diff --git a/kubernetes/talos/cilium.yaml b/kubernetes/talos/cilium.yaml
index 0bdb5b5d..66280704 100644
--- a/kubernetes/talos/cilium.yaml
+++ b/kubernetes/talos/cilium.yaml
@@ -29,33 +29,199 @@ metadata:
   name: "cilium-operator"
   namespace: kube-system
 ---
-# Source: cilium/templates/cilium-ca-secret.yaml
+# Source: cilium/templates/hubble/tls-cronjob/serviceaccount.yaml
+# Cilium CA + Hubble server certs are generated in-cluster by the
+# hubble-generate-certs Job below (hubble.tls.auto.method=cronJob),
+# NOT baked into this manifest. The Job creates/reuses Secret cilium-ca
+# and issues Secret hubble-server-certs at install; the CronJob renews
+# them. No private key material is committed to git. See issue #188.
 apiVersion: v1
-kind: Secret
+kind: ServiceAccount
 metadata:
-  name: cilium-ca
+  name: "hubble-generate-certs"
   namespace: kube-system
-  labels:
-    cilium.io/helm-template-non-idempotent: "true"
-data:
-  ca.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURGRENDQWZ5Z0F3SUJBZ0lSQU9DbHNSOTFSQWdPekpJbTdOc0hFcG93RFFZSktvWklodmNOQVFFTEJRQXcKRkRFU01CQUdBMVVFQXhNSlEybHNhWFZ0SUVOQk1CNFhEVEkyTURRd05ERTRNamt6TWxvWERUSTVNRFF3TXpFNApNamt6TWxvd0ZERVNNQkFHQTFVRUF4TUpRMmxzYVhWdElFTkJNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DCkFROEFNSUlCQ2dLQ0FRRUEwaDcwM3UrUTNHOTNJZmdaTG9QeWY3RzdjN3NEbklYWTJWbWdLMmxpMlJsSlg2TnAKMmFXTUxzaWFHUm9iOTl5NEZGdW13dzFScFBkdkVmd0I3NUVxRXE1UlV2L0dQUUhLbHNTWGJMY0QzUW9tU2piUApaaVYrTUlXMHRrcHFyVFVvSjNaQ096M1dscmcyeFRHNEFVZFhlelhYZ1lKeVZ2U1B2ZTFEeC8ra0xpMlpCcmxoCk14QXA1MjAxbHBURVl3dThxU0xqMmlhbkhZWFBTUzV5OGhUSzBna3psTTgzblcyZThBbjd2TCt0TlQwQlVGaGMKbnozYUVidytNK2IwcG1vbFhCUTA5M29BaUdsSXR2SmJ1QkU0VXdtQnJIVDB3Zk1sL2phWEt3Z3g1SDlVeHpxYwpzcm1rZC9iSytiZ2g3S01WdWpOUU1OZlNHRldmY2JCdWR5MlJJd0lEQVFBQm8yRXdYekFPQmdOVkhROEJBZjhFCkJBTUNBcVF3SFFZRFZSMGxCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQ01BOEdBMVVkRXdFQi93UUYKTUFNQkFmOHdIUVlEVlIwT0JCWUVGRSt0T2JjUGRtVlZtaWdOazU5OEVjLysyZ0MwTUEwR0NTcUdTSWIzRFFFQgpDd1VBQTRJQkFRQWRUSkhkTVNsNnlmQ1dLZHpWK0xrSUxmQXFyU3FETDZUN2VDclM2U0EyWklnZjVvcU4xd1NOCmdlWlNmZjRsL2xDdDNZYUFXeXVIZEtPaWFqb29XUStyR1A3OTRWdnJHZ0ZVNDF1UTI4YWRkUDB5dkpSTklRUXgKQVNrZ2NzTVV0VlZVQTZjK1d6TDZCTGJHZ0Q0NUhHU1ZoWmI0TXY4NVdXMDE0eXc3L2NINm9ObHVLbjR2ZEFmTgpCVGZ1WUl1SURoS0NkUEVHVnFOMHgvV08wY0xRWXZXT0NLblNVejIzOEV3NVFLWVRWd04rd3diTXdZZlBrMDcrCkF3UFBXWlc3OXNBVnFPWlRjRElpcmwzTVIyR3QxaVVaSkUvY0ttVWJjS2RXMGVXWGdQQUpRQkIrdnNCd3Y4MVUKa282eFFzc1lDWGd1dWc2aW1qRFNTRVhNSWpudS93UGYKLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=
-  ca.key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFcEFJQkFBS0NBUUVBMGg3MDN1K1EzRzkzSWZnWkxvUHlmN0c3YzdzRG5JWFkyVm1nSzJsaTJSbEpYNk5wCjJhV01Mc2lhR1JvYjk5eTRGRnVtd3cxUnBQZHZFZndCNzVFcUVxNVJVdi9HUFFIS2xzU1hiTGNEM1FvbVNqYlAKWmlWK01JVzB0a3BxclRVb0ozWkNPejNXbHJnMnhURzRBVWRYZXpYWGdZSnlWdlNQdmUxRHgvK2tMaTJaQnJsaApNeEFwNTIwMWxwVEVZd3U4cVNMajJpYW5IWVhQU1M1eThoVEswZ2t6bE04M25XMmU4QW43dkwrdE5UMEJVRmhjCm56M2FFYncrTStiMHBtb2xYQlEwOTNvQWlHbEl0dkpidUJFNFV3bUJySFQwd2ZNbC9qYVhLd2d4NUg5VXh6cWMKc3Jta2QvYksrYmdoN0tNVnVqTlFNTmZTR0ZXZmNiQnVkeTJSSXdJREFRQUJBb0lCQUdTZGVqZytreWxiSHJyZgphSCtEbzExT0tDclV4SGZ4QjlPY1BUeE1iSTcwc3RQZkZsS29HU1pWM0tSa2dqd0FMdzFnamN3YzFwbWQra3VzClZ1ajJwQ1RwMy90VWl3S3ZsdWozSG1OcWg2a1NzUjhjZTllMzRHTXZ3MGIrLzNJTllEcjFQK1hLU0xWSFpNS3MKZWlYeW1ZdGdUdCt2TFQxQ1FvcDUwTmsyS3RJSkdYajVacSt5YXY3czRTMFFDU0lKeitMREVmSHQzMThnb0lqaQpEd1Bvd0dVZzlBUW1NYUtSRnI3S1REdk0yeGg3MEZJcW1kcWJ6WFdiTzQwV1VQLzBpQzlUZHhBN1dabHBuSGJ3ClBIZkdUY2krcXNLOUJ5RmU2Vm1YeHU5Nk1GcmY5aXdKaXc1WmZOdzZYb1RIMFZKazBqRWNJbjYybGVpQWh2TjgKbUp6MjFHRUNnWUVBNnRONEdJRlphODFtOTdNeWNkazc1TVh2ekczNVl3bHhmTlA3bmRVUkt0SHZCWnpLVUg1QgpObUhvZHpxUisraTl5SlJacnJsejlmSy9scE1GcTRrL0FGdDQ0WElxZWQ2dXE1ZUZSK3NMMkZGN1ZUclFxQUpJClhyQWJmdlptTTFxOUMwYUtxenlpbkRXQ2kxZGVTdDdncDRuakZSZHhYNEE5VGVwZ3MvOHBJR3NDZ1lFQTVSRTIKOFdaSHVxWHhqYXRoZlI2K25YMjZiNGc5Z1ZFdDdGaCsyR1NYSUpCeWQ2dmYrOGxxWE1iVmFtdDkyNHRBOEx4dApoaGhpYjhSRStGcFZyVHpHVVBDblNETlhIU25YYVMvMnY3Wjd5eU9BM1ZJUzVwenVsQUdndWlPTzI2b0M0dVdwCjVkQXRiRW9wUGZYdUxReUFoMjNBMjJ1dlJlb2ZxaXNXQVRzZUlDa0NnWUJkV3JDVjNXWjFTdlV5YUJVWDJhckwKNmp6STRyZVFQY0xXUTFmMmlTd0gvK21zSzRicXRTYXJ2Z1N5MGFBVHE1VTNWbkxJMllWV002a2k3VlFGdTh4RwpFaGRlV1FxMTVHZEFaRDVpTnZsQWlEUWx6L24vc05pZ2ZCYVNSTmFnZCtSTHhVRi9qZDEvaUc1Ymd1SkRsWk51ClI0ejFaNXAwd3dDY0p4OUdyNXZqL1FLQmdRQzR1OUpZaWtqc3NPbUdmQ0ZLRzZKVU50SkZJbFdmMWMwNFh3SWwKRjdKOWs2Q00vSExOaDFrYzYwbXY0bktFdk9BcGhYeTZlUzNodnlKME83MyswUldLcnhucGMyWWM0ZUtVTlJkRQo4ekVRMlZnU3BSOFRGcHFkaUZhTDV5Tk42ZVVjQVdXc0xlQ0VCYWNQRGlmLzhxWXhFZ1ZIcjZlUnRjZkZuNnZHCllGdmlTUUtCZ1FEZVlJWjVHaCszd244V2cydVRjQ2hkS20wWFlTT282QjVRUU1yNU1QU3U5NnYvQ3pnR2tGN1AKTWhiSE5SNlF4NW5DT0thajZEaEcvM3BHQkFFb244OE42bHExdGRJaS9OaXRISWlzeUJDSXRsK0ZoODFLekNJSgpYSVZGOW1lS1N1OUN0QXBjYmU1TWJxWWFKNjMxK1pUNndTLy9qU05rbmFpUzh0T3hBN0Z1bEE9PQotLS0tLUVORCBSU0EgUFJJVkFURSBLRVktLS0tLQo=
