Secret resource. If you set this and don't set create=true, you have to create the secret manually. |
diff --git a/deployments/charts/kuma/templates/_helpers.tpl b/deployments/charts/kuma/templates/_helpers.tpl
index b6a93ecab..6a0f2675f 100644
--- a/deployments/charts/kuma/templates/_helpers.tpl
+++ b/deployments/charts/kuma/templates/_helpers.tpl
@@ -231,10 +231,8 @@ env:
 - name: KUMA_RUNTIME_KUBERNETES_INJECTOR_BUILTIN_DNS_LOGGING
   value: "true"
 {{- end }}
-{{- if not .Values.controlPlane.tls.general.useSystemCA }}
 - name: KUMA_RUNTIME_KUBERNETES_INJECTOR_CA_CERT_FILE
   value: /var/run/secrets/kuma.io/tls-cert/ca.crt
-{{- end }}
 - name: KUMA_DEFAULTS_SKIP_MESH_CREATION
   value: {{ .Values.controlPlane.defaults.skipMeshCreation | quote }}
 - name: KUMA_MODE
diff --git a/deployments/charts/kuma/templates/cp-deployment.yaml b/deployments/charts/kuma/templates/cp-deployment.yaml
index a8f45e9cd..61bb2d27f 100644
--- a/deployments/charts/kuma/templates/cp-deployment.yaml
+++ b/deployments/charts/kuma/templates/cp-deployment.yaml
@@ -229,12 +229,10 @@ spec:
               mountPath: /var/run/secrets/kuma.io/tls-cert/tls.key
               subPath: tls.key
               readOnly: true
-            {{- if not .Values.controlPlane.tls.general.useSystemCA }}
             - name: general-tls-cert{{- if .Values.controlPlane.tls.general.caSecretName }}-ca{{- end }}
               mountPath: /var/run/secrets/kuma.io/tls-cert/ca.crt
               subPath: ca.crt
               readOnly: true
-            {{- end }}
           {{- end }}
           {{- if and (eq .Values.controlPlane.environment "universal") (eq .Values.controlPlane.mode "zone") }}
             {{- if .Values.controlPlane.tls.general.secretName }}
@@ -246,12 +244,10 @@ spec:
               mountPath: /var/run/secrets/kuma.io/tls-cert/tls.key
               subPath: tls.key
               readOnly: true
-            {{- if not .Values.controlPlane.tls.general.useSystemCA }}
             - name: general-tls-cert{{- if .Values.controlPlane.tls.general.caSecretName }}-ca{{- end }}
               mountPath: /var/run/secrets/kuma.io/tls-cert/ca.crt
               subPath: ca.crt
               readOnly: true
-            {{- end}}
             {{- end }}
           {{- end }}
             - name: {{ include "kuma.name" . }}-control-plane-config
diff --git a/deployments/charts/kuma/templates/cp-webhooks-and-secrets.yaml b/deployments/charts/kuma/templates/cp-webhooks-and-secrets.yaml
index e3b30150e..31bf3e75f 100644
--- a/deployments/charts/kuma/templates/cp-webhooks-and-secrets.yaml
+++ b/deployments/charts/kuma/templates/cp-webhooks-and-secrets.yaml
@@ -1,16 +1,7 @@
-{{- $caBundle := .Values.controlPlane.tls.general.caBundle -}}
-{{- if (and (empty $caBundle) (ne .Values.controlPlane.tls.general.caSecretName "")) -}}
-  {{- if .Values.testOnly -}}
-  {{- $caBundle = "FakeReadFromK8S" -}}
-  {{- else -}}
-  {{- $caSecret := (lookup "v1" "Secret" .Release.Namespace .Values.controlPlane.tls.general.caSecretName) -}}
-  {{- $caBundle = index $caSecret.data "ca.crt" -}}
-  {{- end -}}
-{{- end -}}
-{{- $secretName := print (include "kuma.name" .) "-tls-cert" -}}
-{{- if (ne .Values.controlPlane.tls.general.secretName "") -}}
-  {{- $secretName = .Values.controlPlane.tls.general.secretName -}}
-{{- end -}}
+{{- if not (eq (empty .Values.controlPlane.tls.general.caBundle) (empty .Values.controlPlane.tls.general.secretName)) }}
+  {{ fail "You need to send both or neither of controlPlane.tls.general.caBundle and controlPlane.tls.general.secretName"}}
+{{- end }}
+{{- $caBundle := .Values.controlPlane.tls.general.caBundle }}
 {{/*
 Generate certificates
 see: https://masterminds.github.io/sprig/crypto.html
@@ -20,34 +11,28 @@ see: https://github.com/networkservicemesh/networkservicemesh/blob/804ad5026bb5d
 We only autogenerate certs if user did not chose their own secret.
 We only autogenerate certs if the cert is not yet generated. This way we keep the secrets between HELM upgrades.
 */}}
+
+{{- if eq .Values.controlPlane.tls.general.secretName "" -}}
+{{- $cert := "" }}
+{{- $key := "" }}
+{{- $secretName := print (include "kuma.name" .) "-tls-cert" }}
+
 {{- $secret := (lookup "v1" "Secret" .Release.Namespace $secretName) -}}
-{{- if $secret -}} {{/* If the secret already exists read and check the ca is coherent */}}
-  {{- $caSecretBundle := index $secret.data "ca.crt" -}}
-  {{- if (ne $caSecretBundle "") -}}
-    {{- if (and (ne $caBundle "") (ne $caSecretBundle $caBundle)) -}}
-      {{- fail (print "caBundle read in secret '" $secretName "' doesn't match the one set in .Values.controlPlane.tls.general.caSecretName or .Values.controlPlane.tls.general.caBundle") -}}
-    {{- end -}}
-    {{- $caBundle = $caSecretBundle -}}
-  {{- end -}}
+{{- if $secret -}}
+  {{- $cert = index $secret.data "tls.crt" -}}
+  {{- $key = index $secret.data "tls.key" -}}
+  {{- $caBundle = index $secret.data "ca.crt" -}}
 {{- else -}}
-{{- if (empty .Values.controlPlane.tls.general.secretName) -}}
-  {{- if (or (ne .Values.controlPlane.tls.general.caBundle "") (ne .Values.controlPlane.tls.general.caSecretName "") (.Values.controlPlane.tls.general.useSystemCA)) -}}
-    {{- fail "Can't set controlPlane.tls.general.caBundle, .Values.controlPlane.tls.general.caSecretName or .Values.controlPlane.tls.general.useSystemCA when using auto-generated certs" -}}
-  {{- end -}}
   {{- $commonName := (include "kuma.controlPlane.serviceName" .) -}}
   {{- $altNames := list (printf "%s.%s" $commonName .Release.Namespace) (printf "%s.%s.svc" $commonName .Release.Namespace) -}}
   {{- $certTTL := 3650 -}}
   {{- $ca := genCA "kuma-ca" $certTTL -}}
 
   {{- $genCert := genSignedCert $commonName nil $altNames $certTTL $ca -}}
-  {{- $cert := $genCert.Cert | b64enc -}}
-  {{- $key := $genCert.Key | b64enc -}}
-  {{- $caBundle = $ca.Cert | b64enc -}}
-  {{- if .Values.testOnly -}}
-    {{- $cert = "RedactedGeneratedCertForTests" -}}
-    {{- $key = "RedactedGeneratedCertKeyForTests" -}}
-    {{- $caBundle = "RedactedGeneratedCAForTests" -}}
-  {{- end -}}
+  {{- $cert = $genCert.Cert | b64enc -}}
+  {{- $key = $genCert.Key | b64enc -}}
+  {{ $caBundle = $ca.Cert | b64enc }}
+{{- end -}}
 ---
 apiVersion: v1
 kind: Secret
@@ -59,12 +44,8 @@ metadata:
 data:
   tls.crt: {{ $cert }}
   tls.key: {{ $key }}
-  {{if (not .Values.controlPlane.tls.general.useSystemCA) }}ca.crt: {{ $caBundle }}{{end}}
-{{- end -}}
-{{- end -}}
-{{- if (and (empty $caBundle) (not .Values.controlPlane.tls.general.useSystemCA)) -}}
-  {{- fail "Couldn't extract CA bundle, you are either not using generated cert or we couldn't extract it from values or secrets" -}}
-{{- end -}}
+  ca.crt: {{ $caBundle }}
+{{- end }}
 {{- if (eq .Values.controlPlane.environment "kubernetes") }}
 ---
 apiVersion: admissionregistration.k8s.io/v1
@@ -83,7 +64,7 @@ webhooks:
           operator: NotIn
           values: ["kube-system"]
     clientConfig:
-      {{if (not .Values.controlPlane.tls.general.useSystemCA) }}caBundle: {{ $caBundle }}{{end}}
+      caBundle: {{ $caBundle }}
       service:
         namespace: {{ .Release.Namespace }}
         name: {{ include "kuma.controlPlane.serviceName" . }}
@@ -118,7 +99,7 @@ webhooks:
           operator: NotIn
           values: ["kube-system"]
     clientConfig:
-      {{if (not .Values.controlPlane.tls.general.useSystemCA) }}caBundle: {{ $caBundle }}{{end}}
+      caBundle: {{ $caBundle }}
       service:
         namespace: {{ .Release.Namespace }}
         name: {{ include "kuma.controlPlane.serviceName" . }}
@@ -171,7 +152,7 @@ webhooks:
           operator: In
           values: ["enabled", "true"]
     clientConfig:
-      {{if (not .Values.controlPlane.tls.general.useSystemCA) }}caBundle: {{ $caBundle }}{{end}}
+      caBundle: {{ $caBundle }}
       service:
         namespace: {{ .Release.Namespace }}
         name: {{ include "kuma.controlPlane.serviceName" . }}
@@ -198,7 +179,7 @@ webhooks:
       matchLabels:
         kuma.io/sidecar-injection: enabled
     clientConfig:
-      {{if (not .Values.controlPlane.tls.general.useSystemCA) }}caBundle: {{ $caBundle }}{{end}}
+      caBundle: {{ $caBundle }}
       service:
         namespace: {{ .Release.Namespace }}
         name: {{ include "kuma.controlPlane.serviceName" . }}
@@ -231,7 +212,7 @@ webhooks:
           operator: NotIn
           values: ["kube-system"]
     clientConfig:
-      {{if (not .Values.controlPlane.tls.general.useSystemCA) }}caBundle: {{ $caBundle }}{{end}}
+      caBundle: {{ $caBundle }}
       service:
         namespace: {{ .Release.Namespace }}
         name: {{ include "kuma.controlPlane.serviceName" . }}
@@ -287,7 +268,7 @@ webhooks:
           operator: NotIn
           values: ["kube-system"]
     clientConfig:
-      {{if (not .Values.controlPlane.tls.general.useSystemCA) }}caBundle: {{ $caBundle }}{{end}}
+      caBundle: {{ $caBundle }}
       service:
         namespace: {{ .Release.Namespace }}
         name: {{ include "kuma.controlPlane.serviceName" . }}
@@ -311,7 +292,7 @@ webhooks:
         kuma.io/system-namespace: "true"
     failurePolicy: Ignore
     clientConfig:
-      {{if (not .Values.controlPlane.tls.general.useSystemCA) }}caBundle: {{ $caBundle }}{{end}}
+      caBundle: {{ $caBundle }}
       service:
         namespace: {{ .Release.Namespace }}
         name: {{ include "kuma.controlPlane.serviceName" .  }}
@@ -337,7 +318,7 @@ webhooks:
           operator: NotIn
           values: ["kube-system"]
     clientConfig:
-      {{if (not .Values.controlPlane.tls.general.useSystemCA) }}caBundle: {{ $caBundle }}{{end}}
+      caBundle: {{ $caBundle }}
       service:
         namespace: {{ .Release.Namespace }}
         name: {{ include "kuma.controlPlane.serviceName" .  }}
diff --git a/deployments/charts/kuma/values.yaml b/deployments/charts/kuma/values.yaml
index e0f9e5b71..b09b1cdf7 100644
--- a/deployments/charts/kuma/values.yaml
+++ b/deployments/charts/kuma/values.yaml
@@ -219,8 +219,6 @@ controlPlane:
       caSecretName: ""
       # -- Base64 encoded CA certificate (the same as in controlPlane.tls.general.secret#ca.crt)
       caBundle: ""
-      # -- Don't use a CA bundle for the control plane's TLS, use the system one
-      useSystemCA: false
     apiServer:
       # -- Secret that contains tls.crt, tls.key for protecting Kuma API on HTTPS
       secretName: ""
@@ -743,6 +741,3 @@ plugins:
     meshtimeouts: true
     meshtraces: true
     meshtrafficpermissions: true
-
-# @ignored for helm-docs
-testOnly: false
diff --git a/docs/generated/raw/helm-values.yaml b/docs/generated/raw/helm-values.yaml
index e0f9e5b71..b09b1cdf7 100644
--- a/docs/generated/raw/helm-values.yaml
+++ b/docs/generated/raw/helm-values.yaml
@@ -219,8 +219,6 @@ controlPlane:
       caSecretName: ""
       # -- Base64 encoded CA certificate (the same as in controlPlane.tls.general.secret#ca.crt)
       caBundle: ""
-      # -- Don't use a CA bundle for the control plane's TLS, use the system one
-      useSystemCA: false
     apiServer:
       # -- Secret that contains tls.crt, tls.key for protecting Kuma API on HTTPS
       secretName: ""
@@ -743,6 +741,3 @@ plugins:
     meshtimeouts: true
     meshtraces: true
     meshtrafficpermissions: true
-
-# @ignored for helm-docs
-testOnly: false


Test patch:
diff --git a/app/kumactl/cmd/install/install_control_plane_test.go b/app/kumactl/cmd/install/install_control_plane_test.go
index 0f574e7eb..e6e7535fa 100644
--- a/app/kumactl/cmd/install/install_control_plane_test.go
+++ b/app/kumactl/cmd/install/install_control_plane_test.go
@@ -59,9 +59,10 @@ var _ = Describe("kumactl install control-plane", func() {
 			[]string{
 				"install",
 				"control-plane",
+				"--tls-general-secret", "general-tls-secret",
+				"--tls-general-ca-bundle", "XYZ",
 				"--skip-kinds", "CustomResourceDefinition",
 				"--without-kubernetes-connection",
-				"--set", "testOnly=true",
 				"--values", inputFile,
 			},
 		)
@@ -374,7 +375,7 @@ controlPlane:
 		}),
 		Entry("--tls-general-secret without --tls-general-ca-bundle", errTestCase{
 			extraArgs: []string{"--tls-general-secret", "sec"},
-			errorMsg:  "Couldn't extract CA bundle, you are either not using generated cert or we couldn't extract it from values or secrets",
+			errorMsg:  "You need to send both or neither of controlPlane.tls.general.caBundle and controlPlane.tls.general.secretName",
 		}),
 		Entry("with unexpected image tag", errTestCase{
 			extraArgs: []string{"--set", "global.image.tag=1.5.0"},
diff --git a/app/kumactl/cmd/install/testdata/install-control-plane.cni-enabled.golden.yaml b/app/kumactl/cmd/install/testdata/install-control-plane.cni-enabled.golden.yaml
index 3586beb04..2b2fc35e3 100644
--- a/app/kumactl/cmd/install/testdata/install-control-plane.cni-enabled.golden.yaml
+++ b/app/kumactl/cmd/install/testdata/install-control-plane.cni-enabled.golden.yaml
@@ -567,7 +567,7 @@ spec:
     metadata:
       annotations:
         checksum/config: fd9d1d8386f97f2bd49e50f476520816168a1c9f60bbc43dec1347a64d239155
