- Set peer urls for default etcd instance to avoid leaving peer port unsecured - Update generated etcd peer certificate SANs to include localhost - Use a proper CN for etcd server and peer certificates - Increase the manifest update timeout