 ---
-# Source: cilium/templates/hubble/tls-helm/server-secret.yaml
-apiVersion: v1
-kind: Secret
+# Source: cilium/templates/hubble/tls-cronjob/role.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
 metadata:
-  name: hubble-server-certs
+  name: hubble-generate-certs
   namespace: kube-system
   labels:
-    cilium.io/helm-template-non-idempotent: "true"
+    app.kubernetes.io/part-of: cilium
 
-  annotations:
-type: kubernetes.io/tls
-data:
-  ca.crt:  LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURGRENDQWZ5Z0F3SUJBZ0lSQU9DbHNSOTFSQWdPekpJbTdOc0hFcG93RFFZSktvWklodmNOQVFFTEJRQXcKRkRFU01CQUdBMVVFQXhNSlEybHNhWFZ0SUVOQk1CNFhEVEkyTURRd05ERTRNamt6TWxvWERUSTVNRFF3TXpFNApNamt6TWxvd0ZERVNNQkFHQTFVRUF4TUpRMmxzYVhWdElFTkJNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DCkFROEFNSUlCQ2dLQ0FRRUEwaDcwM3UrUTNHOTNJZmdaTG9QeWY3RzdjN3NEbklYWTJWbWdLMmxpMlJsSlg2TnAKMmFXTUxzaWFHUm9iOTl5NEZGdW13dzFScFBkdkVmd0I3NUVxRXE1UlV2L0dQUUhLbHNTWGJMY0QzUW9tU2piUApaaVYrTUlXMHRrcHFyVFVvSjNaQ096M1dscmcyeFRHNEFVZFhlelhYZ1lKeVZ2U1B2ZTFEeC8ra0xpMlpCcmxoCk14QXA1MjAxbHBURVl3dThxU0xqMmlhbkhZWFBTUzV5OGhUSzBna3psTTgzblcyZThBbjd2TCt0TlQwQlVGaGMKbnozYUVidytNK2IwcG1vbFhCUTA5M29BaUdsSXR2SmJ1QkU0VXdtQnJIVDB3Zk1sL2phWEt3Z3g1SDlVeHpxYwpzcm1rZC9iSytiZ2g3S01WdWpOUU1OZlNHRldmY2JCdWR5MlJJd0lEQVFBQm8yRXdYekFPQmdOVkhROEJBZjhFCkJBTUNBcVF3SFFZRFZSMGxCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQ01BOEdBMVVkRXdFQi93UUYKTUFNQkFmOHdIUVlEVlIwT0JCWUVGRSt0T2JjUGRtVlZtaWdOazU5OEVjLysyZ0MwTUEwR0NTcUdTSWIzRFFFQgpDd1VBQTRJQkFRQWRUSkhkTVNsNnlmQ1dLZHpWK0xrSUxmQXFyU3FETDZUN2VDclM2U0EyWklnZjVvcU4xd1NOCmdlWlNmZjRsL2xDdDNZYUFXeXVIZEtPaWFqb29XUStyR1A3OTRWdnJHZ0ZVNDF1UTI4YWRkUDB5dkpSTklRUXgKQVNrZ2NzTVV0VlZVQTZjK1d6TDZCTGJHZ0Q0NUhHU1ZoWmI0TXY4NVdXMDE0eXc3L2NINm9ObHVLbjR2ZEFmTgpCVGZ1WUl1SURoS0NkUEVHVnFOMHgvV08wY0xRWXZXT0NLblNVejIzOEV3NVFLWVRWd04rd3diTXdZZlBrMDcrCkF3UFBXWlc3OXNBVnFPWlRjRElpcmwzTVIyR3QxaVVaSkUvY0ttVWJjS2RXMGVXWGdQQUpRQkIrdnNCd3Y4MVUKa282eFFzc1lDWGd1dWc2aW1qRFNTRVhNSWpudS93UGYKLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=
-  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURWekNDQWorZ0F3SUJBZ0lSQU55NzcyVXVURjJtR1h0ZUVQYVBqNDR3RFFZSktvWklodmNOQVFFTEJRQXcKRkRFU01CQUdBMVVFQXhNSlEybHNhWFZ0SUVOQk1CNFhEVEkyTURRd05ERTRNamt6TWxvWERUSTNNRFF3TkRFNApNamt6TWxvd0tqRW9NQ1lHQTFVRUF3d2ZLaTVrWldaaGRXeDBMbWgxWW1Kc1pTMW5jbkJqTG1OcGJHbDFiUzVwCmJ6Q0NBU0l3RFFZSktvWklodmNOQVFFQkJRQURnZ0VQQURDQ0FRb0NnZ0VCQUppV2M1NTU4UnRVb1BxV0lkT24KTEdMOVJudjErOHU5UHlLTm1kYkpQa2dicDEwZmdyQ3BaZktoRDJGT0luRklwdDRsR3M3Wm1NTVR2b1BOb0lkSwo2N3lmSzhzaDhaWkRTZ0xJUXNVZVV5TitKdWtiNzhxdXdXOWtwZzREczJSbmRIei9icEl4S29vVE5pZTZMNjBqCmlpRnFETERXSU1STU16dG84OWNJWndnUHJlTXhrVGdVN0hYSUw5WWU5NWNtSGhiak1UdlBBQVR2RmxRdzhsRy8KZG4xZXlwSGpEV3Bqcmw4U0pnMDd1ZW9aUUNFMjdDMkpoRFJWa0NQZXVPWXRKOC96ZFFpd1dsd3plcFFreDlLVwoxVW9wUUt6VVc4aXQwSm9pZGVVdnpCU2xNSWNSOHdLS2F4TFlUa0xRNVY2MXVyMW1SNzNWREpTNy9PUkNkQnoyCjFiRUNBd0VBQWFPQmpUQ0JpakFPQmdOVkhROEJBZjhFQkFNQ0JhQXdIUVlEVlIwbEJCWXdGQVlJS3dZQkJRVUgKQXdFR0NDc0dBUVVGQndNQ01Bd0dBMVVkRXdFQi93UUNNQUF3SHdZRFZSMGpCQmd3Rm9BVVQ2MDV0dzkyWlZXYQpLQTJUbjN3UnovN2FBTFF3S2dZRFZSMFJCQ013SVlJZktpNWtaV1poZFd4MExtaDFZbUpzWlMxbmNuQmpMbU5wCmJHbDFiUzVwYnpBTkJna3Foa2lHOXcwQkFRc0ZBQU9DQVFFQUNsWTIveGQxNUNZVEhoQ3VKSzdHUEttc2pYWjQKbElOV2F2eXhIakRXRmdlWDZIWGh1NS9lWEZjOS93TGpoRm9ZT3BMaEVXRmtrc2NhRjNRY0xGUHY5UXVRcW01WApYaTdCa09SVG9zZ0loL2ZidktXUXpNa29HL0xZNXgvNm5XbHVoYlE3bE5adzlseFBTUjdIVDBEb0F6UHNpZWd0CjdpLzcxaW9lMXFDUVJFMm1wL0diRk5ocDQvNExlU1YzM3VmQ2o4OVVIMlpjL1ZZMWU2WldzeTl6b05pS3JsYWsKNFJkMlFNUjRjeXRnaC9iVzNSVytaOWF3R0V3ZVVvb1M1UXA4ZzdBYVczTHlwbER1UGFOSC8zc2s2VHhPZDhWMQo4TlJBTkYrYUh1QUh5SW5wcTBTYUVqRTF5QUN3NW9oeXhMa2ViK00rWnJUblhwQndHY0NJSzdRdDRBPT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=
