When I describe the secret in capi-system it does ...
# cluster-api
f
When I describe the secret in capi-system it does confirm that the certs are selfsigned.