-        checksum/tls-secrets: 5a0917b4af9ccf8a32bf6230b48fb6712df9b2025cff668518cf50caaab0bf24
+        checksum/tls-secrets: 55df76c297436a96c281fa360f359938237859b33236d52399c3c877d6154285
       labels: 
         app: kuma-control-plane
         app.kubernetes.io/name: kuma
diff --git a/app/kumactl/cmd/install/testdata/install-control-plane.defaults.golden.yaml b/app/kumactl/cmd/install/testdata/install-control-plane.defaults.golden.yaml
index 682c1f64c..fae0d3558 100644
--- a/app/kumactl/cmd/install/testdata/install-control-plane.defaults.golden.yaml
+++ b/app/kumactl/cmd/install/testdata/install-control-plane.defaults.golden.yaml
@@ -7991,7 +7991,7 @@ spec:
     metadata:
       annotations:
         checksum/config: fd9d1d8386f97f2bd49e50f476520816168a1c9f60bbc43dec1347a64d239155
-        checksum/tls-secrets: 5a0917b4af9ccf8a32bf6230b48fb6712df9b2025cff668518cf50caaab0bf24
+        checksum/tls-secrets: 55df76c297436a96c281fa360f359938237859b33236d52399c3c877d6154285
       labels: 
         app: kuma-control-plane
         app.kubernetes.io/name: kuma
diff --git a/app/kumactl/cmd/install/testdata/install-control-plane.dump-values.yaml b/app/kumactl/cmd/install/testdata/install-control-plane.dump-values.yaml
index e0f9e5b71..b09b1cdf7 100644
--- a/app/kumactl/cmd/install/testdata/install-control-plane.dump-values.yaml
+++ b/app/kumactl/cmd/install/testdata/install-control-plane.dump-values.yaml
@@ -219,8 +219,6 @@ controlPlane:
       caSecretName: ""
       # -- Base64 encoded CA certificate (the same as in controlPlane.tls.general.secret#ca.crt)
       caBundle: ""
-      # -- Don't use a CA bundle for the control plane's TLS, use the system one
-      useSystemCA: false
     apiServer:
       # -- Secret that contains tls.crt, tls.key for protecting Kuma API on HTTPS
       secretName: ""
@@ -743,6 +741,3 @@ plugins:
     meshtimeouts: true
     meshtraces: true
     meshtrafficpermissions: true
-
-# @ignored for helm-docs
-testOnly: false
diff --git a/app/kumactl/cmd/install/testdata/install-control-plane.gateway-api-present-not-enabled.yaml b/app/kumactl/cmd/install/testdata/install-control-plane.gateway-api-present-not-enabled.yaml
index 682c1f64c..fae0d3558 100644
--- a/app/kumactl/cmd/install/testdata/install-control-plane.gateway-api-present-not-enabled.yaml
+++ b/app/kumactl/cmd/install/testdata/install-control-plane.gateway-api-present-not-enabled.yaml
@@ -7991,7 +7991,7 @@ spec:
     metadata:
       annotations:
         checksum/config: fd9d1d8386f97f2bd49e50f476520816168a1c9f60bbc43dec1347a64d239155
-        checksum/tls-secrets: 5a0917b4af9ccf8a32bf6230b48fb6712df9b2025cff668518cf50caaab0bf24
+        checksum/tls-secrets: 55df76c297436a96c281fa360f359938237859b33236d52399c3c877d6154285
       labels: 
         app: kuma-control-plane
         app.kubernetes.io/name: kuma
diff --git a/app/kumactl/cmd/install/testdata/install-control-plane.gateway-api-present.yaml b/app/kumactl/cmd/install/testdata/install-control-plane.gateway-api-present.yaml
index 6690ec441..8e78f0e1b 100644
--- a/app/kumactl/cmd/install/testdata/install-control-plane.gateway-api-present.yaml
+++ b/app/kumactl/cmd/install/testdata/install-control-plane.gateway-api-present.yaml
@@ -8216,7 +8216,7 @@ spec:
     metadata:
       annotations:
         checksum/config: fd9d1d8386f97f2bd49e50f476520816168a1c9f60bbc43dec1347a64d239155
-        checksum/tls-secrets: 5a0917b4af9ccf8a32bf6230b48fb6712df9b2025cff668518cf50caaab0bf24
+        checksum/tls-secrets: 55df76c297436a96c281fa360f359938237859b33236d52399c3c877d6154285
       labels: 
         app: kuma-control-plane
         app.kubernetes.io/name: kuma
diff --git a/app/kumactl/cmd/install/testdata/install-control-plane.global-universal-on-k8s.golden.yaml b/app/kumactl/cmd/install/testdata/install-control-plane.global-universal-on-k8s.golden.yaml
index 3f849f282..44e9d87bc 100644
--- a/app/kumactl/cmd/install/testdata/install-control-plane.global-universal-on-k8s.golden.yaml
+++ b/app/kumactl/cmd/install/testdata/install-control-plane.global-universal-on-k8s.golden.yaml
@@ -110,7 +110,7 @@ spec:
     metadata:
       annotations:
         checksum/config: fd9d1d8386f97f2bd49e50f476520816168a1c9f60bbc43dec1347a64d239155
-        checksum/tls-secrets: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
+        checksum/tls-secrets: 75a11da44c802486bc6f65640aa48a730f0f684c5c07a42ba3cd1735eb3fb070
       labels: 
         app: kuma-control-plane
         app.kubernetes.io/name: kuma
diff --git a/app/kumactl/cmd/install/testdata/install-control-plane.global.golden.yaml b/app/kumactl/cmd/install/testdata/install-control-plane.global.golden.yaml
index ffc64a044..e2ca5e25c 100644
--- a/app/kumactl/cmd/install/testdata/install-control-plane.global.golden.yaml
+++ b/app/kumactl/cmd/install/testdata/install-control-plane.global.golden.yaml
@@ -369,7 +369,7 @@ spec:
     metadata:
       annotations:
         checksum/config: fd9d1d8386f97f2bd49e50f476520816168a1c9f60bbc43dec1347a64d239155
-        checksum/tls-secrets: 37e20aeec5e3100d47bf2bf8924da6c33ed9424a405cc9903f18fb943006a939
+        checksum/tls-secrets: 3d4c27e032e4581f6ea2585ce59c62c4a18599aafaa5dc40dd3275d38e91a2dd
       labels: 
         app: kuma-control-plane
         app.kubernetes.io/name: kuma
diff --git a/app/kumactl/cmd/install/testdata/install-control-plane.override-env-vars.golden.yaml b/app/kumactl/cmd/install/testdata/install-control-plane.override-env-vars.golden.yaml
index e4f06ab79..b4f0b1b39 100644
--- a/app/kumactl/cmd/install/testdata/install-control-plane.override-env-vars.golden.yaml
+++ b/app/kumactl/cmd/install/testdata/install-control-plane.override-env-vars.golden.yaml
@@ -353,7 +353,7 @@ spec:
     metadata:
       annotations:
         checksum/config: fd9d1d8386f97f2bd49e50f476520816168a1c9f60bbc43dec1347a64d239155
-        checksum/tls-secrets: 5a0917b4af9ccf8a32bf6230b48fb6712df9b2025cff668518cf50caaab0bf24
+        checksum/tls-secrets: 55df76c297436a96c281fa360f359938237859b33236d52399c3c877d6154285
       labels: 
         app: kuma-control-plane
         app.kubernetes.io/name: kuma
diff --git a/app/kumactl/cmd/install/testdata/install-control-plane.overrides.golden.yaml b/app/kumactl/cmd/install/testdata/install-control-plane.overrides.golden.yaml
index d6aa83d02..c0e066c82 100644
--- a/app/kumactl/cmd/install/testdata/install-control-plane.overrides.golden.yaml
+++ b/app/kumactl/cmd/install/testdata/install-control-plane.overrides.golden.yaml
@@ -355,7 +355,7 @@ spec:
     metadata:
       annotations:
         checksum/config: 154c47a95fc93687dd1e825cea7f843d0fe8c450f82014d27cd7eb1a49f3bd35
-        checksum/tls-secrets: 08618d88e5ea5d68ef0978db932cb4e6f714a60ad487e4b8f8437f260ad544e2
+        checksum/tls-secrets: 78426437c5cfc1153b8cbb96647d3d8cb2c7e189a62b31a080c5bbe4b360dc25
       labels: 
         app: kuma-control-plane
         app.kubernetes.io/name: kuma
diff --git a/app/kumactl/cmd/install/testdata/install-control-plane.registry.golden.yaml b/app/kumactl/cmd/install/testdata/install-control-plane.registry.golden.yaml
index c5d28d293..1b45c9e9d 100644
--- a/app/kumactl/cmd/install/testdata/install-control-plane.registry.golden.yaml
+++ b/app/kumactl/cmd/install/testdata/install-control-plane.registry.golden.yaml
@@ -353,7 +353,7 @@ spec:
     metadata:
       annotations:
         checksum/config: fd9d1d8386f97f2bd49e50f476520816168a1c9f60bbc43dec1347a64d239155
-        checksum/tls-secrets: 5a0917b4af9ccf8a32bf6230b48fb6712df9b2025cff668518cf50caaab0bf24
+        checksum/tls-secrets: 55df76c297436a96c281fa360f359938237859b33236d52399c3c877d6154285
       labels: 
         app: kuma-control-plane
         app.kubernetes.io/name: kuma
diff --git a/app/kumactl/cmd/install/testdata/install-control-plane.tproxy-ebpf-experimental-enabled.golden.yaml b/app/kumactl/cmd/install/testdata/install-control-plane.tproxy-ebpf-experimental-enabled.golden.yaml
index e8d92130e..4e91d07b9 100644
--- a/app/kumactl/cmd/install/testdata/install-control-plane.tproxy-ebpf-experimental-enabled.golden.yaml
+++ b/app/kumactl/cmd/install/testdata/install-control-plane.tproxy-ebpf-experimental-enabled.golden.yaml
@@ -353,7 +353,7 @@ spec:
     metadata:
       annotations:
         checksum/config: fd9d1d8386f97f2bd49e50f476520816168a1c9f60bbc43dec1347a64d239155
-        checksum/tls-secrets: 5a0917b4af9ccf8a32bf6230b48fb6712df9b2025cff668518cf50caaab0bf24
+        checksum/tls-secrets: 55df76c297436a96c281fa360f359938237859b33236d52399c3c877d6154285
       labels: 
         app: kuma-control-plane
         app.kubernetes.io/name: kuma
diff --git a/app/kumactl/cmd/install/testdata/install-control-plane.with-egress.golden.yaml b/app/kumactl/cmd/install/testdata/install-control-plane.with-egress.golden.yaml
index 056a30e50..cde00459e 100644
--- a/app/kumactl/cmd/install/testdata/install-control-plane.with-egress.golden.yaml
+++ b/app/kumactl/cmd/install/testdata/install-control-plane.with-egress.golden.yaml
@@ -384,7 +384,7 @@ spec:
     metadata:
       annotations:
         checksum/config: fd9d1d8386f97f2bd49e50f476520816168a1c9f60bbc43dec1347a64d239155
-        checksum/tls-secrets: 5a0917b4af9ccf8a32bf6230b48fb6712df9b2025cff668518cf50caaab0bf24
+        checksum/tls-secrets: 55df76c297436a96c281fa360f359938237859b33236d52399c3c877d6154285
       labels: 
         app: kuma-control-plane
         app.kubernetes.io/name: kuma
diff --git a/app/kumactl/cmd/install/testdata/install-control-plane.with-helm-set.yaml b/app/kumactl/cmd/install/testdata/install-control-plane.with-helm-set.yaml
index 39af7ba63..dddec4b97 100644
--- a/app/kumactl/cmd/install/testdata/install-control-plane.with-helm-set.yaml
+++ b/app/kumactl/cmd/install/testdata/install-control-plane.with-helm-set.yaml
@@ -8053,7 +8053,7 @@ spec:
     metadata:
       annotations:
         checksum/config: fd9d1d8386f97f2bd49e50f476520816168a1c9f60bbc43dec1347a64d239155
-        checksum/tls-secrets: 5a0917b4af9ccf8a32bf6230b48fb6712df9b2025cff668518cf50caaab0bf24
+        checksum/tls-secrets: 55df76c297436a96c281fa360f359938237859b33236d52399c3c877d6154285
       labels: 
         app: kuma-control-plane
         app.kubernetes.io/name: kuma
diff --git a/app/kumactl/cmd/install/testdata/install-control-plane.with-helm-values.yaml b/app/kumactl/cmd/install/testdata/install-control-plane.with-helm-values.yaml
index 536bfbbeb..883153979 100644
--- a/app/kumactl/cmd/install/testdata/install-control-plane.with-helm-values.yaml
+++ b/app/kumactl/cmd/install/testdata/install-control-plane.with-helm-values.yaml
@@ -353,7 +353,7 @@ spec:
     metadata:
       annotations:
         checksum/config: fd9d1d8386f97f2bd49e50f476520816168a1c9f60bbc43dec1347a64d239155
-        checksum/tls-secrets: 5a0917b4af9ccf8a32bf6230b48fb6712df9b2025cff668518cf50caaab0bf24
+        checksum/tls-secrets: 55df76c297436a96c281fa360f359938237859b33236d52399c3c877d6154285
       labels: 
         app: kuma-control-plane
         app.kubernetes.io/name: kuma
diff --git a/app/kumactl/cmd/install/testdata/install-control-plane.with-ingress.golden.yaml b/app/kumactl/cmd/install/testdata/install-control-plane.with-ingress.golden.yaml
index 2597b5397..3beb46c09 100644
--- a/app/kumactl/cmd/install/testdata/install-control-plane.with-ingress.golden.yaml
+++ b/app/kumactl/cmd/install/testdata/install-control-plane.with-ingress.golden.yaml
@@ -384,7 +384,7 @@ spec:
     metadata:
       annotations:
         checksum/config: fd9d1d8386f97f2bd49e50f476520816168a1c9f60bbc43dec1347a64d239155
-        checksum/tls-secrets: 5a0917b4af9ccf8a32bf6230b48fb6712df9b2025cff668518cf50caaab0bf24
+        checksum/tls-secrets: 55df76c297436a96c281fa360f359938237859b33236d52399c3c877d6154285
       labels: 
         app: kuma-control-plane
         app.kubernetes.io/name: kuma
diff --git a/app/kumactl/cmd/install/testdata/install-control-plane.zone-universal-on-k8s.golden.yaml b/app/kumactl/cmd/install/testdata/install-control-plane.zone-universal-on-k8s.golden.yaml
index c9d08e888..d25df3020 100644
--- a/app/kumactl/cmd/install/testdata/install-control-plane.zone-universal-on-k8s.golden.yaml
+++ b/app/kumactl/cmd/install/testdata/install-control-plane.zone-universal-on-k8s.golden.yaml
@@ -94,7 +94,7 @@ spec:
     metadata:
       annotations:
         checksum/config: fd9d1d8386f97f2bd49e50f476520816168a1c9f60bbc43dec1347a64d239155
-        checksum/tls-secrets: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
+        checksum/tls-secrets: 75a11da44c802486bc6f65640aa48a730f0f684c5c07a42ba3cd1735eb3fb070
       labels: 
         app: kuma-control-plane
         app.kubernetes.io/name: kuma
diff --git a/app/kumactl/cmd/install/testdata/install-control-plane.zone.golden.yaml b/app/kumactl/cmd/install/testdata/install-control-plane.zone.golden.yaml
index 9175be8b7..086f70232 100644
--- a/app/kumactl/cmd/install/testdata/install-control-plane.zone.golden.yaml
+++ b/app/kumactl/cmd/install/testdata/install-control-plane.zone.golden.yaml
