It's worrying that this is considered minimal pain in the k8s world. It's not a ding, it's a sign that it's not a platform to be taken or used on a whim but with serious considerations about time involved.
I believe dealing with certificates that include the ability to end-to-end test them is never simple.