-  tls.key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFb1FJQkFBS0NBUUVBbUpaem5ubnhHMVNnK3BZaDA2Y3NZdjFHZS9YN3k3MC9JbzJaMXNrK1NCdW5YUitDCnNLbGw4cUVQWVU0aWNVaW0zaVVhenRtWXd4TytnODJnaDBycnZKOHJ5eUh4bGtOS0FzaEN4UjVUSTM0bTZSdnYKeXE3QmIyU21EZ096WkdkMGZQOXVrakVxaWhNMko3b3ZyU09LSVdvTXNOWWd4RXd6TzJqejF3aG5DQSt0NHpHUgpPQlRzZGNndjFoNzNseVllRnVNeE84OEFCTzhXVkREeVViOTJmVjdLa2VNTmFtT3VYeEltRFR1NTZobEFJVGJzCkxZbUVORldRSTk2NDVpMG56L04xQ0xCYVhETjZsQ1RIMHBiVlNpbEFyTlJieUszUW1pSjE1Uy9NRktVd2h4SHoKQW9wckV0aE9RdERsWHJXNnZXWkh2ZFVNbEx2ODVFSjBIUGJWc1FJREFRQUJBb0gvWXExYk5IYkVJSGJUTWxjNgpNNllodVA3MXNvb01FMFJQa0FqbVY0N3AxSnViMlVmY3l0UlFOaWFjNkJlZmc5d2l1R29xQ0g2djJpTHFvQmsrCktPcjFUN0M4YUtGU0RJVjNrRlVPWjA4MUg0WUQzTHltSFZDdGpyR0lQL215N1R1SWk0WnJ3bGdKWTNxWFVqWXkKWmY2VngzZnFFbkl1dm9xSTBCdTZCeHoyTHlMMUJOeUN3bGVlK3JCbTIwd3pNbWVhc0NIOU8wUlV2emZYK0lrbwpXQncvTGlqZmk0ejN6RmF6bFN5NE8zVk9mZHl5YmxrNkhoN1JPQlRGZklCc3lXckVpUUhXeEVVMWV4QlNOTnB0CnZ5K09SckhhQkVCUElKRE4yZk9NM1hMZWZTTGtPQmFaUlE4WGFqdVNXM0x4NERKZ0ZkdTlYV1lxMUdaZ3gzVG4KMXpISkFvR0JBTVdEMnpSY2RydDVCTUoxL1gwaGdxNVJTN3R1MjMxMllTaUdQM3hQTXQ5bUtrSFBKY0J1V3psagp5NWtGSkMrRGN6OGNuWDdMOFJMSTFBY3JSV3ZmTHppcFRuclRPTWRxWkFBR0pMckxsOGpGeGlPWnRFQWQxM0NCCjdxeHNiUVpkbzdPWEVCUGR3UVhZVmwxR25reVUyemhzdDEvWmRvcG5aZDJMUkFCeSt3OGZBb0dCQU1YRS9MZDUKWlplL3psbDE1bldTUVV1NFFObS9VMTdNYXFjOXVMeDNlNGFwcGRqd0lUQndrQnBpNWQ1YlVVdVlZb2lqekhmLwovQVhiSzB6UmhOSVVTMEJSOGc3VkZWWFNIbm1mRldlQTVFc3psMzJRWTZSY0sxdFRndzcrOHBxRHpDZFhURFJUCkJLQ2hRL0FTckVuRXB1dTNFTVA3V1dQdGszdFZlRDBWWWhFdkFvR0FHYmQ2VWczNzg1cmxNTUNXR2JYRVF4Z1kKcVRYYzVEQUdwSFVlVFB3dTNvRjUzUW13bTZhQ3dDMHJOQ2hFTnQrQm9PVUQ2Sjk3S3Z2MUIxM3Q4d2FqS2xoNAovR3NHQ0lqa3JsQWVkaWZPQW5rbHZEcm1DamNZZHZDajk5VkNPTUwyYm9xcnNEcCtTRm1MblNkMXN2anF0aVVKCmx6UkVSKzhBaDJEN29LZFg0dmNDZ1lBbUhQNXZCWEEwdkh3eDlXekNmN3Noc3BLYzVDaFcvcUlYTk9mak9rdU4KK2lmQ0ZSVHdWdUVPbEx5a0M0a3hQbDdPNG5KSE5nZ0Z3T1VwV3I5MEZRRWpsaWRHQUg2cUdXSlNJZnhvQkFqNwpEU2hHeElyUFpBdmUvOHNrR3JINllTZjQ5UFAwcVlNY3liZGtEdFV4S2pyWTltQyt4RFBIOUVNVjQ3VFdZTWFUCmRRS0JnUUNYM0FNZitOL3hzMWh1MU1hNzN5OHBtYU1HdlB0NFYxNVRVK2ZrREhDQ09kSTZMRllYcHJwVThwZkMKOHpjejdRWndrV1AvU3NWRFBxL1pPdjN4b2J2QWNLS1VZUXdJdnZQcHJHeVpvYzlyek5UQ2JLdnE1bEo2U1liYwo5NUk1cmZZcmxFTDVtY1BxZENlQ3FJajhMMkJibGhYdXdIWkdOU0ZyaEFaWFc3Ynd5dz09Ci0tLS0tRU5EIFJTQSBQUklWQVRFIEtFWS0tLS0tCg==
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - secrets
+    verbs:
+      - create
+  - apiGroups:
+      - ""
+    resources:
+      - secrets
+    resourceNames:
+      - hubble-server-certs
+      - hubble-relay-client-certs
+      - hubble-relay-server-certs
+      - hubble-metrics-server-certs
+      - hubble-ui-client-certs
+    verbs:
+      - update
+  - apiGroups:
+      - ""
+    resources:
+      - secrets
+    resourceNames:
+      - cilium-ca
+    verbs:
+      - get
+      - update
+---
+# Source: cilium/templates/hubble/tls-cronjob/rolebinding.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: hubble-generate-certs
+  namespace: kube-system
+  labels:
+    app.kubernetes.io/part-of: cilium
+
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: hubble-generate-certs
+subjects:
+- kind: ServiceAccount
+  name: "hubble-generate-certs"
+  namespace: kube-system
+---
+# Source: cilium/templates/hubble/tls-cronjob/job.yaml
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: hubble-generate-certs-a3297ae8da
+  namespace: kube-system
+  labels:
+    k8s-app: hubble-generate-certs
+    app.kubernetes.io/name: hubble-generate-certs
+    app.kubernetes.io/part-of: cilium
+spec:
+  template:
+    metadata:
+      labels:
+        k8s-app: hubble-generate-certs
+    spec:
+      securityContext:
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: certgen
+          image: "quay.io/cilium/certgen:v0.4.1@sha256:f0c656830e856d26b24b0e144df1f8b327d3b46748d76a630514111fc365b697"
+          imagePullPolicy: IfNotPresent
+          securityContext:
+            capabilities:
+              drop:
+              - ALL
+            allowPrivilegeEscalation: false
+          command:
+            - "/usr/bin/cilium-certgen"
+          # Because this is executed as a job, we pass the values as command
+          # line args instead of via config map. This allows users to inspect
+          # the values used in past runs by inspecting the completed pod.