@@ -353,7 +353,7 @@ spec:
     metadata:
       annotations:
         checksum/config: fd9d1d8386f97f2bd49e50f476520816168a1c9f60bbc43dec1347a64d239155
-        checksum/tls-secrets: 5a0917b4af9ccf8a32bf6230b48fb6712df9b2025cff668518cf50caaab0bf24
+        checksum/tls-secrets: 55df76c297436a96c281fa360f359938237859b33236d52399c3c877d6154285
       labels: 
         app: kuma-control-plane
         app.kubernetes.io/name: kuma
diff --git a/app/kumactl/cmd/install/testdata/install-cp-helm/doNotChangeTlsChecksum.values.yaml b/app/kumactl/cmd/install/testdata/install-cp-helm/doNotChangeTlsChecksum.values.yaml
index 1d6ce940a..b8c28d66f 100644
--- a/app/kumactl/cmd/install/testdata/install-cp-helm/doNotChangeTlsChecksum.values.yaml
+++ b/app/kumactl/cmd/install/testdata/install-cp-helm/doNotChangeTlsChecksum.values.yaml
@@ -1,6 +1,1 @@
-restartOnSecretChange: false
-controlPlane:
-  tls:
-    general:
-      secretName: general-tls-secret
-      caBundle: XYZ
+restartOnSecretChange: false
\ No newline at end of file
diff --git a/app/kumactl/cmd/install/testdata/install-cp-helm/empty.golden.yaml b/app/kumactl/cmd/install/testdata/install-cp-helm/empty.golden.yaml
index 7420bb19d..f7f871b91 100644
--- a/app/kumactl/cmd/install/testdata/install-cp-helm/empty.golden.yaml
+++ b/app/kumactl/cmd/install/testdata/install-cp-helm/empty.golden.yaml
@@ -18,21 +18,6 @@ metadata:
     app.kubernetes.io/instance: kuma
 ---
 apiVersion: v1
-kind: Secret
-type: kubernetes.io/tls
-metadata:
-  name: kuma-tls-cert
-  namespace: kuma-system
-  labels: 
-    app: kuma-control-plane
-    app.kubernetes.io/name: kuma
-    app.kubernetes.io/instance: kuma
-data:
-  tls.crt: RedactedGeneratedCertForTests
-  tls.key: RedactedGeneratedCertKeyForTests
-  ca.crt: RedactedGeneratedCAForTests
----
-apiVersion: v1
 kind: ConfigMap
 metadata:
   name: kuma-control-plane-config
@@ -368,7 +353,7 @@ spec:
     metadata:
       annotations:
         checksum/config: fd9d1d8386f97f2bd49e50f476520816168a1c9f60bbc43dec1347a64d239155
-        checksum/tls-secrets: 8586a7997e2e6b7bbe3337e256dc3ee22f1e06cb578d53591a6735e154001a2c
+        checksum/tls-secrets: 55df76c297436a96c281fa360f359938237859b33236d52399c3c877d6154285
       labels: 
         app: kuma-control-plane
         app.kubernetes.io/name: kuma
@@ -503,7 +488,7 @@ spec:
       volumes:
         - name: general-tls-cert
           secret:
-            secretName: kuma-tls-cert
+            secretName: general-tls-secret
         - name: kuma-control-plane-config
           configMap:
             name: kuma-control-plane-config
@@ -529,7 +514,7 @@ webhooks:
           operator: NotIn
           values: ["kube-system"]
     clientConfig:
-      caBundle: RedactedGeneratedCAForTests
+      caBundle: XYZ
       service:
         namespace: kuma-system
         name: kuma-control-plane
@@ -569,7 +554,7 @@ webhooks:
           operator: NotIn
           values: ["kube-system"]
     clientConfig:
-      caBundle: RedactedGeneratedCAForTests
+      caBundle: XYZ
       service:
         namespace: kuma-system
         name: kuma-control-plane
@@ -627,7 +612,7 @@ webhooks:
           operator: In
           values: ["enabled", "true"]
     clientConfig:
-      caBundle: RedactedGeneratedCAForTests
+      caBundle: XYZ
       service:
         namespace: kuma-system
         name: kuma-control-plane
@@ -654,7 +639,7 @@ webhooks:
       matchLabels:
         kuma.io/sidecar-injection: enabled
     clientConfig:
-      caBundle: RedactedGeneratedCAForTests
+      caBundle: XYZ
       service:
         namespace: kuma-system
         name: kuma-control-plane
@@ -689,7 +674,7 @@ webhooks:
           operator: NotIn
           values: ["kube-system"]
     clientConfig:
-      caBundle: RedactedGeneratedCAForTests
+      caBundle: XYZ
       service:
         namespace: kuma-system
         name: kuma-control-plane
@@ -750,7 +735,7 @@ webhooks:
           operator: NotIn
           values: ["kube-system"]
     clientConfig:
-      caBundle: RedactedGeneratedCAForTests
+      caBundle: XYZ
       service:
         namespace: kuma-system
         name: kuma-control-plane
@@ -773,7 +758,7 @@ webhooks:
         kuma.io/system-namespace: "true"
     failurePolicy: Ignore
     clientConfig:
-      caBundle: RedactedGeneratedCAForTests
+      caBundle: XYZ
       service:
         namespace: kuma-system
         name: kuma-control-plane
@@ -799,7 +784,7 @@ webhooks:
           operator: NotIn
           values: ["kube-system"]
     clientConfig:
-      caBundle: RedactedGeneratedCAForTests
+      caBundle: XYZ
       service:
         namespace: kuma-system
         name: kuma-control-plane
diff --git a/app/kumactl/cmd/install/testdata/install-cp-helm/fix4485.golden.yaml b/app/kumactl/cmd/install/testdata/install-cp-helm/fix4485.golden.yaml
index 4b4a7df37..4a859d532 100644
--- a/app/kumactl/cmd/install/testdata/install-cp-helm/fix4485.golden.yaml
+++ b/app/kumactl/cmd/install/testdata/install-cp-helm/fix4485.golden.yaml
@@ -19,22 +19,6 @@ metadata:
     app.kubernetes.io/instance: kuma
 ---
 apiVersion: v1
-kind: Secret
-type: kubernetes.io/tls
-metadata:
-  name: kuma-tls-cert
-  namespace: kuma-system
-  labels: 
-    app: kuma-control-plane
-    "foo": "baz"
-    app.kubernetes.io/name: kuma
-    app.kubernetes.io/instance: kuma
-data:
-  tls.crt: RedactedGeneratedCertForTests
-  tls.key: RedactedGeneratedCertKeyForTests
-  ca.crt: RedactedGeneratedCAForTests
----
-apiVersion: v1
 kind: ConfigMap
 metadata:
   name: kuma-control-plane-config
@@ -391,7 +375,7 @@ spec:
     metadata:
       annotations:
         checksum/config: 3a137bbfcbbe6ba5a3997b30b1b047b2b080a9f912520a5fa683f11c4c6b6f3c
-        checksum/tls-secrets: 2592438e0105c2d802f5a3c307b66570f45955f045e0e9e67e8f34803d423f18
+        checksum/tls-secrets: eaa0755517dab3b768995399fe8f9ec305104f81d9e86f75dc8dde820bc7c897
       labels: 
         app: kuma-control-plane
         "foo": "baz"
@@ -530,7 +514,7 @@ spec:
       volumes:
         - name: general-tls-cert
           secret:
-            secretName: kuma-tls-cert
+            secretName: general-tls-secret
         - name: kuma-control-plane-config
           configMap:
             name: kuma-control-plane-config
@@ -560,7 +544,7 @@ webhooks:
           operator: NotIn
           values: ["kube-system"]
     clientConfig:
-      caBundle: RedactedGeneratedCAForTests
+      caBundle: XYZ
       service:
         namespace: kuma-system
         name: kuma-control-plane
@@ -600,7 +584,7 @@ webhooks:
           operator: NotIn
           values: ["kube-system"]
     clientConfig:
-      caBundle: RedactedGeneratedCAForTests
+      caBundle: XYZ
       service:
         namespace: kuma-system
         name: kuma-control-plane
@@ -658,7 +642,7 @@ webhooks:
           operator: In
           values: ["enabled", "true"]
     clientConfig:
-      caBundle: RedactedGeneratedCAForTests
+      caBundle: XYZ
       service:
         namespace: kuma-system
         name: kuma-control-plane
@@ -685,7 +669,7 @@ webhooks:
       matchLabels:
         kuma.io/sidecar-injection: enabled
     clientConfig:
-      caBundle: RedactedGeneratedCAForTests
+      caBundle: XYZ
       service:
         namespace: kuma-system
         name: kuma-control-plane
@@ -721,7 +705,7 @@ webhooks:
           operator: NotIn
           values: ["kube-system"]
     clientConfig:
-      caBundle: RedactedGeneratedCAForTests
+      caBundle: XYZ
       service:
         namespace: kuma-system
         name: kuma-control-plane
@@ -782,7 +766,7 @@ webhooks:
           operator: NotIn
           values: ["kube-system"]
     clientConfig:
-      caBundle: RedactedGeneratedCAForTests
+      caBundle: XYZ
       service:
         namespace: kuma-system
         name: kuma-control-plane
@@ -805,7 +789,7 @@ webhooks:
         kuma.io/system-namespace: "true"
     failurePolicy: Ignore
     clientConfig:
-      caBundle: RedactedGeneratedCAForTests
+      caBundle: XYZ
       service:
         namespace: kuma-system
         name: kuma-control-plane
@@ -831,7 +815,7 @@ webhooks:
           operator: NotIn
           values: ["kube-system"]
     clientConfig:
-      caBundle: RedactedGeneratedCAForTests
+      caBundle: XYZ
       service:
         namespace: kuma-system
         name: kuma-control-plane
diff --git a/app/kumactl/cmd/install/testdata/install-cp-helm/fix4496.golden.yaml b/app/kumactl/cmd/install/testdata/install-cp-helm/fix4496.golden.yaml
index a9c6ee564..0d9f5c2ba 100644
--- a/app/kumactl/cmd/install/testdata/install-cp-helm/fix4496.golden.yaml
+++ b/app/kumactl/cmd/install/testdata/install-cp-helm/fix4496.golden.yaml
@@ -30,22 +30,6 @@ metadata:
     app.kubernetes.io/instance: kuma
 ---
 apiVersion: v1
-kind: Secret
-type: kubernetes.io/tls
-metadata:
-  name: kuma-tls-cert
-  namespace: kuma-system
-  labels: 
-    app: kuma-control-plane
-    "foo": "bar"
-    app.kubernetes.io/name: kuma
-    app.kubernetes.io/instance: kuma
-data:
-  tls.crt: RedactedGeneratedCertForTests
-  tls.key: RedactedGeneratedCertKeyForTests
-  ca.crt: RedactedGeneratedCAForTests
----
-apiVersion: v1
 kind: ConfigMap
 metadata:
   name: kuma-control-plane-config
@@ -410,7 +394,7 @@ spec:
     metadata:
       annotations:
         checksum/config: 2f553eadd8f68661f4b1fd0b3ccbbc562943d89fa76f2f2ba2975541290fda71
-        checksum/tls-secrets: 56668f0d91c7dfd6a1dd988d0555337fb46e278874fa0a85749a5985368cff96
+        checksum/tls-secrets: 2f113fa37a7e14ba1e46472f1f935a27406262785eb9e4e87f1149ea616f25a1
       labels: 
         app: kuma-control-plane
         "foo": "bar"
@@ -550,7 +534,7 @@ spec:
       volumes:
         - name: general-tls-cert
           secret:
-            secretName: kuma-tls-cert
+            secretName: general-tls-secret
         - name: kuma-control-plane-config
           configMap:
             name: kuma-control-plane-config
@@ -683,7 +667,7 @@ spec:
       volumes:
         - name: control-plane-ca
           secret:
-            secretName: "kuma-tls-cert"
+            secretName: "general-tls-secret"
             items:
               - key: ca.crt
                 path: ca.crt
@@ -734,7 +718,7 @@ webhooks:
           operator: NotIn
           values: ["kube-system"]
     clientConfig:
-      caBundle: RedactedGeneratedCAForTests
+      caBundle: XYZ
       service:
         namespace: kuma-system
         name: kuma-control-plane
@@ -774,7 +758,7 @@ webhooks:
           operator: NotIn
           values: ["kube-system"]
     clientConfig:
-      caBundle: RedactedGeneratedCAForTests
+      caBundle: XYZ
       service:
         namespace: kuma-system
         name: kuma-control-plane
@@ -832,7 +816,7 @@ webhooks:
           operator: In
           values: ["enabled", "true"]
     clientConfig:
-      caBundle: RedactedGeneratedCAForTests
+      caBundle: XYZ
       service:
         namespace: kuma-system
         name: kuma-control-plane
@@ -859,7 +843,7 @@ webhooks:
       matchLabels:
         kuma.io/sidecar-injection: enabled
     clientConfig:
-      caBundle: RedactedGeneratedCAForTests
+      caBundle: XYZ
       service:
         namespace: kuma-system
         name: kuma-control-plane
@@ -895,7 +879,7 @@ webhooks:
           operator: NotIn
           values: ["kube-system"]
     clientConfig:
-      caBundle: RedactedGeneratedCAForTests
+      caBundle: XYZ
       service:
         namespace: kuma-system
         name: kuma-control-plane
@@ -956,7 +940,7 @@ webhooks:
           operator: NotIn
           values: ["kube-system"]
     clientConfig:
-      caBundle: RedactedGeneratedCAForTests
+      caBundle: XYZ
       service:
         namespace: kuma-system
         name: kuma-control-plane
@@ -979,7 +963,7 @@ webhooks:
         kuma.io/system-namespace: "true"
     failurePolicy: Ignore
     clientConfig:
-      caBundle: RedactedGeneratedCAForTests
+      caBundle: XYZ
       service:
         namespace: kuma-system
         name: kuma-control-plane
@@ -1005,7 +989,7 @@ webhooks:
           operator: NotIn
           values: ["kube-system"]
     clientConfig:
-      caBundle: RedactedGeneratedCAForTests
+      caBundle: XYZ
       service:
         namespace: kuma-system
         name: kuma-control-plane
diff --git a/app/kumactl/cmd/install/testdata/install-cp-helm/fix4935.golden.yaml b/app/kumactl/cmd/install/testdata/install-cp-helm/fix4935.golden.yaml
index 485103d86..61c9f4c60 100644
--- a/app/kumactl/cmd/install/testdata/install-cp-helm/fix4935.golden.yaml
+++ b/app/kumactl/cmd/install/testdata/install-cp-helm/fix4935.golden.yaml
@@ -47,21 +47,6 @@ metadata:
     app.kubernetes.io/name: kuma
     app.kubernetes.io/instance: kuma
 ---
-apiVersion: v1
-kind: Secret
-type: kubernetes.io/tls
-metadata:
-  name: kuma-tls-cert
-  namespace: kuma-system
-  labels: 
-    app: kuma-control-plane
-    app.kubernetes.io/name: kuma
-    app.kubernetes.io/instance: kuma
-data:
-  tls.crt: RedactedGeneratedCertForTests
-  tls.key: RedactedGeneratedCertKeyForTests
