diff --git a/deploy/pve-cloud-controller-manager.yaml b/deploy/pve-cloud-controller-manager.yaml
index e694df8..ccabca5 100644
--- a/deploy/pve-cloud-controller-manager.yaml
+++ b/deploy/pve-cloud-controller-manager.yaml
@@ -70,61 +70,68 @@ subjects:
   name: cloud-controller-manager
   namespace: kube-system
 ---
-apiVersion: v1
-kind: Pod
+apiVersion: apps/v1
+kind: Deployment
 metadata:
   name: pve-cloud-controller-manager
   namespace: kube-system
   labels:
     app: pve-cloud-controller-manager
 spec:
-  priorityClassName: system-node-critical
-  #hostNetwork: true
-  containers:
-  - args:
-    - --cloud-config=/etc/kubernetes/pve.json
-    - --tls-min-version=VersionTLS12
-    - --tls-cipher-suites="TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"
-    - --cloud-provider=pve
-    - --leader-elect=true
-    image: reg.k8s.giftfish.de/library/pve-cloud-controller-manager-amd64:dev
-    imagePullPolicy: Always
-    livenessProbe:
-      httpGet:
-        path: /healthz
-        port: 10258
-        scheme: HTTPS
-      initialDelaySeconds: 3
-      periodSeconds: 3
-    name: manager
-    resources:
-      requests:
-        cpu: 100m
-        memory: 50Mi
-    volumeMounts:
-    - name: etc-kubernetes
-      mountPath: /etc/kubernetes
-      readOnly: true
-    - name: etc-ssl
-      mountPath: /etc/ssl
-      readOnly: true
-  volumes:
-  - name: etc-kubernetes
-    hostPath:
-      path: /etc/kubernetes
-  - name: etc-ssl
-    hostPath:
-      path: /etc/ssl
-  dnsPolicy: Default
-  serviceAccountName: cloud-controller-manager
-  tolerations:
-  - effect: NoSchedule
-    key: node.cloudprovider.kubernetes.io/uninitialized
-    value: "true"
-  - key: CriticalAddonsOnly
-    operator: Exists
-  - effect: NoSchedule
-    key: node-role.kubernetes.io/master
-  - effect: NoSchedule
-    key: node.kubernetes.io/not-ready
-
+  replicas: 1
+  selector:
+    matchLabels:
+      app: pve-cloud-controller-manager
+  template:
+    metadata:
+      labels:
+        app: pve-cloud-controller-manager
+    spec:
+      priorityClassName: system-node-critical
+      containers:
+      - args:
+        - --cloud-config=/etc/kubernetes/pve.json
+        - --tls-min-version=VersionTLS12
+        - --tls-cipher-suites="TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"
+        - --cloud-provider=pve
+        - --leader-elect=true
+        image: reg.k8s.giftfish.de/library/pve-cloud-controller-manager-amd64:dev
+        imagePullPolicy: Always
+        livenessProbe:
+          httpGet:
+            path: /healthz
+            port: 10258
+            scheme: HTTPS
+          initialDelaySeconds: 3
+          periodSeconds: 3
+        name: manager
+        resources:
+          requests:
+            cpu: 100m
+            memory: 50Mi
+        volumeMounts:
+        - name: config
+          mountPath: /etc/kubernetes/pve.json
+          readOnly: true
+        - name: ca-certs
+          mountPath: /etc/ssl/certs
+          readOnly: true
+      volumes:
+      - name: config
+        hostPath:
+          path: /etc/kubernetes/pve.json
+      - name: ca-certs
+        hostPath:
+          path: /etc/ssl/certs
+      dnsPolicy: Default
+      serviceAccountName: cloud-controller-manager
+      tolerations:
+      - effect: NoSchedule
+        key: node.cloudprovider.kubernetes.io/uninitialized
+        value: "true"
+      - key: CriticalAddonsOnly
+        operator: Exists
+      - effect: NoSchedule
+        key: node-role.kubernetes.io/master
+      - effect: NoSchedule
+        key: node.kubernetes.io/not-ready
diff --git a/deploy/pve-csr-approver-manager.yaml b/deploy/pve-csr-approver-manager.yaml
index bac047b..4444d15 100644
--- a/deploy/pve-csr-approver-manager.yaml
+++ b/deploy/pve-csr-approver-manager.yaml
@@ -46,56 +46,64 @@ subjects:
   namespace: kube-system
   name: pve-csr-approver
 ---
-apiVersion: v1
-kind: Pod
+apiVersion: apps/v1
+kind: Deployment
 metadata:
   name: pve-csr-approver-manager
   namespace: kube-system
   labels:
     app: pve-csr-approver-manager
 spec:
-  priorityClassName: system-node-critical
-  #hostNetwork: true
-  containers:
-  - args:
-    - --cloud-config=/etc/kubernetes/pve.json
-    - --leader-elect=true
-    name: manager
-    image: reg.k8s.giftfish.de/library/pve-csr-approver-manager-amd64:dev
-    imagePullPolicy: Always
-    livenessProbe:
-      httpGet:
-        path: /healthz
-        port: 9449
-      initialDelaySeconds: 3
-      periodSeconds: 3
-    resources:
-      requests:
-        cpu: 100m
-        memory: 50Mi
-    volumeMounts:
-    - name: etc-kubernetes
-      mountPath: /etc/kubernetes
-      readOnly: true
-    - name: etc-ssl
-      mountPath: /etc/ssl
-      readOnly: true
-  volumes:
-  - name: etc-kubernetes
-    hostPath:
-      path: /etc/kubernetes
-  - name: etc-ssl
-    hostPath:
-      path: /etc/ssl
-  dnsPolicy: Default
-  serviceAccountName: pve-csr-approver
-  tolerations:
-  - effect: NoSchedule
-    key: node.cloudprovider.kubernetes.io/uninitialized
-    value: "true"
-  - key: CriticalAddonsOnly
-    operator: Exists
-  - effect: NoSchedule
-    key: node-role.kubernetes.io/master
-  - effect: NoSchedule
-    key: node.kubernetes.io/not-ready
+  replicas: 1
+  selector:
+    matchLabels:
+      app: pve-csr-approver-manager
+  template:
+    metadata:
+      labels:
+        app: pve-csr-approver-manager
+    spec:
+      priorityClassName: system-node-critical
+      containers:
+      - args:
+        - --cloud-config=/etc/kubernetes/pve.json
+        - --leader-elect=true
+        name: manager
+        image: reg.k8s.giftfish.de/library/pve-csr-approver-manager-amd64:dev
+        imagePullPolicy: Always
+        livenessProbe:
+          httpGet:
+            path: /healthz
+            port: 9449
+          initialDelaySeconds: 3
+          periodSeconds: 3
+        resources:
+          requests:
+            cpu: 100m
+            memory: 50Mi
+        volumeMounts:
+        - name: config
+          mountPath: /etc/kubernetes/pve.json
+          readOnly: true
+        - name: ca-certs
+          mountPath: /etc/ssl/certs
+          readOnly: true
+      volumes:
+      - name: config
+        hostPath:
+          path: /etc/kubernetes/pve.json
+      - name: ca-certs
+        hostPath:
+          path: /etc/ssl/certs
+      dnsPolicy: Default
+      serviceAccountName: pve-csr-approver
+      tolerations:
+      - effect: NoSchedule
+        key: node.cloudprovider.kubernetes.io/uninitialized
+        value: "true"
+      - key: CriticalAddonsOnly
+        operator: Exists
+      - effect: NoSchedule
+        key: node-role.kubernetes.io/master
+      - effect: NoSchedule
+        key: node.kubernetes.io/not-ready