+          args:
+            - "--ca-generate=true"
+            - "--ca-reuse-secret"
+            - "--ca-secret-namespace=kube-system"
+            - "--ca-secret-name=cilium-ca"
+            - "--ca-common-name=Cilium CA"
+          env:
+            - name: CILIUM_CERTGEN_CONFIG
+              value: |
+                certs:
+                - name: hubble-server-certs
+                  namespace: kube-system
+                  commonName: "*.default.hubble-grpc.cilium.io"
+                  hosts:
+                  - "*.default.hubble-grpc.cilium.io"
+                  usage:
+                  - signing
+                  - key encipherment
+                  - server auth
+                  - client auth
+                  validity: 8760h
+
+      hostNetwork: false
+      serviceAccountName: "hubble-generate-certs"
+      automountServiceAccountToken: true
+      restartPolicy: OnFailure
+---
+# Source: cilium/templates/hubble/tls-cronjob/cronjob.yaml
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: hubble-generate-certs
+  namespace: kube-system
+  labels:
+    k8s-app: hubble-generate-certs
+    app.kubernetes.io/name: hubble-generate-certs
+    app.kubernetes.io/part-of: cilium
+spec:
+  schedule: "0 0 1 */4 *"
+  successfulJobsHistoryLimit: 3
+  failedJobsHistoryLimit: 1
+  concurrencyPolicy: Forbid
+  jobTemplate:
+    spec:
+      template:
+        metadata:
+          labels:
+            k8s-app: hubble-generate-certs
+        spec:
+          securityContext:
+            seccompProfile:
+              type: RuntimeDefault
+          containers:
+            - name: certgen
+              image: "quay.io/cilium/certgen:v0.4.1@sha256:f0c656830e856d26b24b0e144df1f8b327d3b46748d76a630514111fc365b697"
+              imagePullPolicy: IfNotPresent
+              securityContext:
+                capabilities:
+                  drop:
+                  - ALL
+                allowPrivilegeEscalation: false
+              command:
+                - "/usr/bin/cilium-certgen"
+              # Because this is executed as a job, we pass the values as command
+              # line args instead of via config map. This allows users to inspect
+              # the values used in past runs by inspecting the completed pod.
+              args:
+                - "--ca-generate=true"
+                - "--ca-reuse-secret"
+                - "--ca-secret-namespace=kube-system"
+                - "--ca-secret-name=cilium-ca"
+                - "--ca-common-name=Cilium CA"
+              env:
+                - name: CILIUM_CERTGEN_CONFIG
+                  value: |
+                    certs:
+                    - name: hubble-server-certs
+                      namespace: kube-system
+                      commonName: "*.default.hubble-grpc.cilium.io"
+                      hosts:
+                      - "*.default.hubble-grpc.cilium.io"
+                      usage:
+                      - signing
+                      - key encipherment
+                      - server auth
+                      - client auth
+                      validity: 8760h
+
+          hostNetwork: false
+          serviceAccountName: "hubble-generate-certs"
+          automountServiceAccountToken: true
+          restartPolicy: OnFailure
 ---
 # Source: cilium/templates/cilium-configmap.yaml
 apiVersion: v1
diff --git a/kubernetes/talos/patches/cilium-cni.yaml b/kubernetes/talos/patches/cilium-cni.yaml
index f580e952..b1c4f5b8 100644
--- a/kubernetes/talos/patches/cilium-cni.yaml
+++ b/kubernetes/talos/patches/cilium-cni.yaml
@@ -51,33 +51,195 @@ cluster:
           name: "cilium-operator"
           namespace: kube-system
         ---
-        # Source: cilium/templates/cilium-ca-secret.yaml
+        # Source: cilium/templates/hubble/tls-cronjob/serviceaccount.yaml
+        # Cilium CA + Hubble server certs are generated in-cluster by the
+        # hubble-generate-certs Job below (hubble.tls.auto.method=cronJob),
+        # NOT baked into this manifest. The Job creates/reuses Secret cilium-ca
+        # and issues Secret hubble-server-certs at install; the CronJob renews
+        # them. No private key material is committed to git. See issue #188.