-  ca.crt: RedactedGeneratedCAForTests
----
 kind: ConfigMap
 apiVersion: v1
 metadata:
@@ -652,7 +637,7 @@ spec:
     metadata:
       annotations:
         checksum/config: fd9d1d8386f97f2bd49e50f476520816168a1c9f60bbc43dec1347a64d239155
-        checksum/tls-secrets: 8586a7997e2e6b7bbe3337e256dc3ee22f1e06cb578d53591a6735e154001a2c
+        checksum/tls-secrets: 55df76c297436a96c281fa360f359938237859b33236d52399c3c877d6154285
         bim: "bam"
         foo: "{\"bar\": \"baz\"}"
       labels: 
@@ -797,7 +782,7 @@ spec:
       volumes:
         - name: general-tls-cert
           secret:
-            secretName: kuma-tls-cert
+            secretName: general-tls-secret
         - name: kuma-control-plane-config
           configMap:
             name: kuma-control-plane-config
@@ -929,7 +914,7 @@ spec:
       volumes:
         - name: control-plane-ca
           secret:
-            secretName: "kuma-tls-cert"
+            secretName: "general-tls-secret"
             items:
               - key: ca.crt
                 path: ca.crt
@@ -1063,7 +1048,7 @@ spec:
       volumes:
         - name: control-plane-ca
           secret:
-            secretName: "kuma-tls-cert"
+            secretName: "general-tls-secret"
             items:
               - key: ca.crt
                 path: ca.crt
@@ -1115,7 +1100,7 @@ webhooks:
           operator: NotIn
           values: ["kube-system"]
     clientConfig:
-      caBundle: RedactedGeneratedCAForTests
+      caBundle: XYZ
       service:
         namespace: kuma-system
         name: kuma-control-plane
@@ -1155,7 +1140,7 @@ webhooks:
           operator: NotIn
           values: ["kube-system"]
     clientConfig:
-      caBundle: RedactedGeneratedCAForTests
+      caBundle: XYZ
       service:
         namespace: kuma-system
         name: kuma-control-plane
@@ -1213,7 +1198,7 @@ webhooks:
           operator: In
           values: ["enabled", "true"]
     clientConfig:
-      caBundle: RedactedGeneratedCAForTests
+      caBundle: XYZ
       service:
         namespace: kuma-system
         name: kuma-control-plane
@@ -1240,7 +1225,7 @@ webhooks:
       matchLabels:
         kuma.io/sidecar-injection: enabled
     clientConfig:
-      caBundle: RedactedGeneratedCAForTests
+      caBundle: XYZ
       service:
         namespace: kuma-system
         name: kuma-control-plane
@@ -1275,7 +1260,7 @@ webhooks:
           operator: NotIn
           values: ["kube-system"]
     clientConfig:
-      caBundle: RedactedGeneratedCAForTests
+      caBundle: XYZ
       service:
         namespace: kuma-system
         name: kuma-control-plane
@@ -1336,7 +1321,7 @@ webhooks:
           operator: NotIn
           values: ["kube-system"]
     clientConfig:
-      caBundle: RedactedGeneratedCAForTests
+      caBundle: XYZ
       service:
         namespace: kuma-system
         name: kuma-control-plane
@@ -1359,7 +1344,7 @@ webhooks:
         kuma.io/system-namespace: "true"
     failurePolicy: Ignore
     clientConfig:
-      caBundle: RedactedGeneratedCAForTests
+      caBundle: XYZ
       service:
         namespace: kuma-system
         name: kuma-control-plane
@@ -1385,7 +1370,7 @@ webhooks:
           operator: NotIn
           values: ["kube-system"]
     clientConfig:
-      caBundle: RedactedGeneratedCAForTests
+      caBundle: XYZ
       service:
         namespace: kuma-system
         name: kuma-control-plane
diff --git a/app/kumactl/cmd/install/testdata/install-cp-helm/fix5978.golden.yaml b/app/kumactl/cmd/install/testdata/install-cp-helm/fix5978.golden.yaml
index 3505b14fc..bd9c787c1 100644
--- a/app/kumactl/cmd/install/testdata/install-cp-helm/fix5978.golden.yaml
+++ b/app/kumactl/cmd/install/testdata/install-cp-helm/fix5978.golden.yaml
@@ -415,7 +415,7 @@ spec:
     metadata:
       annotations:
         checksum/config: fd9d1d8386f97f2bd49e50f476520816168a1c9f60bbc43dec1347a64d239155
-        checksum/tls-secrets: 8feab4cb511a689843f6c8589127720445c7ce544195ac3ed5e65167e86f8fb2
+        checksum/tls-secrets: 55df76c297436a96c281fa360f359938237859b33236d52399c3c877d6154285
       labels: 
         app: kuma-control-plane
         app.kubernetes.io/name: kuma
@@ -554,7 +554,7 @@ spec:
       volumes:
         - name: general-tls-cert
           secret:
-            secretName: my-certs
+            secretName: general-tls-secret
         - name: general-tls-cert-ca
           secret:
             secretName: my-custom-ca-name
@@ -843,7 +843,7 @@ webhooks:
           operator: NotIn
           values: ["kube-system"]
     clientConfig:
-      caBundle: FakeReadFromK8S
+      caBundle: XYZ
       service:
         namespace: kuma-system
         name: kuma-control-plane
@@ -883,7 +883,7 @@ webhooks:
           operator: NotIn
           values: ["kube-system"]
     clientConfig:
-      caBundle: FakeReadFromK8S
+      caBundle: XYZ
       service:
         namespace: kuma-system
         name: kuma-control-plane
@@ -941,7 +941,7 @@ webhooks:
           operator: In
           values: ["enabled", "true"]
     clientConfig:
-      caBundle: FakeReadFromK8S
+      caBundle: XYZ
       service:
         namespace: kuma-system
         name: kuma-control-plane
@@ -968,7 +968,7 @@ webhooks:
       matchLabels:
         kuma.io/sidecar-injection: enabled
     clientConfig:
-      caBundle: FakeReadFromK8S
+      caBundle: XYZ
       service:
         namespace: kuma-system
         name: kuma-control-plane
@@ -1003,7 +1003,7 @@ webhooks:
           operator: NotIn
           values: ["kube-system"]
     clientConfig:
-      caBundle: FakeReadFromK8S
+      caBundle: XYZ
       service:
         namespace: kuma-system
         name: kuma-control-plane
@@ -1064,7 +1064,7 @@ webhooks:
           operator: NotIn
           values: ["kube-system"]
     clientConfig:
-      caBundle: FakeReadFromK8S
+      caBundle: XYZ
       service:
         namespace: kuma-system
         name: kuma-control-plane
@@ -1087,7 +1087,7 @@ webhooks:
         kuma.io/system-namespace: "true"
     failurePolicy: Ignore
     clientConfig:
-      caBundle: FakeReadFromK8S
+      caBundle: XYZ
       service:
         namespace: kuma-system
         name: kuma-control-plane
@@ -1113,7 +1113,7 @@ webhooks:
           operator: NotIn
           values: ["kube-system"]
     clientConfig:
-      caBundle: FakeReadFromK8S
+      caBundle: XYZ
       service:
         namespace: kuma-system
         name: kuma-control-plane
diff --git a/app/kumactl/cmd/install/testdata/install-cp-helm/fix5978.values.yaml b/app/kumactl/cmd/install/testdata/install-cp-helm/fix5978.values.yaml
index 7e00bca01..9ce845295 100644
--- a/app/kumactl/cmd/install/testdata/install-cp-helm/fix5978.values.yaml
+++ b/app/kumactl/cmd/install/testdata/install-cp-helm/fix5978.values.yaml
@@ -4,7 +4,6 @@ controlPlane:
   kdsGlobalAddress: "grpcs://foo.com:3456"
   tls:
     general:
-      secretName: my-certs
       caSecretName: my-custom-ca-name
 ingress:
   enabled: true
diff --git a/app/kumactl/cmd/install/testdata/install-cp-helm/fix7724.golden.yaml b/app/kumactl/cmd/install/testdata/install-cp-helm/fix7724.golden.yaml
index d93985979..d8589fd92 100644
--- a/app/kumactl/cmd/install/testdata/install-cp-helm/fix7724.golden.yaml
+++ b/app/kumactl/cmd/install/testdata/install-cp-helm/fix7724.golden.yaml
@@ -21,21 +21,6 @@ metadata:
     ping: pong
 ---
 apiVersion: v1
-kind: Secret
-type: kubernetes.io/tls
-metadata:
-  name: kuma-tls-cert
-  namespace: kuma-system
-  labels: 
-    app: kuma-control-plane
-    app.kubernetes.io/name: kuma
-    app.kubernetes.io/instance: kuma
-data:
-  tls.crt: RedactedGeneratedCertForTests
-  tls.key: RedactedGeneratedCertKeyForTests
-  ca.crt: RedactedGeneratedCAForTests
----
-apiVersion: v1
 kind: ConfigMap
 metadata:
   name: kuma-control-plane-config
@@ -371,7 +356,7 @@ spec:
     metadata:
       annotations:
         checksum/config: fd9d1d8386f97f2bd49e50f476520816168a1c9f60bbc43dec1347a64d239155
-        checksum/tls-secrets: 8586a7997e2e6b7bbe3337e256dc3ee22f1e06cb578d53591a6735e154001a2c
+        checksum/tls-secrets: 55df76c297436a96c281fa360f359938237859b33236d52399c3c877d6154285
       labels: 
         app: kuma-control-plane
         app.kubernetes.io/name: kuma
@@ -506,7 +491,7 @@ spec:
       volumes:
         - name: general-tls-cert
           secret:
-            secretName: kuma-tls-cert
+            secretName: general-tls-secret
         - name: kuma-control-plane-config
           configMap:
             name: kuma-control-plane-config
@@ -532,7 +517,7 @@ webhooks:
           operator: NotIn
           values: ["kube-system"]
     clientConfig:
-      caBundle: RedactedGeneratedCAForTests
+      caBundle: XYZ
       service:
         namespace: kuma-system
         name: kuma-control-plane
@@ -572,7 +557,7 @@ webhooks:
           operator: NotIn
           values: ["kube-system"]
     clientConfig:
-      caBundle: RedactedGeneratedCAForTests
+      caBundle: XYZ
       service:
         namespace: kuma-system
         name: kuma-control-plane
@@ -630,7 +615,7 @@ webhooks:
           operator: In
           values: ["enabled", "true"]
     clientConfig:
-      caBundle: RedactedGeneratedCAForTests
+      caBundle: XYZ
       service:
         namespace: kuma-system
         name: kuma-control-plane
@@ -657,7 +642,7 @@ webhooks:
       matchLabels:
         kuma.io/sidecar-injection: enabled
     clientConfig:
-      caBundle: RedactedGeneratedCAForTests
+      caBundle: XYZ
       service:
         namespace: kuma-system
         name: kuma-control-plane
@@ -692,7 +677,7 @@ webhooks:
           operator: NotIn
           values: ["kube-system"]
     clientConfig:
-      caBundle: RedactedGeneratedCAForTests
+      caBundle: XYZ
       service:
         namespace: kuma-system
         name: kuma-control-plane
@@ -753,7 +738,7 @@ webhooks:
           operator: NotIn
           values: ["kube-system"]
     clientConfig:
-      caBundle: RedactedGeneratedCAForTests
+      caBundle: XYZ
       service:
         namespace: kuma-system
         name: kuma-control-plane
@@ -776,7 +761,7 @@ webhooks:
         kuma.io/system-namespace: "true"
     failurePolicy: Ignore
     clientConfig:
-      caBundle: RedactedGeneratedCAForTests
+      caBundle: XYZ
       service:
         namespace: kuma-system
         name: kuma-control-plane
@@ -802,7 +787,7 @@ webhooks:
           operator: NotIn
           values: ["kube-system"]
     clientConfig:
-      caBundle: RedactedGeneratedCAForTests
+      caBundle: XYZ
       service:
         namespace: kuma-system
         name: kuma-control-plane
diff --git a/app/kumactl/cmd/install/testdata/install-cp-helm/fix7724.values.yaml b/app/kumactl/cmd/install/testdata/install-cp-helm/fix7724.values.yaml
index ed95ebf59..535f58800 100644
--- a/app/kumactl/cmd/install/testdata/install-cp-helm/fix7724.values.yaml
+++ b/app/kumactl/cmd/install/testdata/install-cp-helm/fix7724.values.yaml
@@ -1,4 +1,4 @@
 controlPlane:
-  serviceAccountAnnotations:
+  serviceAccountAnnotations: 
     foo: '{"bar": "taz"}'
     ping: "pong"
diff --git a/app/kumactl/cmd/install/testdata/install-cp-helm/fix7824.golden.yaml b/app/kumactl/cmd/install/testdata/install-cp-helm/fix7824.golden.yaml
index e4a704361..d57c75ef2 100644
--- a/app/kumactl/cmd/install/testdata/install-cp-helm/fix7824.golden.yaml
+++ b/app/kumactl/cmd/install/testdata/install-cp-helm/fix7824.golden.yaml
@@ -53,21 +53,6 @@ imagePullSecrets:
   - name: "image-secret"
 ---
 apiVersion: v1
-kind: Secret
-type: kubernetes.io/tls
-metadata:
-  name: kuma-tls-cert
-  namespace: kuma-system
-  labels: 
-    app: kuma-control-plane
-    app.kubernetes.io/name: kuma
-    app.kubernetes.io/instance: kuma
-data:
-  tls.crt: RedactedGeneratedCertForTests
-  tls.key: RedactedGeneratedCertKeyForTests
-  ca.crt: RedactedGeneratedCAForTests
----
-apiVersion: v1
 kind: ConfigMap
 metadata:
   name: kuma-control-plane-config
@@ -445,7 +430,7 @@ spec:
     metadata:
       annotations:
         checksum/config: fd9d1d8386f97f2bd49e50f476520816168a1c9f60bbc43dec1347a64d239155
-        checksum/tls-secrets: 8586a7997e2e6b7bbe3337e256dc3ee22f1e06cb578d53591a6735e154001a2c
+        checksum/tls-secrets: 55df76c297436a96c281fa360f359938237859b33236d52399c3c877d6154285
       labels: 
         app: kuma-control-plane
         app.kubernetes.io/name: kuma
@@ -605,7 +590,7 @@ spec:
                      path: namespace
         - name: general-tls-cert
           secret:
-            secretName: kuma-tls-cert
+            secretName: general-tls-secret
         - name: kuma-control-plane-config
           configMap:
             name: kuma-control-plane-config
@@ -755,7 +740,7 @@ spec:
                       path: namespace
         - name: control-plane-ca
           secret:
-            secretName: "kuma-tls-cert"
+            secretName: "general-tls-secret"
             items:
               - key: ca.crt
                 path: ca.crt
@@ -907,7 +892,7 @@ spec:
                       path: namespace
