Follow-up from "Add config.caCert for self-signed KAS addresses"

The following discussion from !6 (merged) should be addressed:

• @ash2k started a discussion:

  Not in this MR: do we want to start using readOnly: true? It needs to be behind a version check, it was introduced recently. https://kubernetes.io/docs/concepts/configuration/secret/ Doesn't explain what this flag does...