This is needeed for bootstrapping the control plane,
because it's a CRD so can't be registered until the control plane is running.
It's also quite nice because we might want to review the contents of the
host CRD, e.g. to verify the key out-of-band.
This supports workflows that modify the local kubeconfig for advanced configurations,
which were accidentally broken by trying to always generate the config.
Issue #17262