         - name: control-plane-ca
           secret:
-            secretName: "kuma-tls-cert"
+            secretName: "general-tls-secret"
             items:
               - key: ca.crt
                 path: ca.crt
@@ -933,7 +918,7 @@ webhooks:
           operator: NotIn
           values: ["kube-system"]
     clientConfig:
-      caBundle: RedactedGeneratedCAForTests
+      caBundle: XYZ
       service:
         namespace: kuma-system
         name: kuma-control-plane
@@ -973,7 +958,7 @@ webhooks:
           operator: NotIn
           values: ["kube-system"]
     clientConfig:
-      caBundle: RedactedGeneratedCAForTests
+      caBundle: XYZ
       service:
         namespace: kuma-system
         name: kuma-control-plane
@@ -1031,7 +1016,7 @@ webhooks:
           operator: In
           values: ["enabled", "true"]
     clientConfig:
-      caBundle: RedactedGeneratedCAForTests
+      caBundle: XYZ
       service:
         namespace: kuma-system
         name: kuma-control-plane
@@ -1058,7 +1043,7 @@ webhooks:
       matchLabels:
         kuma.io/sidecar-injection: enabled
     clientConfig:
-      caBundle: RedactedGeneratedCAForTests
+      caBundle: XYZ
       service:
         namespace: kuma-system
         name: kuma-control-plane
@@ -1093,7 +1078,7 @@ webhooks:
           operator: NotIn
           values: ["kube-system"]
     clientConfig:
-      caBundle: RedactedGeneratedCAForTests
+      caBundle: XYZ
       service:
         namespace: kuma-system
         name: kuma-control-plane
@@ -1154,7 +1139,7 @@ webhooks:
           operator: NotIn
           values: ["kube-system"]
     clientConfig:
-      caBundle: RedactedGeneratedCAForTests
+      caBundle: XYZ
       service:
         namespace: kuma-system
         name: kuma-control-plane
@@ -1177,7 +1162,7 @@ webhooks:
         kuma.io/system-namespace: "true"
     failurePolicy: Ignore
     clientConfig:
-      caBundle: RedactedGeneratedCAForTests
+      caBundle: XYZ
       service:
         namespace: kuma-system
         name: kuma-control-plane
@@ -1203,7 +1188,7 @@ webhooks:
           operator: NotIn
           values: ["kube-system"]
     clientConfig:
-      caBundle: RedactedGeneratedCAForTests
+      caBundle: XYZ
       service:
         namespace: kuma-system
         name: kuma-control-plane
diff --git a/app/kumactl/cmd/install/testdata/install-cp-helm/fix9324.golden.yaml b/app/kumactl/cmd/install/testdata/install-cp-helm/fix9324.golden.yaml
deleted file mode 100644
index 2297657a5..000000000
--- a/app/kumactl/cmd/install/testdata/install-cp-helm/fix9324.golden.yaml
+++ /dev/null
@@ -1,801 +0,0 @@
-
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: kuma-system
-  labels:
-    kuma.io/system-namespace: "true"
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: kuma-control-plane
-  namespace: kuma-system
-  labels: 
-    app: kuma-control-plane
-    app.kubernetes.io/name: kuma
-    app.kubernetes.io/instance: kuma
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: kuma-control-plane-config
-  namespace: kuma-system
-  labels: 
-    app: kuma-control-plane
-    app.kubernetes.io/name: kuma
-    app.kubernetes.io/instance: kuma
-data:
-  config.yaml: |
-    # use this file to override default configuration of `kuma-cp`
-    #
-    # see conf/kuma-cp.conf.yml for available settings
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: kuma-control-plane
-  labels: 
-    app: kuma-control-plane
-    app.kubernetes.io/name: kuma
-    app.kubernetes.io/instance: kuma
-rules:
-  - apiGroups:
-      - ""
-    resources:
-      - namespaces
-      - pods
-      - configmaps
-      - nodes
-    verbs:
-      - get
-      - list
-      - watch
-  - apiGroups:
-      - "apps"
-    resources:
-      - deployments
-      - replicasets
-    verbs:
-      - create
-      - delete
-      - get
-      - list
-      - patch
-      - update
-      - watch
-  - apiGroups:
-      - "batch"
-    resources:
-      - jobs
-    verbs:
-      - get
-      - list
-      - watch
-  - apiGroups:
-      - gateway.networking.k8s.io
-    resources:
-      - gatewayclasses
-      - gateways
-      - referencegrants
-      - httproutes
-    verbs:
-      - create
-      - delete
-      - get
-      - list
-      - patch
-      - update
-      - watch
-  - apiGroups:
-      - gateway.networking.k8s.io
-    resources:
-      - gatewayclasses/status
-      - gateways/status
-      - httproutes/status
-    verbs:
-      - get
-      - patch
-      - update
-  - apiGroups:
-      - coordination.k8s.io
-    resources:
-      - leases
-    verbs:
-      - get
-      - list
-      - watch
-      - create
-      - update
-      - patch
-      - delete
-  - apiGroups:
-      - ""
-    resources:
-      - events
-    verbs:
-      - create
-      - patch
-  - apiGroups:
-      - ""
-    resources:
-      - services
-    verbs:
-      - get
-      - delete
-      - list
-      - watch
-      - create
-      - update
-      - patch
-  - apiGroups:
-      - kuma.io
-    resources:
-      - dataplanes
-      - dataplaneinsights
-      - meshes
-      - zones
-      - zoneinsights
-      - zoneingresses
-      - zoneingressinsights
-      - zoneegresses
-      - zoneegressinsights
-      - meshinsights
-      - serviceinsights
-      - proxytemplates
-      - ratelimits
-      - trafficpermissions
-      - trafficroutes
-      - timeouts
-      - retries
-      - circuitbreakers
-      - virtualoutbounds
-      - containerpatches
-      - externalservices
-      - faultinjections
-      - healthchecks
-      - trafficlogs
-      - traffictraces
-      - meshgateways
-      - meshgatewayroutes
-      - meshgatewayinstances
-      - meshaccesslogs
-      - meshcircuitbreakers
-      - meshfaultinjections
-      - meshhealthchecks
-      - meshhttproutes
-      - meshloadbalancingstrategies
-      - meshmetrics
-      - meshproxypatches
-      - meshratelimits
-      - meshretries
-      - meshtcproutes
-      - meshtimeouts
-      - meshtraces
-      - meshtrafficpermissions
-      - meshservices
-    verbs:
-      - get
-      - list
-      - watch
-      - create
-      - update
-      - patch
-      - delete
-  - apiGroups:
-      - kuma.io
-    resources:
-      - meshgatewayinstances/status
-      - meshgatewayinstances/finalizers
-      - meshes/finalizers
-      - dataplanes/finalizers
-    verbs:
-      - get
-      - patch
-      - update
-  - apiGroups:
-      - ""
-    resources:
-      - pods/finalizers
-    verbs:
-      - get
-      - patch
-      - update
-  # validate k8s token before issuing mTLS cert
-  - apiGroups:
-      - authentication.k8s.io
-    resources:
-      - tokenreviews
-    verbs:
-      - create
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: kuma-control-plane
-  labels: 
-    app: kuma-control-plane
-    app.kubernetes.io/name: kuma
-    app.kubernetes.io/instance: kuma
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: kuma-control-plane
-subjects:
-  - kind: ServiceAccount
-    name: kuma-control-plane
-    namespace: kuma-system
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: kuma-control-plane
-  namespace: kuma-system
-  labels: 
-    app: kuma-control-plane
-    app.kubernetes.io/name: kuma
-    app.kubernetes.io/instance: kuma
-rules:
-  - apiGroups:
-      - ""
-    resources:
-      - secrets
-    verbs:
-      - get
-      - list
-      - watch
-      - create
-      - update
-      - patch
-      - delete
-  - apiGroups:
-      - ""
-    resources:
-      - configmaps
-    verbs:
-      - get
-      - list
-      - watch
-      - create
-      - update
-      - patch
-      - delete
-  # leader-for-life election deletes Pods in some circumstances
-  - apiGroups:
-      - ""
-    resources:
-      - pods
-    verbs:
-      - delete
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: kuma-control-plane
-  namespace: kuma-system
-  labels: 
-    app: kuma-control-plane
-    app.kubernetes.io/name: kuma
-    app.kubernetes.io/instance: kuma
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: kuma-control-plane
-subjects:
-  - kind: ServiceAccount
-    name: kuma-control-plane
-    namespace: kuma-system
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: kuma-control-plane
-  namespace: kuma-system
-  labels: 
-    app: kuma-control-plane
-    app.kubernetes.io/name: kuma
-    app.kubernetes.io/instance: kuma
-  annotations:
-    prometheus.io/port: "5680"
-    prometheus.io/scrape: "true"
-spec:
-  type: ClusterIP
-  ports:
-    - port: 5680
-      name: diagnostics
-      appProtocol: http
-    - port: 5681
-      name: http-api-server
-      appProtocol: http
-    - port: 5682
-      name: https-api-server
-      appProtocol: https
-    - port: 443
-      name: https-admission-server
-      targetPort: 5443
-      appProtocol: https
-    - port: 5676
-      name: mads-server
-      appProtocol: https
-    - port: 5678
-      name: dp-server
-      appProtocol: https
-  selector:
-    app: kuma-control-plane
-    app.kubernetes.io/name: kuma
-    app.kubernetes.io/instance: kuma
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: kuma-control-plane
-  namespace: kuma-system
-  labels: 
-    app: kuma-control-plane
-    app.kubernetes.io/name: kuma
-    app.kubernetes.io/instance: kuma
-  annotations: 
-    
-spec:
-  replicas: 1
-  minReadySeconds: 0
-  strategy:
-    rollingUpdate:
-      maxSurge: 1
-      maxUnavailable: 0
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: kuma
-      app.kubernetes.io/instance: kuma
-      app: kuma-control-plane
-  template:
-    metadata:
-      annotations:
-        checksum/config: fd9d1d8386f97f2bd49e50f476520816168a1c9f60bbc43dec1347a64d239155
-        checksum/tls-secrets: 5a0917b4af9ccf8a32bf6230b48fb6712df9b2025cff668518cf50caaab0bf24
-      labels: 
-        app: kuma-control-plane
-        app.kubernetes.io/name: kuma
-        app.kubernetes.io/instance: kuma
-    spec:
-      affinity: 
-        podAntiAffinity:
-          preferredDuringSchedulingIgnoredDuringExecution:
-          - podAffinityTerm:
-              labelSelector:
-                matchExpressions:
-                - key: app.kubernetes.io/name
-                  operator: In
-                  values:
-                  - 'kuma'
-                - key: app.kubernetes.io/instance
-                  operator: In
-                  values:
-                  - 'kuma'
-                - key: app
-                  operator: In
-                  values:
-                  - 'kuma-control-plane'
-              topologyKey: kubernetes.io/hostname
-            weight: 100
-      securityContext:
-        runAsNonRoot: true
-      serviceAccountName: kuma-control-plane
-      automountServiceAccountToken: true
-      nodeSelector:
-        
-        kubernetes.io/os: linux
-      hostNetwork: false
-      terminationGracePeriodSeconds: 30
-      containers:
-        - name: control-plane
-          image: "docker.io/kumahq/kuma-cp:0.0.1"
-          imagePullPolicy: IfNotPresent
-          securityContext:
-            readOnlyRootFilesystem: true
-          env:
-            - name: KUMA_API_SERVER_AUTHN_LOCALHOST_IS_ADMIN
-              value: "false"
-            - name: KUMA_API_SERVER_READ_ONLY
-              value: "true"
-            - name: KUMA_DEFAULTS_SKIP_MESH_CREATION
-              value: "false"
-            - name: KUMA_DP_SERVER_HDS_ENABLED
-              value: "false"
-            - name: KUMA_ENVIRONMENT
-              value: "kubernetes"
-            - name: KUMA_GENERAL_TLS_CERT_FILE
-              value: "/var/run/secrets/kuma.io/tls-cert/tls.crt"
-            - name: KUMA_GENERAL_TLS_KEY_FILE
-              value: "/var/run/secrets/kuma.io/tls-cert/tls.key"
-            - name: KUMA_INJECTOR_INIT_CONTAINER_IMAGE
-              value: "docker.io/kumahq/kuma-init:0.0.1"
-            - name: KUMA_MODE
-              value: "zone"
-            - name: KUMA_PLUGIN_POLICIES_ENABLED
-              value: "meshaccesslogs,meshcircuitbreakers,meshfaultinjections,meshhealthchecks,meshhttproutes,meshloadbalancingstrategies,meshmetrics,meshproxypatches,meshratelimits,meshretries,meshtcproutes,meshtimeouts,meshtraces,meshtrafficpermissions"
-            - name: KUMA_RUNTIME_KUBERNETES_ADMISSION_SERVER_CERT_DIR
-              value: "/var/run/secrets/kuma.io/tls-cert"
-            - name: KUMA_RUNTIME_KUBERNETES_ADMISSION_SERVER_PORT
-              value: "5443"
-            - name: KUMA_RUNTIME_KUBERNETES_CONTROL_PLANE_SERVICE_NAME
-              value: "kuma-control-plane"
-            - name: KUMA_RUNTIME_KUBERNETES_INJECTOR_CA_CERT_FILE
-              value: "/var/run/secrets/kuma.io/tls-cert/ca.crt"
-            - name: KUMA_RUNTIME_KUBERNETES_INJECTOR_CNI_ENABLED
-              value: "false"
-            - name: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_IMAGE
-              value: "docker.io/kumahq/kuma-dp:0.0.1"
-            - name: KUMA_RUNTIME_KUBERNETES_SERVICE_ACCOUNT_NAME
-              value: "system:serviceaccount:kuma-system:kuma-control-plane"