         apiVersion: v1
-        kind: Secret
+        kind: ServiceAccount
         metadata:
-          name: cilium-ca
+          name: "hubble-generate-certs"
           namespace: kube-system
-          labels:
-            cilium.io/helm-template-non-idempotent: "true"
-        data:
-          ca.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURGRENDQWZ5Z0F3SUJBZ0lSQU9DbHNSOTFSQWdPekpJbTdOc0hFcG93RFFZSktvWklodmNOQVFFTEJRQXcKRkRFU01CQUdBMVVFQXhNSlEybHNhWFZ0SUVOQk1CNFhEVEkyTURRd05ERTRNamt6TWxvWERUSTVNRFF3TXpFNApNamt6TWxvd0ZERVNNQkFHQTFVRUF4TUpRMmxzYVhWdElFTkJNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DCkFROEFNSUlCQ2dLQ0FRRUEwaDcwM3UrUTNHOTNJZmdaTG9QeWY3RzdjN3NEbklYWTJWbWdLMmxpMlJsSlg2TnAKMmFXTUxzaWFHUm9iOTl5NEZGdW13dzFScFBkdkVmd0I3NUVxRXE1UlV2L0dQUUhLbHNTWGJMY0QzUW9tU2piUApaaVYrTUlXMHRrcHFyVFVvSjNaQ096M1dscmcyeFRHNEFVZFhlelhYZ1lKeVZ2U1B2ZTFEeC8ra0xpMlpCcmxoCk14QXA1MjAxbHBURVl3dThxU0xqMmlhbkhZWFBTUzV5OGhUSzBna3psTTgzblcyZThBbjd2TCt0TlQwQlVGaGMKbnozYUVidytNK2IwcG1vbFhCUTA5M29BaUdsSXR2SmJ1QkU0VXdtQnJIVDB3Zk1sL2phWEt3Z3g1SDlVeHpxYwpzcm1rZC9iSytiZ2g3S01WdWpOUU1OZlNHRldmY2JCdWR5MlJJd0lEQVFBQm8yRXdYekFPQmdOVkhROEJBZjhFCkJBTUNBcVF3SFFZRFZSMGxCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQ01BOEdBMVVkRXdFQi93UUYKTUFNQkFmOHdIUVlEVlIwT0JCWUVGRSt0T2JjUGRtVlZtaWdOazU5OEVjLysyZ0MwTUEwR0NTcUdTSWIzRFFFQgpDd1VBQTRJQkFRQWRUSkhkTVNsNnlmQ1dLZHpWK0xrSUxmQXFyU3FETDZUN2VDclM2U0EyWklnZjVvcU4xd1NOCmdlWlNmZjRsL2xDdDNZYUFXeXVIZEtPaWFqb29XUStyR1A3OTRWdnJHZ0ZVNDF1UTI4YWRkUDB5dkpSTklRUXgKQVNrZ2NzTVV0VlZVQTZjK1d6TDZCTGJHZ0Q0NUhHU1ZoWmI0TXY4NVdXMDE0eXc3L2NINm9ObHVLbjR2ZEFmTgpCVGZ1WUl1SURoS0NkUEVHVnFOMHgvV08wY0xRWXZXT0NLblNVejIzOEV3NVFLWVRWd04rd3diTXdZZlBrMDcrCkF3UFBXWlc3OXNBVnFPWlRjRElpcmwzTVIyR3QxaVVaSkUvY0ttVWJjS2RXMGVXWGdQQUpRQkIrdnNCd3Y4MVUKa282eFFzc1lDWGd1dWc2aW1qRFNTRVhNSWpudS93UGYKLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=
-          ca.key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFcEFJQkFBS0NBUUVBMGg3MDN1K1EzRzkzSWZnWkxvUHlmN0c3YzdzRG5JWFkyVm1nSzJsaTJSbEpYNk5wCjJhV01Mc2lhR1JvYjk5eTRGRnVtd3cxUnBQZHZFZndCNzVFcUVxNVJVdi9HUFFIS2xzU1hiTGNEM1FvbVNqYlAKWmlWK01JVzB0a3BxclRVb0ozWkNPejNXbHJnMnhURzRBVWRYZXpYWGdZSnlWdlNQdmUxRHgvK2tMaTJaQnJsaApNeEFwNTIwMWxwVEVZd3U4cVNMajJpYW5IWVhQU1M1eThoVEswZ2t6bE04M25XMmU4QW43dkwrdE5UMEJVRmhjCm56M2FFYncrTStiMHBtb2xYQlEwOTNvQWlHbEl0dkpidUJFNFV3bUJySFQwd2ZNbC9qYVhLd2d4NUg5VXh6cWMKc3Jta2QvYksrYmdoN0tNVnVqTlFNTmZTR0ZXZmNiQnVkeTJSSXdJREFRQUJBb0lCQUdTZGVqZytreWxiSHJyZgphSCtEbzExT0tDclV4SGZ4QjlPY1BUeE1iSTcwc3RQZkZsS29HU1pWM0tSa2dqd0FMdzFnamN3YzFwbWQra3VzClZ1ajJwQ1RwMy90VWl3S3ZsdWozSG1OcWg2a1NzUjhjZTllMzRHTXZ3MGIrLzNJTllEcjFQK1hLU0xWSFpNS3MKZWlYeW1ZdGdUdCt2TFQxQ1FvcDUwTmsyS3RJSkdYajVacSt5YXY3czRTMFFDU0lKeitMREVmSHQzMThnb0lqaQpEd1Bvd0dVZzlBUW1NYUtSRnI3S1REdk0yeGg3MEZJcW1kcWJ6WFdiTzQwV1VQLzBpQzlUZHhBN1dabHBuSGJ3ClBIZkdUY2krcXNLOUJ5RmU2Vm1YeHU5Nk1GcmY5aXdKaXc1WmZOdzZYb1RIMFZKazBqRWNJbjYybGVpQWh2TjgKbUp6MjFHRUNnWUVBNnRONEdJRlphODFtOTdNeWNkazc1TVh2ekczNVl3bHhmTlA3bmRVUkt0SHZCWnpLVUg1QgpObUhvZHpxUisraTl5SlJacnJsejlmSy9scE1GcTRrL0FGdDQ0WElxZWQ2dXE1ZUZSK3NMMkZGN1ZUclFxQUpJClhyQWJmdlptTTFxOUMwYUtxenlpbkRXQ2kxZGVTdDdncDRuakZSZHhYNEE5VGVwZ3MvOHBJR3NDZ1lFQTVSRTIKOFdaSHVxWHhqYXRoZlI2K25YMjZiNGc5Z1ZFdDdGaCsyR1NYSUpCeWQ2dmYrOGxxWE1iVmFtdDkyNHRBOEx4dApoaGhpYjhSRStGcFZyVHpHVVBDblNETlhIU25YYVMvMnY3Wjd5eU9BM1ZJUzVwenVsQUdndWlPTzI2b0M0dVdwCjVkQXRiRW9wUGZYdUxReUFoMjNBMjJ1dlJlb2ZxaXNXQVRzZUlDa0NnWUJkV3JDVjNXWjFTdlV5YUJVWDJhckwKNmp6STRyZVFQY0xXUTFmMmlTd0gvK21zSzRicXRTYXJ2Z1N5MGFBVHE1VTNWbkxJMllWV002a2k3VlFGdTh4RwpFaGRlV1FxMTVHZEFaRDVpTnZsQWlEUWx6L24vc05pZ2ZCYVNSTmFnZCtSTHhVRi9qZDEvaUc1Ymd1SkRsWk51ClI0ejFaNXAwd3dDY0p4OUdyNXZqL1FLQmdRQzR1OUpZaWtqc3NPbUdmQ0ZLRzZKVU50SkZJbFdmMWMwNFh3SWwKRjdKOWs2Q00vSExOaDFrYzYwbXY0bktFdk9BcGhYeTZlUzNodnlKME83MyswUldLcnhucGMyWWM0ZUtVTlJkRQo4ekVRMlZnU3BSOFRGcHFkaUZhTDV5Tk42ZVVjQVdXc0xlQ0VCYWNQRGlmLzhxWXhFZ1ZIcjZlUnRjZkZuNnZHCllGdmlTUUtCZ1FEZVlJWjVHaCszd244V2cydVRjQ2hkS20wWFlTT282QjVRUU1yNU1QU3U5NnYvQ3pnR2tGN1AKTWhiSE5SNlF4NW5DT0thajZEaEcvM3BHQkFFb244OE42bHExdGRJaS9OaXRISWlzeUJDSXRsK0ZoODFLekNJSgpYSVZGOW1lS1N1OUN0QXBjYmU1TWJxWWFKNjMxK1pUNndTLy9qU05rbmFpUzh0T3hBN0Z1bEE9PQotLS0tLUVORCBSU0EgUFJJVkFURSBLRVktLS0tLQo=
         ---
-        # Source: cilium/templates/hubble/tls-helm/server-secret.yaml
-        apiVersion: v1
-        kind: Secret
