The Installer creates the initial version of the root credential secret at kube-system / openstack-credentials, which cloud-credential-operator (CCO) will consume. Once we have support in CCO for consuming a CA cert from this root credential, we should modify the Installer to start populating the CA cert field. We should also stop adding the CA cert to the openshift-cloud-controller-manager / cloud-conf config map since the Cloud Config Operator (and CSI Drivers) will be able to start consuming the CA cert from the secret instead. This may need to be done separately depending on the order that patches land in.