-            - name: KUMA_STORE_KUBERNETES_SYSTEM_NAMESPACE
-              value: "kuma-system"
-            - name: KUMA_STORE_TYPE
-              value: "kubernetes"
-            - name: KUMA_INTER_CP_CATALOG_INSTANCE_ADDRESS
-              valueFrom:
-                fieldRef:
-                  fieldPath: status.podIP
-          args:
-            - run
-            - --log-level=info
-            - --log-output-path=
-            - --config-file=/etc/kuma.io/kuma-control-plane/config.yaml
-          ports:
-            - containerPort: 5680
-              name: diagnostics
-              protocol: TCP
-            - containerPort: 5681
-            - containerPort: 5682
-            - containerPort: 5443
-            - containerPort: 5678
-          livenessProbe:
-            timeoutSeconds: 10
-            httpGet:
-              path: /healthy
-              port: 5680
-          readinessProbe:
-            timeoutSeconds: 10
-            httpGet:
-              path: /ready
-              port: 5680
-          resources:
-            limits:
-              memory: 256Mi
-            requests:
-              cpu: 500m
-              memory: 256Mi
-          
-          volumeMounts:
-            - name: general-tls-cert
-              mountPath: /var/run/secrets/kuma.io/tls-cert/tls.crt
-              subPath: tls.crt
-              readOnly: true
-            - name: general-tls-cert
-              mountPath: /var/run/secrets/kuma.io/tls-cert/tls.key
-              subPath: tls.key
-              readOnly: true
-            - name: general-tls-cert
-              mountPath: /var/run/secrets/kuma.io/tls-cert/ca.crt
-              subPath: ca.crt
-              readOnly: true
-            - name: kuma-control-plane-config
-              mountPath: /etc/kuma.io/kuma-control-plane
-              readOnly: true
-            - name: tmp
-              mountPath: /tmp
-      volumes:
-        - name: general-tls-cert
-          secret:
-            secretName: my-custom-ca-name
-        - name: kuma-control-plane-config
-          configMap:
-            name: kuma-control-plane-config
-        - name: tmp
-          emptyDir: {}
----
-apiVersion: admissionregistration.k8s.io/v1
-kind: MutatingWebhookConfiguration
-metadata:
-  name: kuma-admission-mutating-webhook-configuration
-  namespace: kuma-system
-  labels: 
-    app: kuma-control-plane
-    app.kubernetes.io/name: kuma
-    app.kubernetes.io/instance: kuma
-webhooks:
-  - name: mesh.defaulter.kuma-admission.kuma.io
-    admissionReviewVersions: ["v1"]
-    failurePolicy: Fail
-    namespaceSelector:
-      matchExpressions:
-        - key: kubernetes.io/metadata.name
-          operator: NotIn
-          values: ["kube-system"]
-    clientConfig:
-      caBundle: XYZ
-      service:
-        namespace: kuma-system
-        name: kuma-control-plane
-        path: /default-kuma-io-v1alpha1-mesh
-    rules:
-      - apiGroups:
-          - kuma.io
-        apiVersions:
-          - v1alpha1
-        operations:
-          - CREATE
-          - UPDATE
-        resources:
-          - meshes
-          - meshaccesslogs
-          - meshcircuitbreakers
-          - meshfaultinjections
-          - meshhealthchecks
-          - meshhttproutes
-          - meshloadbalancingstrategies
-          - meshmetrics
-          - meshproxypatches
-          - meshratelimits
-          - meshretries
-          - meshtcproutes
-          - meshtimeouts
-          - meshtraces
-          - meshtrafficpermissions
-          - meshservices
-    sideEffects: None
-  - name: owner-reference.kuma-admission.kuma.io
-    admissionReviewVersions: ["v1"]
-    failurePolicy: Fail
-    namespaceSelector:
-      matchExpressions:
-        - key: kubernetes.io/metadata.name
-          operator: NotIn
-          values: ["kube-system"]
-    clientConfig:
-      caBundle: XYZ
-      service:
-        namespace: kuma-system
-        name: kuma-control-plane
-        path: /owner-reference-kuma-io-v1alpha1
-    rules:
-      - apiGroups:
-          - kuma.io
-        apiVersions:
-          - v1alpha1
-        operations:
-          - CREATE
-        resources:
-          - circuitbreakers
-          - externalservices
-          - faultinjections
-          - healthchecks
-          - meshgateways
-          - meshgatewayroutes
-          - proxytemplates
-          - ratelimits
-          - retries
-          - timeouts
-          - trafficlogs
-          - trafficpermissions
-          - trafficroutes
-          - traffictraces
-          - virtualoutbounds
-          - meshaccesslogs
-          - meshcircuitbreakers
-          - meshfaultinjections
-          - meshhealthchecks
-          - meshhttproutes
-          - meshloadbalancingstrategies
-          - meshmetrics
-          - meshproxypatches
-          - meshratelimits
-          - meshretries
-          - meshtcproutes
-          - meshtimeouts
-          - meshtraces
-          - meshtrafficpermissions
-          - meshservices
-  
-      
-    sideEffects: None
-  - name: namespace-kuma-injector.kuma.io
-    admissionReviewVersions: ["v1"]
-    failurePolicy: Fail
-    namespaceSelector:
-      matchExpressions:
-        - key: kubernetes.io/metadata.name
-          operator: NotIn
-          values: ["kube-system"]
-        - key: kuma.io/sidecar-injection
-          operator: In
-          values: ["enabled", "true"]
-    clientConfig:
-      caBundle: XYZ
-      service:
-        namespace: kuma-system
-        name: kuma-control-plane
-        path: /inject-sidecar
-    rules:
-      - apiGroups:
-          - ""
-        apiVersions:
-          - v1
-        operations:
-          - CREATE
-        resources:
-          - pods
-    sideEffects: None
-  - name: pods-kuma-injector.kuma.io
-    admissionReviewVersions: ["v1"]
-    failurePolicy: Fail
-    namespaceSelector:
-      matchExpressions:
-        - key: kubernetes.io/metadata.name
-          operator: NotIn
-          values: ["kube-system"]
-    objectSelector:
-      matchLabels:
-        kuma.io/sidecar-injection: enabled
-    clientConfig:
-      caBundle: XYZ
-      service:
-        namespace: kuma-system
-        name: kuma-control-plane
-        path: /inject-sidecar
-    rules:
-      - apiGroups:
-          - ""
-        apiVersions:
-          - v1
-        operations:
-          - CREATE
-        resources:
-          - pods
-    sideEffects: None
----
-apiVersion: admissionregistration.k8s.io/v1
-kind: ValidatingWebhookConfiguration
-metadata:
-  name: kuma-validating-webhook-configuration
-  namespace: kuma-system
-  labels: 
-    app: kuma-control-plane
-    app.kubernetes.io/name: kuma
-    app.kubernetes.io/instance: kuma
-webhooks:
-  - name: validator.kuma-admission.kuma.io
-    admissionReviewVersions: ["v1"]
-    failurePolicy: Fail
-    namespaceSelector:
-      matchExpressions:
-        - key: kubernetes.io/metadata.name
-          operator: NotIn
-          values: ["kube-system"]
-    clientConfig:
-      caBundle: XYZ
-      service:
-        namespace: kuma-system
-        name: kuma-control-plane
-        path: /validate-kuma-io-v1alpha1
-    rules:
-      - apiGroups:
-          - kuma.io
-        apiVersions:
-          - v1alpha1
-        operations:
-          - CREATE
-          - UPDATE
-          - DELETE
-        resources:
-          - circuitbreakers
-          - dataplanes
-          - externalservices
-          - faultinjections
-          - gatewayinstances
-          - healthchecks
-          - meshes
-          - meshgateways
-          - meshgatewayroutes
-          - proxytemplates
-          - ratelimits
-          - retries
-          - trafficlogs
-          - trafficpermissions
-          - trafficroutes
-          - traffictraces
-          - virtualoutbounds
-          - zones
-          - containerpatches
-          - meshaccesslogs
-          - meshcircuitbreakers
-          - meshfaultinjections
-          - meshhealthchecks
-          - meshhttproutes
-          - meshloadbalancingstrategies
-          - meshmetrics
-          - meshproxypatches
-          - meshratelimits
-          - meshretries
-          - meshtcproutes
-          - meshtimeouts
-          - meshtraces
-          - meshtrafficpermissions
-          - meshservices
-    
-      
-    sideEffects: None
-  - name: service.validator.kuma-admission.kuma.io
-    admissionReviewVersions: ["v1"]
-    failurePolicy: Ignore
-    namespaceSelector:
-      matchExpressions:
-        - key: kubernetes.io/metadata.name
-          operator: NotIn
-          values: ["kube-system"]
-    clientConfig:
-      caBundle: XYZ
-      service:
-        namespace: kuma-system
-        name: kuma-control-plane
-        path: /validate-v1-service
-    rules:
-      - apiGroups:
-          - ""
-        apiVersions:
-          - v1
-        operations:
-          - CREATE
-          - UPDATE
-        resources:
-          - services
-    sideEffects: None
-  - name: secret.validator.kuma-admission.kuma.io
-    admissionReviewVersions: ["v1"]
-    namespaceSelector:
-      matchLabels:
-        kuma.io/system-namespace: "true"
-    failurePolicy: Ignore
-    clientConfig:
-      caBundle: XYZ
-      service:
-        namespace: kuma-system
-        name: kuma-control-plane
-        path: /validate-v1-secret
-    rules:
-      - apiGroups:
-          - ""
-        apiVersions:
-          - v1
-        operations:
-          - CREATE
-          - UPDATE
-          - DELETE
-        resources:
-          - secrets
-    sideEffects: None
-  - name: gateway.validator.kuma-admission.kuma.io
-    admissionReviewVersions: ["v1"]
-    failurePolicy: Ignore
-    namespaceSelector:
-      matchExpressions:
-        - key: kubernetes.io/metadata.name
-          operator: NotIn
-          values: ["kube-system"]
-    clientConfig:
-      caBundle: XYZ
-      service:
-        namespace: kuma-system
-        name: kuma-control-plane
-        path: /validate-gatewayclass
-    rules:
-      - apiGroups:
-          - "gateway.networking.k8s.io"
-        apiVersions:
-          - v1beta1
-        operations:
-          - CREATE
-        resources:
-          - gatewayclasses
-    sideEffects: None
diff --git a/app/kumactl/cmd/install/testdata/install-cp-helm/fix9324.values.yaml b/app/kumactl/cmd/install/testdata/install-cp-helm/fix9324.values.yaml
deleted file mode 100644
index 7c9f6d92b..000000000
--- a/app/kumactl/cmd/install/testdata/install-cp-helm/fix9324.values.yaml
+++ /dev/null
@@ -1,5 +0,0 @@
-controlPlane:
-  tls:
-    general:
-      secretName: my-custom-ca-name
-      caBundle: XYZ
diff --git a/app/kumactl/cmd/install/testdata/install-cp-helm/fix9324_systemCA.golden.yaml b/app/kumactl/cmd/install/testdata/install-cp-helm/fix9324_systemCA.golden.yaml
deleted file mode 100644
index 1bcb6633d..000000000
--- a/app/kumactl/cmd/install/testdata/install-cp-helm/fix9324_systemCA.golden.yaml
+++ /dev/null
@@ -1,795 +0,0 @@
-
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: kuma-system
-  labels:
-    kuma.io/system-namespace: "true"
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: kuma-control-plane
-  namespace: kuma-system
-  labels: 
-    app: kuma-control-plane
-    app.kubernetes.io/name: kuma
-    app.kubernetes.io/instance: kuma
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: kuma-control-plane-config
-  namespace: kuma-system
-  labels: 
-    app: kuma-control-plane
-    app.kubernetes.io/name: kuma
-    app.kubernetes.io/instance: kuma
-data:
-  config.yaml: |
-    # use this file to override default configuration of `kuma-cp`
-    #
-    # see conf/kuma-cp.conf.yml for available settings
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: kuma-control-plane
-  labels: 
-    app: kuma-control-plane
-    app.kubernetes.io/name: kuma
-    app.kubernetes.io/instance: kuma
-rules:
-  - apiGroups:
-      - ""
-    resources:
-      - namespaces
-      - pods
-      - configmaps
-      - nodes
-    verbs:
-      - get
-      - list
-      - watch
-  - apiGroups:
-      - "apps"
-    resources:
-      - deployments
-      - replicasets
-    verbs:
-      - create
-      - delete
-      - get
-      - list
-      - patch
-      - update
-      - watch
-  - apiGroups:
-      - "batch"
-    resources:
-      - jobs
-    verbs:
-      - get
-      - list
-      - watch
-  - apiGroups:
-      - gateway.networking.k8s.io
-    resources:
-      - gatewayclasses
-      - gateways
-      - referencegrants
-      - httproutes
-    verbs:
-      - create
-      - delete
-      - get
-      - list
-      - patch
-      - update
-      - watch
-  - apiGroups:
-      - gateway.networking.k8s.io
-    resources:
-      - gatewayclasses/status
-      - gateways/status
-      - httproutes/status
-    verbs:
-      - get
-      - patch
-      - update
-  - apiGroups:
-      - coordination.k8s.io
-    resources:
-      - leases
-    verbs:
-      - get
-      - list
-      - watch
-      - create