+        # Source: cilium/templates/hubble/tls-cronjob/role.yaml
+        apiVersion: rbac.authorization.k8s.io/v1
+        kind: Role
         metadata:
-          name: hubble-server-certs
+          name: hubble-generate-certs
           namespace: kube-system
           labels:
-            cilium.io/helm-template-non-idempotent: "true"
-        
-          annotations:
-        type: kubernetes.io/tls
-        data:
-          ca.crt:  LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURGRENDQWZ5Z0F3SUJBZ0lSQU9DbHNSOTFSQWdPekpJbTdOc0hFcG93RFFZSktvWklodmNOQVFFTEJRQXcKRkRFU01CQUdBMVVFQXhNSlEybHNhWFZ0SUVOQk1CNFhEVEkyTURRd05ERTRNamt6TWxvWERUSTVNRFF3TXpFNApNamt6TWxvd0ZERVNNQkFHQTFVRUF4TUpRMmxzYVhWdElFTkJNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DCkFROEFNSUlCQ2dLQ0FRRUEwaDcwM3UrUTNHOTNJZmdaTG9QeWY3RzdjN3NEbklYWTJWbWdLMmxpMlJsSlg2TnAKMmFXTUxzaWFHUm9iOTl5NEZGdW13dzFScFBkdkVmd0I3NUVxRXE1UlV2L0dQUUhLbHNTWGJMY0QzUW9tU2piUApaaVYrTUlXMHRrcHFyVFVvSjNaQ096M1dscmcyeFRHNEFVZFhlelhYZ1lKeVZ2U1B2ZTFEeC8ra0xpMlpCcmxoCk14QXA1MjAxbHBURVl3dThxU0xqMmlhbkhZWFBTUzV5OGhUSzBna3psTTgzblcyZThBbjd2TCt0TlQwQlVGaGMKbnozYUVidytNK2IwcG1vbFhCUTA5M29BaUdsSXR2SmJ1QkU0VXdtQnJIVDB3Zk1sL2phWEt3Z3g1SDlVeHpxYwpzcm1rZC9iSytiZ2g3S01WdWpOUU1OZlNHRldmY2JCdWR5MlJJd0lEQVFBQm8yRXdYekFPQmdOVkhROEJBZjhFCkJBTUNBcVF3SFFZRFZSMGxCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQ01BOEdBMVVkRXdFQi93UUYKTUFNQkFmOHdIUVlEVlIwT0JCWUVGRSt0T2JjUGRtVlZtaWdOazU5OEVjLysyZ0MwTUEwR0NTcUdTSWIzRFFFQgpDd1VBQTRJQkFRQWRUSkhkTVNsNnlmQ1dLZHpWK0xrSUxmQXFyU3FETDZUN2VDclM2U0EyWklnZjVvcU4xd1NOCmdlWlNmZjRsL2xDdDNZYUFXeXVIZEtPaWFqb29XUStyR1A3OTRWdnJHZ0ZVNDF1UTI4YWRkUDB5dkpSTklRUXgKQVNrZ2NzTVV0VlZVQTZjK1d6TDZCTGJHZ0Q0NUhHU1ZoWmI0TXY4NVdXMDE0eXc3L2NINm9ObHVLbjR2ZEFmTgpCVGZ1WUl1SURoS0NkUEVHVnFOMHgvV08wY0xRWXZXT0NLblNVejIzOEV3NVFLWVRWd04rd3diTXdZZlBrMDcrCkF3UFBXWlc3OXNBVnFPWlRjRElpcmwzTVIyR3QxaVVaSkUvY0ttVWJjS2RXMGVXWGdQQUpRQkIrdnNCd3Y4MVUKa282eFFzc1lDWGd1dWc2aW1qRFNTRVhNSWpudS93UGYKLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=
-          tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURWekNDQWorZ0F3SUJBZ0lSQU55NzcyVXVURjJtR1h0ZUVQYVBqNDR3RFFZSktvWklodmNOQVFFTEJRQXcKRkRFU01CQUdBMVVFQXhNSlEybHNhWFZ0SUVOQk1CNFhEVEkyTURRd05ERTRNamt6TWxvWERUSTNNRFF3TkRFNApNamt6TWxvd0tqRW9NQ1lHQTFVRUF3d2ZLaTVrWldaaGRXeDBMbWgxWW1Kc1pTMW5jbkJqTG1OcGJHbDFiUzVwCmJ6Q0NBU0l3RFFZSktvWklodmNOQVFFQkJRQURnZ0VQQURDQ0FRb0NnZ0VCQUppV2M1NTU4UnRVb1BxV0lkT24KTEdMOVJudjErOHU5UHlLTm1kYkpQa2dicDEwZmdyQ3BaZktoRDJGT0luRklwdDRsR3M3Wm1NTVR2b1BOb0lkSwo2N3lmSzhzaDhaWkRTZ0xJUXNVZVV5TitKdWtiNzhxdXdXOWtwZzREczJSbmRIei9icEl4S29vVE5pZTZMNjBqCmlpRnFETERXSU1STU16dG84OWNJWndnUHJlTXhrVGdVN0hYSUw5WWU5NWNtSGhiak1UdlBBQVR2RmxRdzhsRy8KZG4xZXlwSGpEV3Bqcmw4U0pnMDd1ZW9aUUNFMjdDMkpoRFJWa0NQZXVPWXRKOC96ZFFpd1dsd3plcFFreDlLVwoxVW9wUUt6VVc4aXQwSm9pZGVVdnpCU2xNSWNSOHdLS2F4TFlUa0xRNVY2MXVyMW1SNzNWREpTNy9PUkNkQnoyCjFiRUNBd0VBQWFPQmpUQ0JpakFPQmdOVkhROEJBZjhFQkFNQ0JhQXdIUVlEVlIwbEJCWXdGQVlJS3dZQkJRVUgKQXdFR0NDc0dBUVVGQndNQ01Bd0dBMVVkRXdFQi93UUNNQUF3SHdZRFZSMGpCQmd3Rm9BVVQ2MDV0dzkyWlZXYQpLQTJUbjN3UnovN2FBTFF3S2dZRFZSMFJCQ013SVlJZktpNWtaV1poZFd4MExtaDFZbUpzWlMxbmNuQmpMbU5wCmJHbDFiUzVwYnpBTkJna3Foa2lHOXcwQkFRc0ZBQU9DQVFFQUNsWTIveGQxNUNZVEhoQ3VKSzdHUEttc2pYWjQKbElOV2F2eXhIakRXRmdlWDZIWGh1NS9lWEZjOS93TGpoRm9ZT3BMaEVXRmtrc2NhRjNRY0xGUHY5UXVRcW01WApYaTdCa09SVG9zZ0loL2ZidktXUXpNa29HL0xZNXgvNm5XbHVoYlE3bE5adzlseFBTUjdIVDBEb0F6UHNpZWd0CjdpLzcxaW9lMXFDUVJFMm1wL0diRk5ocDQvNExlU1YzM3VmQ2o4OVVIMlpjL1ZZMWU2WldzeTl6b05pS3JsYWsKNFJkMlFNUjRjeXRnaC9iVzNSVytaOWF3R0V3ZVVvb1M1UXA4ZzdBYVczTHlwbER1UGFOSC8zc2s2VHhPZDhWMQo4TlJBTkYrYUh1QUh5SW5wcTBTYUVqRTF5QUN3NW9oeXhMa2ViK00rWnJUblhwQndHY0NJSzdRdDRBPT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=
