The MCOA addon has the responsibility of creating resources necessary for authenticating spoke workloads with the hub cluster. However, once these resources are created they are not tracked by the addon to be reconciled. So if for instance, cert-manager updates a secret then this secret will not trigger an update to the ManifestWorks resource.

Resources created by the MCOA addon should trigger a ManifestWorks update when they are updated.