-      - update
-      - patch
-      - delete
-  - apiGroups:
-      - ""
-    resources:
-      - events
-    verbs:
-      - create
-      - patch
-  - apiGroups:
-      - ""
-    resources:
-      - services
-    verbs:
-      - get
-      - delete
-      - list
-      - watch
-      - create
-      - update
-      - patch
-  - apiGroups:
-      - kuma.io
-    resources:
-      - dataplanes
-      - dataplaneinsights
-      - meshes
-      - zones
-      - zoneinsights
-      - zoneingresses
-      - zoneingressinsights
-      - zoneegresses
-      - zoneegressinsights
-      - meshinsights
-      - serviceinsights
-      - proxytemplates
-      - ratelimits
-      - trafficpermissions
-      - trafficroutes
-      - timeouts
-      - retries
-      - circuitbreakers
-      - virtualoutbounds
-      - containerpatches
-      - externalservices
-      - faultinjections
-      - healthchecks
-      - trafficlogs
-      - traffictraces
-      - meshgateways
-      - meshgatewayroutes
-      - meshgatewayinstances
-      - meshaccesslogs
-      - meshcircuitbreakers
-      - meshfaultinjections
-      - meshhealthchecks
-      - meshhttproutes
-      - meshloadbalancingstrategies
-      - meshmetrics
-      - meshproxypatches
-      - meshratelimits
-      - meshretries
-      - meshtcproutes
-      - meshtimeouts
-      - meshtraces
-      - meshtrafficpermissions
-      - meshservices
-    verbs:
-      - get
-      - list
-      - watch
-      - create
-      - update
-      - patch
-      - delete
-  - apiGroups:
-      - kuma.io
-    resources:
-      - meshgatewayinstances/status
-      - meshgatewayinstances/finalizers
-      - meshes/finalizers
-      - dataplanes/finalizers
-    verbs:
-      - get
-      - patch
-      - update
-  - apiGroups:
-      - ""
-    resources:
-      - pods/finalizers
-    verbs:
-      - get
-      - patch
-      - update
-  # validate k8s token before issuing mTLS cert
-  - apiGroups:
-      - authentication.k8s.io
-    resources:
-      - tokenreviews
-    verbs:
-      - create
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: kuma-control-plane
-  labels: 
-    app: kuma-control-plane
-    app.kubernetes.io/name: kuma
-    app.kubernetes.io/instance: kuma
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: kuma-control-plane
-subjects:
-  - kind: ServiceAccount
-    name: kuma-control-plane
-    namespace: kuma-system
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: kuma-control-plane
-  namespace: kuma-system
-  labels: 
-    app: kuma-control-plane
-    app.kubernetes.io/name: kuma
-    app.kubernetes.io/instance: kuma
-rules:
-  - apiGroups:
-      - ""
-    resources:
-      - secrets
-    verbs:
-      - get
-      - list
-      - watch
-      - create
-      - update
-      - patch
-      - delete
-  - apiGroups:
-      - ""
-    resources:
-      - configmaps
-    verbs:
-      - get
-      - list
-      - watch
-      - create
-      - update
-      - patch
-      - delete
-  # leader-for-life election deletes Pods in some circumstances
-  - apiGroups:
-      - ""
-    resources:
-      - pods
-    verbs:
-      - delete
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: kuma-control-plane
-  namespace: kuma-system
-  labels: 
-    app: kuma-control-plane
-    app.kubernetes.io/name: kuma
-    app.kubernetes.io/instance: kuma
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: kuma-control-plane
-subjects:
-  - kind: ServiceAccount
-    name: kuma-control-plane
-    namespace: kuma-system
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: kuma-control-plane
-  namespace: kuma-system
-  labels: 
-    app: kuma-control-plane
-    app.kubernetes.io/name: kuma
-    app.kubernetes.io/instance: kuma
-  annotations:
-    prometheus.io/port: "5680"
-    prometheus.io/scrape: "true"
-spec:
-  type: ClusterIP
-  ports:
-    - port: 5680
-      name: diagnostics
-      appProtocol: http
-    - port: 5681
-      name: http-api-server
-      appProtocol: http
-    - port: 5682
-      name: https-api-server
-      appProtocol: https
-    - port: 443
-      name: https-admission-server
-      targetPort: 5443
-      appProtocol: https
-    - port: 5676
-      name: mads-server
-      appProtocol: https
-    - port: 5678
-      name: dp-server
-      appProtocol: https
-  selector:
-    app: kuma-control-plane
-    app.kubernetes.io/name: kuma
-    app.kubernetes.io/instance: kuma
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: kuma-control-plane
-  namespace: kuma-system
-  labels: 
-    app: kuma-control-plane
-    app.kubernetes.io/name: kuma
-    app.kubernetes.io/instance: kuma
-  annotations: 
-    
-spec:
-  replicas: 1
-  minReadySeconds: 0
-  strategy:
-    rollingUpdate:
-      maxSurge: 1
-      maxUnavailable: 0
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: kuma
-      app.kubernetes.io/instance: kuma
-      app: kuma-control-plane
-  template:
-    metadata:
-      annotations:
-        checksum/config: fd9d1d8386f97f2bd49e50f476520816168a1c9f60bbc43dec1347a64d239155
-        checksum/tls-secrets: 4ec26ebed3dd08afc61f4d5bf1d8241b1166a25695d573f55cfea73ddab79bf1
-      labels: 
-        app: kuma-control-plane
-        app.kubernetes.io/name: kuma
-        app.kubernetes.io/instance: kuma
-    spec:
-      affinity: 
-        podAntiAffinity:
-          preferredDuringSchedulingIgnoredDuringExecution:
-          - podAffinityTerm:
-              labelSelector:
-                matchExpressions:
-                - key: app.kubernetes.io/name
-                  operator: In
-                  values:
-                  - 'kuma'
-                - key: app.kubernetes.io/instance
-                  operator: In
-                  values:
-                  - 'kuma'
-                - key: app
-                  operator: In
-                  values:
-                  - 'kuma-control-plane'
-              topologyKey: kubernetes.io/hostname
-            weight: 100
-      securityContext:
-        runAsNonRoot: true
-      serviceAccountName: kuma-control-plane
-      automountServiceAccountToken: true
-      nodeSelector:
-        
-        kubernetes.io/os: linux
-      hostNetwork: false
-      terminationGracePeriodSeconds: 30
-      containers:
-        - name: control-plane
-          image: "docker.io/kumahq/kuma-cp:0.0.1"
-          imagePullPolicy: IfNotPresent
-          securityContext:
-            readOnlyRootFilesystem: true
-          env:
-            - name: KUMA_API_SERVER_AUTHN_LOCALHOST_IS_ADMIN
-              value: "false"
-            - name: KUMA_API_SERVER_READ_ONLY
-              value: "true"
-            - name: KUMA_DEFAULTS_SKIP_MESH_CREATION
-              value: "false"
-            - name: KUMA_DP_SERVER_HDS_ENABLED
-              value: "false"
-            - name: KUMA_ENVIRONMENT
-              value: "kubernetes"
-            - name: KUMA_GENERAL_TLS_CERT_FILE
-              value: "/var/run/secrets/kuma.io/tls-cert/tls.crt"
-            - name: KUMA_GENERAL_TLS_KEY_FILE
-              value: "/var/run/secrets/kuma.io/tls-cert/tls.key"
-            - name: KUMA_INJECTOR_INIT_CONTAINER_IMAGE
-              value: "docker.io/kumahq/kuma-init:0.0.1"
-            - name: KUMA_MODE
-              value: "zone"
-            - name: KUMA_PLUGIN_POLICIES_ENABLED
-              value: "meshaccesslogs,meshcircuitbreakers,meshfaultinjections,meshhealthchecks,meshhttproutes,meshloadbalancingstrategies,meshmetrics,meshproxypatches,meshratelimits,meshretries,meshtcproutes,meshtimeouts,meshtraces,meshtrafficpermissions"
-            - name: KUMA_RUNTIME_KUBERNETES_ADMISSION_SERVER_CERT_DIR
-              value: "/var/run/secrets/kuma.io/tls-cert"
-            - name: KUMA_RUNTIME_KUBERNETES_ADMISSION_SERVER_PORT
-              value: "5443"
-            - name: KUMA_RUNTIME_KUBERNETES_CONTROL_PLANE_SERVICE_NAME
-              value: "kuma-control-plane"
-            - name: KUMA_RUNTIME_KUBERNETES_INJECTOR_CNI_ENABLED
-              value: "false"
-            - name: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_IMAGE
-              value: "docker.io/kumahq/kuma-dp:0.0.1"
-            - name: KUMA_RUNTIME_KUBERNETES_SERVICE_ACCOUNT_NAME
-              value: "system:serviceaccount:kuma-system:kuma-control-plane"
-            - name: KUMA_STORE_KUBERNETES_SYSTEM_NAMESPACE
-              value: "kuma-system"
-            - name: KUMA_STORE_TYPE
-              value: "kubernetes"
-            - name: KUMA_INTER_CP_CATALOG_INSTANCE_ADDRESS
-              valueFrom:
-                fieldRef:
-                  fieldPath: status.podIP
-          args:
-            - run
-            - --log-level=info
-            - --log-output-path=
-            - --config-file=/etc/kuma.io/kuma-control-plane/config.yaml
-          ports:
-            - containerPort: 5680
-              name: diagnostics
-              protocol: TCP
-            - containerPort: 5681
-            - containerPort: 5682
-            - containerPort: 5443
-            - containerPort: 5678
-          livenessProbe:
-            timeoutSeconds: 10
-            httpGet:
-              path: /healthy
-              port: 5680
-          readinessProbe:
-            timeoutSeconds: 10
-            httpGet:
-              path: /ready
-              port: 5680
-          resources:
-            limits:
-              memory: 256Mi
-            requests:
-              cpu: 500m
-              memory: 256Mi
-          
-          volumeMounts:
-            - name: general-tls-cert
-              mountPath: /var/run/secrets/kuma.io/tls-cert/tls.crt
-              subPath: tls.crt
-              readOnly: true
-            - name: general-tls-cert
-              mountPath: /var/run/secrets/kuma.io/tls-cert/tls.key
-              subPath: tls.key
-              readOnly: true
-            - name: kuma-control-plane-config
-              mountPath: /etc/kuma.io/kuma-control-plane
-              readOnly: true
-            - name: tmp
-              mountPath: /tmp
-      volumes:
-        - name: general-tls-cert
-          secret:
-            secretName: my-custom-cert-name
-        - name: kuma-control-plane-config
-          configMap:
-            name: kuma-control-plane-config
-        - name: tmp
-          emptyDir: {}
----
-apiVersion: admissionregistration.k8s.io/v1
-kind: MutatingWebhookConfiguration
-metadata:
-  name: kuma-admission-mutating-webhook-configuration
-  namespace: kuma-system
-  labels: 
-    app: kuma-control-plane
-    app.kubernetes.io/name: kuma
-    app.kubernetes.io/instance: kuma
-webhooks:
-  - name: mesh.defaulter.kuma-admission.kuma.io
-    admissionReviewVersions: ["v1"]
-    failurePolicy: Fail
-    namespaceSelector:
-      matchExpressions:
-        - key: kubernetes.io/metadata.name
-          operator: NotIn
-          values: ["kube-system"]
-    clientConfig:
-      
-      service:
-        namespace: kuma-system
-        name: kuma-control-plane
-        path: /default-kuma-io-v1alpha1-mesh
-    rules:
-      - apiGroups:
-          - kuma.io
-        apiVersions:
-          - v1alpha1
-        operations:
-          - CREATE
-          - UPDATE
-        resources:
-          - meshes
-          - meshaccesslogs
-          - meshcircuitbreakers
-          - meshfaultinjections
-          - meshhealthchecks
-          - meshhttproutes
-          - meshloadbalancingstrategies
-          - meshmetrics
-          - meshproxypatches
-          - meshratelimits
-          - meshretries
-          - meshtcproutes
-          - meshtimeouts
-          - meshtraces
-          - meshtrafficpermissions
-          - meshservices
-    sideEffects: None
-  - name: owner-reference.kuma-admission.kuma.io
-    admissionReviewVersions: ["v1"]
-    failurePolicy: Fail
-    namespaceSelector:
-      matchExpressions:
-        - key: kubernetes.io/metadata.name
-          operator: NotIn
-          values: ["kube-system"]
-    clientConfig:
-      
-      service:
-        namespace: kuma-system
-        name: kuma-control-plane
-        path: /owner-reference-kuma-io-v1alpha1
-    rules:
-      - apiGroups:
-          - kuma.io
-        apiVersions:
-          - v1alpha1
-        operations:
-          - CREATE
-        resources:
-          - circuitbreakers
-          - externalservices
-          - faultinjections
-          - healthchecks
-          - meshgateways
-          - meshgatewayroutes
-          - proxytemplates
-          - ratelimits
-          - retries
-          - timeouts
-          - trafficlogs
-          - trafficpermissions
-          - trafficroutes
-          - traffictraces
-          - virtualoutbounds
-          - meshaccesslogs
-          - meshcircuitbreakers
-          - meshfaultinjections
-          - meshhealthchecks
-          - meshhttproutes
-          - meshloadbalancingstrategies
-          - meshmetrics
-          - meshproxypatches
-          - meshratelimits
-          - meshretries
-          - meshtcproutes
-          - meshtimeouts