-          tls.key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFb1FJQkFBS0NBUUVBbUpaem5ubnhHMVNnK3BZaDA2Y3NZdjFHZS9YN3k3MC9JbzJaMXNrK1NCdW5YUitDCnNLbGw4cUVQWVU0aWNVaW0zaVVhenRtWXd4TytnODJnaDBycnZKOHJ5eUh4bGtOS0FzaEN4UjVUSTM0bTZSdnYKeXE3QmIyU21EZ096WkdkMGZQOXVrakVxaWhNMko3b3ZyU09LSVdvTXNOWWd4RXd6TzJqejF3aG5DQSt0NHpHUgpPQlRzZGNndjFoNzNseVllRnVNeE84OEFCTzhXVkREeVViOTJmVjdLa2VNTmFtT3VYeEltRFR1NTZobEFJVGJzCkxZbUVORldRSTk2NDVpMG56L04xQ0xCYVhETjZsQ1RIMHBiVlNpbEFyTlJieUszUW1pSjE1Uy9NRktVd2h4SHoKQW9wckV0aE9RdERsWHJXNnZXWkh2ZFVNbEx2ODVFSjBIUGJWc1FJREFRQUJBb0gvWXExYk5IYkVJSGJUTWxjNgpNNllodVA3MXNvb01FMFJQa0FqbVY0N3AxSnViMlVmY3l0UlFOaWFjNkJlZmc5d2l1R29xQ0g2djJpTHFvQmsrCktPcjFUN0M4YUtGU0RJVjNrRlVPWjA4MUg0WUQzTHltSFZDdGpyR0lQL215N1R1SWk0WnJ3bGdKWTNxWFVqWXkKWmY2VngzZnFFbkl1dm9xSTBCdTZCeHoyTHlMMUJOeUN3bGVlK3JCbTIwd3pNbWVhc0NIOU8wUlV2emZYK0lrbwpXQncvTGlqZmk0ejN6RmF6bFN5NE8zVk9mZHl5YmxrNkhoN1JPQlRGZklCc3lXckVpUUhXeEVVMWV4QlNOTnB0CnZ5K09SckhhQkVCUElKRE4yZk9NM1hMZWZTTGtPQmFaUlE4WGFqdVNXM0x4NERKZ0ZkdTlYV1lxMUdaZ3gzVG4KMXpISkFvR0JBTVdEMnpSY2RydDVCTUoxL1gwaGdxNVJTN3R1MjMxMllTaUdQM3hQTXQ5bUtrSFBKY0J1V3psagp5NWtGSkMrRGN6OGNuWDdMOFJMSTFBY3JSV3ZmTHppcFRuclRPTWRxWkFBR0pMckxsOGpGeGlPWnRFQWQxM0NCCjdxeHNiUVpkbzdPWEVCUGR3UVhZVmwxR25reVUyemhzdDEvWmRvcG5aZDJMUkFCeSt3OGZBb0dCQU1YRS9MZDUKWlplL3psbDE1bldTUVV1NFFObS9VMTdNYXFjOXVMeDNlNGFwcGRqd0lUQndrQnBpNWQ1YlVVdVlZb2lqekhmLwovQVhiSzB6UmhOSVVTMEJSOGc3VkZWWFNIbm1mRldlQTVFc3psMzJRWTZSY0sxdFRndzcrOHBxRHpDZFhURFJUCkJLQ2hRL0FTckVuRXB1dTNFTVA3V1dQdGszdFZlRDBWWWhFdkFvR0FHYmQ2VWczNzg1cmxNTUNXR2JYRVF4Z1kKcVRYYzVEQUdwSFVlVFB3dTNvRjUzUW13bTZhQ3dDMHJOQ2hFTnQrQm9PVUQ2Sjk3S3Z2MUIxM3Q4d2FqS2xoNAovR3NHQ0lqa3JsQWVkaWZPQW5rbHZEcm1DamNZZHZDajk5VkNPTUwyYm9xcnNEcCtTRm1MblNkMXN2anF0aVVKCmx6UkVSKzhBaDJEN29LZFg0dmNDZ1lBbUhQNXZCWEEwdkh3eDlXekNmN3Noc3BLYzVDaFcvcUlYTk9mak9rdU4KK2lmQ0ZSVHdWdUVPbEx5a0M0a3hQbDdPNG5KSE5nZ0Z3T1VwV3I5MEZRRWpsaWRHQUg2cUdXSlNJZnhvQkFqNwpEU2hHeElyUFpBdmUvOHNrR3JINllTZjQ5UFAwcVlNY3liZGtEdFV4S2pyWTltQyt4RFBIOUVNVjQ3VFdZTWFUCmRRS0JnUUNYM0FNZitOL3hzMWh1MU1hNzN5OHBtYU1HdlB0NFYxNVRVK2ZrREhDQ09kSTZMRllYcHJwVThwZkMKOHpjejdRWndrV1AvU3NWRFBxL1pPdjN4b2J2QWNLS1VZUXdJdnZQcHJHeVpvYzlyek5UQ2JLdnE1bEo2U1liYwo5NUk1cmZZcmxFTDVtY1BxZENlQ3FJajhMMkJibGhYdXdIWkdOU0ZyaEFaWFc3Ynd5dz09Ci0tLS0tRU5EIFJTQSBQUklWQVRFIEtFWS0tLS0tCg==
+            app.kubernetes.io/part-of: cilium
+        rules:
+          - apiGroups:
+              - ""
+            resources:
+              - secrets
+            verbs:
+              - create
+          - apiGroups:
+              - ""
+            resources:
+              - secrets
+            resourceNames:
+              - hubble-server-certs
+              - hubble-relay-client-certs
+              - hubble-relay-server-certs
+              - hubble-metrics-server-certs
+              - hubble-ui-client-certs
+            verbs:
+              - update
+          - apiGroups:
+              - ""
+            resources:
+              - secrets
+            resourceNames:
+              - cilium-ca
+            verbs:
+              - get
+              - update
+        ---
+        # Source: cilium/templates/hubble/tls-cronjob/rolebinding.yaml
+        apiVersion: rbac.authorization.k8s.io/v1
+        kind: RoleBinding
+        metadata:
+          name: hubble-generate-certs
+          namespace: kube-system
+          labels:
+            app.kubernetes.io/part-of: cilium
+        roleRef:
+          apiGroup: rbac.authorization.k8s.io
+          kind: Role
+          name: hubble-generate-certs
+        subjects:
+        - kind: ServiceAccount
+          name: "hubble-generate-certs"
+          namespace: kube-system
+        ---
+        # Source: cilium/templates/hubble/tls-cronjob/job.yaml
+        apiVersion: batch/v1
+        kind: Job
+        metadata:
+          name: hubble-generate-certs-a3297ae8da
+          namespace: kube-system
+          labels:
+            k8s-app: hubble-generate-certs
+            app.kubernetes.io/name: hubble-generate-certs
+            app.kubernetes.io/part-of: cilium
+        spec:
+          template:
+            metadata:
+              labels:
+                k8s-app: hubble-generate-certs
+            spec:
+              securityContext:
+                seccompProfile:
+                  type: RuntimeDefault
+              containers:
+                - name: certgen
+                  image: "quay.io/cilium/certgen:v0.4.1@sha256:f0c656830e856d26b24b0e144df1f8b327d3b46748d76a630514111fc365b697"
+                  imagePullPolicy: IfNotPresent
+                  securityContext:
+                    capabilities:
+                      drop:
+                      - ALL
+                    allowPrivilegeEscalation: false
+                  command:
+                    - "/usr/bin/cilium-certgen"
+                  # Because this is executed as a job, we pass the values as command
