gistfile1.txt

diff --git a/cmd/cache-server/main.go b/cmd/cache-server/main.go
index abf99223..3baa2b94 100644
--- a/cmd/cache-server/main.go
+++ b/cmd/cache-server/main.go
@@ -26,7 +26,7 @@ import (
 	"k8s.io/component-base/cli"
 
 	cacheserver "github.com/kcp-dev/kcp/pkg/cache/server"
-	"github.com/kcp-dev/kcp/pkg/cache/server/options"
+	"github.com/kcp-dev/kcp/cmd/cache-server/options"
 	"github.com/kcp-dev/kcp/pkg/cmd/help"
 	"github.com/kcp-dev/kcp/pkg/embeddedetcd"
 )
diff --git a/pkg/cache/server/config.go b/pkg/cache/server/config.go
index 522b57a0..bd6b68f9 100644
--- a/pkg/cache/server/config.go
+++ b/pkg/cache/server/config.go
@@ -119,14 +119,7 @@ func NewConfig(opts *cacheserveroptions.CompletedOptions, optionalLocalShardRest
 	if err := opts.Etcd.ApplyTo(&serverConfig.Config); err != nil {
 		return nil, err
 	}
-	if optionalLocalShardRestConfig == nil {
-		if err := opts.SecureServing.ApplyTo(&serverConfig.Config.SecureServing, &serverConfig.Config.LoopbackClientConfig); err != nil {
-			return nil, err
-		}
-	} else {
-		if err := opts.SecureServing.ApplyTo(&serverConfig.Config.SecureServing, nil); err != nil {
-			return nil, err
-		}
+	if optionalLocalShardRestConfig != nil {
 		serverConfig.LoopbackClientConfig = rest.CopyConfig(optionalLocalShardRestConfig)
 	}
 	if err := opts.Authentication.ApplyTo(&serverConfig.Config.Authentication, serverConfig.SecureServing, serverConfig.OpenAPIConfig); err != nil {
diff --git a/pkg/cache/server/options/options.go b/pkg/cache/server/options/options.go
index 7fa34a30..8ecb7bdc 100644
--- a/pkg/cache/server/options/options.go
+++ b/pkg/cache/server/options/options.go
@@ -29,7 +29,6 @@ import (
 type Options struct {
 	ServerRunOptions *genericoptions.ServerRunOptions
 	Etcd             *genericoptions.EtcdOptions
-	SecureServing    *genericoptions.SecureServingOptionsWithLoopback
 	Authentication   *genericoptions.DelegatingAuthenticationOptions
 	Authorization    *genericoptions.DelegatingAuthorizationOptions
 	APIEnablement    *genericoptions.APIEnablementOptions
@@ -39,7 +38,6 @@ type Options struct {
 type completedOptions struct {
 	ServerRunOptions *genericoptions.ServerRunOptions
 	Etcd             *genericoptions.EtcdOptions
-	SecureServing    *genericoptions.SecureServingOptionsWithLoopback
 	Authentication   *genericoptions.DelegatingAuthenticationOptions
 	Authorization    *genericoptions.DelegatingAuthorizationOptions
 	APIEnablement    *genericoptions.APIEnablementOptions
@@ -54,7 +52,6 @@ func (o *CompletedOptions) Validate() []error {
 	errors := []error{}
 	errors = append(errors, o.ServerRunOptions.Validate()...)
 	errors = append(errors, o.Etcd.Validate()...)
-	errors = append(errors, o.SecureServing.Validate()...)
 	errors = append(errors, o.Authentication.Validate()...)
 	errors = append(errors, o.Authorization.Validate()...)
 	errors = append(errors, o.APIEnablement.Validate()...)
@@ -67,7 +64,6 @@ func NewOptions(rootDir string) *Options {
 	o := &Options{
 		ServerRunOptions: genericoptions.NewServerRunOptions(),
 		Etcd:             genericoptions.NewEtcdOptions(storagebackend.NewDefaultConfig(kubeoptions.DefaultEtcdPathPrefix, nil)),
-		SecureServing:    genericoptions.NewSecureServingOptions().WithLoopback(),
 		Authentication:   genericoptions.NewDelegatingAuthenticationOptions(),
 		Authorization:    genericoptions.NewDelegatingAuthorizationOptions(),
 		APIEnablement:    genericoptions.NewAPIEnablementOptions(),
@@ -75,8 +71,6 @@ func NewOptions(rootDir string) *Options {
 	}
 
 	o.ServerRunOptions.EnablePriorityAndFairness = false
-	o.SecureServing.ServerCert.CertDirectory = rootDir
-	o.SecureServing.BindPort = 6443
 	o.Etcd.StorageConfig.Transport.ServerList = []string{"embedded"}
 	// TODO: enable the watch cache, it was disabled because
 	//  - we need to pass a shard name so that the watch cache can calculate the key
@@ -95,14 +89,9 @@ func (o *Options) Complete() (*CompletedOptions, error) {
 	o.Authentication = nil
 	o.Authorization = nil
 
-	if err := o.SecureServing.MaybeDefaultWithSelfSignedCerts("localhost", nil, nil); err != nil {
-		return nil, err
-	}
-
 	return &CompletedOptions{&completedOptions{
 		ServerRunOptions: o.ServerRunOptions,
 		Etcd:             o.Etcd,
-		SecureServing:    o.SecureServing,
 		Authentication:   o.Authentication,
 		Authorization:    o.Authorization,
 		APIEnablement:    o.APIEnablement,