-          - meshtraces
-          - meshtrafficpermissions
-          - meshservices
-  
-      
-    sideEffects: None
-  - name: namespace-kuma-injector.kuma.io
-    admissionReviewVersions: ["v1"]
-    failurePolicy: Fail
-    namespaceSelector:
-      matchExpressions:
-        - key: kubernetes.io/metadata.name
-          operator: NotIn
-          values: ["kube-system"]
-        - key: kuma.io/sidecar-injection
-          operator: In
-          values: ["enabled", "true"]
-    clientConfig:
-      
-      service:
-        namespace: kuma-system
-        name: kuma-control-plane
-        path: /inject-sidecar
-    rules:
-      - apiGroups:
-          - ""
-        apiVersions:
-          - v1
-        operations:
-          - CREATE
-        resources:
-          - pods
-    sideEffects: None
-  - name: pods-kuma-injector.kuma.io
-    admissionReviewVersions: ["v1"]
-    failurePolicy: Fail
-    namespaceSelector:
-      matchExpressions:
-        - key: kubernetes.io/metadata.name
-          operator: NotIn
-          values: ["kube-system"]
-    objectSelector:
-      matchLabels:
-        kuma.io/sidecar-injection: enabled
-    clientConfig:
-      
-      service:
-        namespace: kuma-system
-        name: kuma-control-plane
-        path: /inject-sidecar
-    rules:
-      - apiGroups:
-          - ""
-        apiVersions:
-          - v1
-        operations:
-          - CREATE
-        resources:
-          - pods
-    sideEffects: None
----
-apiVersion: admissionregistration.k8s.io/v1
-kind: ValidatingWebhookConfiguration
-metadata:
-  name: kuma-validating-webhook-configuration
-  namespace: kuma-system
-  labels: 
-    app: kuma-control-plane
-    app.kubernetes.io/name: kuma
-    app.kubernetes.io/instance: kuma
-webhooks:
-  - name: validator.kuma-admission.kuma.io
-    admissionReviewVersions: ["v1"]
-    failurePolicy: Fail
-    namespaceSelector:
-      matchExpressions:
-        - key: kubernetes.io/metadata.name
-          operator: NotIn
-          values: ["kube-system"]
-    clientConfig:
-      
-      service:
-        namespace: kuma-system
-        name: kuma-control-plane
-        path: /validate-kuma-io-v1alpha1
-    rules:
-      - apiGroups:
-          - kuma.io
-        apiVersions:
-          - v1alpha1
-        operations:
-          - CREATE
-          - UPDATE
-          - DELETE
-        resources:
-          - circuitbreakers
-          - dataplanes
-          - externalservices
-          - faultinjections
-          - gatewayinstances
-          - healthchecks
-          - meshes
-          - meshgateways
-          - meshgatewayroutes
-          - proxytemplates
-          - ratelimits
-          - retries
-          - trafficlogs
-          - trafficpermissions
-          - trafficroutes
-          - traffictraces
-          - virtualoutbounds
-          - zones
-          - containerpatches
-          - meshaccesslogs
-          - meshcircuitbreakers
-          - meshfaultinjections
-          - meshhealthchecks
-          - meshhttproutes
-          - meshloadbalancingstrategies
-          - meshmetrics
-          - meshproxypatches
-          - meshratelimits
-          - meshretries
-          - meshtcproutes
-          - meshtimeouts
-          - meshtraces
-          - meshtrafficpermissions
-          - meshservices
-    
-      
-    sideEffects: None
-  - name: service.validator.kuma-admission.kuma.io
-    admissionReviewVersions: ["v1"]
-    failurePolicy: Ignore
-    namespaceSelector:
-      matchExpressions:
-        - key: kubernetes.io/metadata.name
-          operator: NotIn
-          values: ["kube-system"]
-    clientConfig:
-      
-      service:
-        namespace: kuma-system
-        name: kuma-control-plane
-        path: /validate-v1-service
-    rules:
-      - apiGroups:
-          - ""
-        apiVersions:
-          - v1
-        operations:
-          - CREATE
-          - UPDATE
-        resources:
-          - services
-    sideEffects: None
-  - name: secret.validator.kuma-admission.kuma.io
-    admissionReviewVersions: ["v1"]
-    namespaceSelector:
-      matchLabels:
-        kuma.io/system-namespace: "true"
-    failurePolicy: Ignore
-    clientConfig:
-      
-      service:
-        namespace: kuma-system
-        name: kuma-control-plane
-        path: /validate-v1-secret
-    rules:
-      - apiGroups:
-          - ""
-        apiVersions:
-          - v1
-        operations:
-          - CREATE
-          - UPDATE
-          - DELETE
-        resources:
-          - secrets
-    sideEffects: None
-  - name: gateway.validator.kuma-admission.kuma.io
-    admissionReviewVersions: ["v1"]
-    failurePolicy: Ignore
-    namespaceSelector:
-      matchExpressions:
-        - key: kubernetes.io/metadata.name
-          operator: NotIn
-          values: ["kube-system"]
-    clientConfig:
-      
-      service:
-        namespace: kuma-system
-        name: kuma-control-plane
-        path: /validate-gatewayclass
-    rules:
-      - apiGroups:
-          - "gateway.networking.k8s.io"
-        apiVersions:
-          - v1beta1
-        operations:
-          - CREATE
-        resources:
-          - gatewayclasses
-    sideEffects: None
diff --git a/app/kumactl/cmd/install/testdata/install-cp-helm/fix9324_systemCA.values.yaml b/app/kumactl/cmd/install/testdata/install-cp-helm/fix9324_systemCA.values.yaml
deleted file mode 100644
index 588df6186..000000000
--- a/app/kumactl/cmd/install/testdata/install-cp-helm/fix9324_systemCA.values.yaml
+++ /dev/null
@@ -1,5 +0,0 @@
-controlPlane:
-  tls:
-    general:
-      secretName: my-custom-cert-name
-      useSystemCA: true
diff --git a/app/kumactl/cmd/install/testdata/install-cp-helm/minReadySeconds.golden.yaml b/app/kumactl/cmd/install/testdata/install-cp-helm/minReadySeconds.golden.yaml
index fe434fdb2..3918bdbaf 100644
--- a/app/kumactl/cmd/install/testdata/install-cp-helm/minReadySeconds.golden.yaml
+++ b/app/kumactl/cmd/install/testdata/install-cp-helm/minReadySeconds.golden.yaml
@@ -18,21 +18,6 @@ metadata:
     app.kubernetes.io/instance: kuma
 ---
 apiVersion: v1
-kind: Secret
-type: kubernetes.io/tls
-metadata:
-  name: kuma-tls-cert
-  namespace: kuma-system
-  labels: 
-    app: kuma-control-plane
-    app.kubernetes.io/name: kuma
-    app.kubernetes.io/instance: kuma
-data:
-  tls.crt: RedactedGeneratedCertForTests
-  tls.key: RedactedGeneratedCertKeyForTests
-  ca.crt: RedactedGeneratedCAForTests
----
-apiVersion: v1
 kind: ConfigMap
 metadata:
   name: kuma-control-plane-config
@@ -368,7 +353,7 @@ spec:
     metadata:
       annotations:
         checksum/config: fd9d1d8386f97f2bd49e50f476520816168a1c9f60bbc43dec1347a64d239155
-        checksum/tls-secrets: 8586a7997e2e6b7bbe3337e256dc3ee22f1e06cb578d53591a6735e154001a2c
+        checksum/tls-secrets: 55df76c297436a96c281fa360f359938237859b33236d52399c3c877d6154285
       labels: 
         app: kuma-control-plane
         app.kubernetes.io/name: kuma
@@ -503,7 +488,7 @@ spec:
       volumes:
         - name: general-tls-cert
           secret:
-            secretName: kuma-tls-cert
+            secretName: general-tls-secret
         - name: kuma-control-plane-config
           configMap:
             name: kuma-control-plane-config
@@ -529,7 +514,7 @@ webhooks:
           operator: NotIn
           values: ["kube-system"]
     clientConfig:
-      caBundle: RedactedGeneratedCAForTests
+      caBundle: XYZ
       service:
         namespace: kuma-system
         name: kuma-control-plane
@@ -569,7 +554,7 @@ webhooks:
           operator: NotIn
           values: ["kube-system"]
     clientConfig:
-      caBundle: RedactedGeneratedCAForTests
+      caBundle: XYZ
       service:
         namespace: kuma-system
         name: kuma-control-plane
@@ -627,7 +612,7 @@ webhooks:
           operator: In
           values: ["enabled", "true"]
     clientConfig:
-      caBundle: RedactedGeneratedCAForTests
+      caBundle: XYZ
       service:
         namespace: kuma-system
         name: kuma-control-plane
@@ -654,7 +639,7 @@ webhooks:
       matchLabels:
         kuma.io/sidecar-injection: enabled
     clientConfig:
-      caBundle: RedactedGeneratedCAForTests
+      caBundle: XYZ
       service:
         namespace: kuma-system
         name: kuma-control-plane
@@ -689,7 +674,7 @@ webhooks:
           operator: NotIn
           values: ["kube-system"]
     clientConfig:
-      caBundle: RedactedGeneratedCAForTests
+      caBundle: XYZ
       service:
         namespace: kuma-system
         name: kuma-control-plane
@@ -750,7 +735,7 @@ webhooks:
           operator: NotIn
           values: ["kube-system"]
     clientConfig:
-      caBundle: RedactedGeneratedCAForTests
+      caBundle: XYZ
       service:
         namespace: kuma-system
         name: kuma-control-plane
@@ -773,7 +758,7 @@ webhooks:
         kuma.io/system-namespace: "true"
     failurePolicy: Ignore
     clientConfig:
-      caBundle: RedactedGeneratedCAForTests
+      caBundle: XYZ
       service:
         namespace: kuma-system
         name: kuma-control-plane
@@ -799,7 +784,7 @@ webhooks:
           operator: NotIn
           values: ["kube-system"]
     clientConfig:
-      caBundle: RedactedGeneratedCAForTests
+      caBundle: XYZ
       service:
         namespace: kuma-system
         name: kuma-control-plane
diff --git a/app/kumactl/cmd/install/testdata/install-cp-helm/securityContext.golden.yaml b/app/kumactl/cmd/install/testdata/install-cp-helm/securityContext.golden.yaml
index 5104b19b7..56f507495 100644
--- a/app/kumactl/cmd/install/testdata/install-cp-helm/securityContext.golden.yaml
+++ b/app/kumactl/cmd/install/testdata/install-cp-helm/securityContext.golden.yaml
@@ -18,21 +18,6 @@ metadata:
     app.kubernetes.io/instance: kuma
 ---
 apiVersion: v1
-kind: Secret
-type: kubernetes.io/tls
-metadata:
-  name: kuma-tls-cert
-  namespace: kuma-system
-  labels: 
-    app: kuma-control-plane
-    app.kubernetes.io/name: kuma
-    app.kubernetes.io/instance: kuma
-data:
-  tls.crt: RedactedGeneratedCertForTests
-  tls.key: RedactedGeneratedCertKeyForTests
-  ca.crt: RedactedGeneratedCAForTests
----
-apiVersion: v1
 kind: ConfigMap
 metadata:
   name: kuma-control-plane-config
@@ -368,7 +353,7 @@ spec:
     metadata:
       annotations:
         checksum/config: fd9d1d8386f97f2bd49e50f476520816168a1c9f60bbc43dec1347a64d239155
-        checksum/tls-secrets: 8586a7997e2e6b7bbe3337e256dc3ee22f1e06cb578d53591a6735e154001a2c
+        checksum/tls-secrets: 55df76c297436a96c281fa360f359938237859b33236d52399c3c877d6154285
       labels: 
         app: kuma-control-plane
         app.kubernetes.io/name: kuma
@@ -504,7 +489,7 @@ spec:
       volumes:
         - name: general-tls-cert
           secret:
-            secretName: kuma-tls-cert
+            secretName: general-tls-secret
         - name: kuma-control-plane-config
           configMap:
             name: kuma-control-plane-config
@@ -530,7 +515,7 @@ webhooks:
           operator: NotIn
           values: ["kube-system"]
     clientConfig:
-      caBundle: RedactedGeneratedCAForTests
+      caBundle: XYZ
       service:
         namespace: kuma-system
         name: kuma-control-plane
@@ -570,7 +555,7 @@ webhooks:
           operator: NotIn
           values: ["kube-system"]
     clientConfig:
-      caBundle: RedactedGeneratedCAForTests
+      caBundle: XYZ
       service:
         namespace: kuma-system
         name: kuma-control-plane
@@ -628,7 +613,7 @@ webhooks:
           operator: In
           values: ["enabled", "true"]
     clientConfig:
-      caBundle: RedactedGeneratedCAForTests
+      caBundle: XYZ
       service:
         namespace: kuma-system
         name: kuma-control-plane
@@ -655,7 +640,7 @@ webhooks:
       matchLabels:
         kuma.io/sidecar-injection: enabled
     clientConfig:
-      caBundle: RedactedGeneratedCAForTests
+      caBundle: XYZ
       service:
         namespace: kuma-system
         name: kuma-control-plane
@@ -690,7 +675,7 @@ webhooks:
           operator: NotIn
           values: ["kube-system"]
     clientConfig:
-      caBundle: RedactedGeneratedCAForTests
+      caBundle: XYZ
       service:
         namespace: kuma-system
         name: kuma-control-plane
@@ -751,7 +736,7 @@ webhooks:
           operator: NotIn
           values: ["kube-system"]
     clientConfig:
-      caBundle: RedactedGeneratedCAForTests
+      caBundle: XYZ
       service:
         namespace: kuma-system
         name: kuma-control-plane
@@ -774,7 +759,7 @@ webhooks:
         kuma.io/system-namespace: "true"
     failurePolicy: Ignore
     clientConfig:
-      caBundle: RedactedGeneratedCAForTests
+      caBundle: XYZ
       service:
         namespace: kuma-system
         name: kuma-control-plane
@@ -800,7 +785,7 @@ webhooks:
           operator: NotIn
           values: ["kube-system"]
     clientConfig:
-      caBundle: RedactedGeneratedCAForTests
+      caBundle: XYZ
       service:
         namespace: kuma-system
         name: kuma-control-plane