+                  # line args instead of via config map. This allows users to inspect
+                  # the values used in past runs by inspecting the completed pod.
+                  args:
+                    - "--ca-generate=true"
+                    - "--ca-reuse-secret"
+                    - "--ca-secret-namespace=kube-system"
+                    - "--ca-secret-name=cilium-ca"
+                    - "--ca-common-name=Cilium CA"
+                  env:
+                    - name: CILIUM_CERTGEN_CONFIG
+                      value: |
+                        certs:
+                        - name: hubble-server-certs
+                          namespace: kube-system
+                          commonName: "*.default.hubble-grpc.cilium.io"
+                          hosts:
+                          - "*.default.hubble-grpc.cilium.io"
+                          usage:
+                          - signing
+                          - key encipherment
+                          - server auth
+                          - client auth
+                          validity: 8760h
+              hostNetwork: false
+              serviceAccountName: "hubble-generate-certs"
+              automountServiceAccountToken: true
+              restartPolicy: OnFailure
+        ---
+        # Source: cilium/templates/hubble/tls-cronjob/cronjob.yaml
+        apiVersion: batch/v1
+        kind: CronJob
+        metadata:
+          name: hubble-generate-certs
+          namespace: kube-system
+          labels:
+            k8s-app: hubble-generate-certs
+            app.kubernetes.io/name: hubble-generate-certs
+            app.kubernetes.io/part-of: cilium
+        spec:
+          schedule: "0 0 1 */4 *"
+          successfulJobsHistoryLimit: 3
+          failedJobsHistoryLimit: 1
+          concurrencyPolicy: Forbid
+          jobTemplate:
+            spec:
+              template:
+                metadata:
+                  labels:
+                    k8s-app: hubble-generate-certs
+                spec:
+                  securityContext:
+                    seccompProfile:
+                      type: RuntimeDefault
+                  containers:
+                    - name: certgen
+                      image: "quay.io/cilium/certgen:v0.4.1@sha256:f0c656830e856d26b24b0e144df1f8b327d3b46748d76a630514111fc365b697"
+                      imagePullPolicy: IfNotPresent
+                      securityContext:
+                        capabilities:
+                          drop:
+                          - ALL
+                        allowPrivilegeEscalation: false
+                      command:
+                        - "/usr/bin/cilium-certgen"
+                      # Because this is executed as a job, we pass the values as command
+                      # line args instead of via config map. This allows users to inspect
+                      # the values used in past runs by inspecting the completed pod.
+                      args:
+                        - "--ca-generate=true"
+                        - "--ca-reuse-secret"
+                        - "--ca-secret-namespace=kube-system"
+                        - "--ca-secret-name=cilium-ca"
+                        - "--ca-common-name=Cilium CA"
+                      env:
+                        - name: CILIUM_CERTGEN_CONFIG
+                          value: |
+                            certs:
+                            - name: hubble-server-certs
+                              namespace: kube-system
+                              commonName: "*.default.hubble-grpc.cilium.io"
+                              hosts:
+                              - "*.default.hubble-grpc.cilium.io"
+                              usage:
+                              - signing
+                              - key encipherment
+                              - server auth
+                              - client auth
+                              validity: 8760h
+                  hostNetwork: false
+                  serviceAccountName: "hubble-generate-certs"
+                  automountServiceAccountToken: true
+                  restartPolicy: OnFailure
         ---
         # Source: cilium/templates/cilium-configmap.yaml
         apiVersion: v1