diff --git a/packages/apps/kubernetes/templates/_helpers.tpl b/packages/apps/kubernetes/templates/_helpers.tpl
index 36c06b64..89f06934 100644
--- a/packages/apps/kubernetes/templates/_helpers.tpl
+++ b/packages/apps/kubernetes/templates/_helpers.tpl
@@ -49,3 +49,43 @@ Selector labels
 app.kubernetes.io/name: {{ include "kubernetes.name" . }}
 app.kubernetes.io/instance: {{ .Release.Name }}
 {{- end }}
+
+{{/*
+wait-for-kubeconfig init container shared by the control-plane-side
+Deployments (cluster-autoscaler, kccm, kcsi-controller) that mount the
+*-admin-kubeconfig Secret provisioned asynchronously by Kamaji. The
+Secret volume is declared optional so kubelet does not FailedMount while
+Kamaji is still bootstrapping; this container polls the mounted path and
+exits only when super-admin.svc appears, which happens after kubelet's
+optional-Secret refresh cycle.
+
+The 10m deadline stays strictly below the 15m HelmRelease
+Install.Timeout scoped to the Kubernetes Application kind so the
+CrashLoopBackOff surfaces before flux remediation fires and uninstalls
+the Cluster CR.
+
+Call site owns the surrounding volumes block; the kubeconfig volume
+must exist on the pod and mount at /etc/kubernetes/kubeconfig.
+*/}}
+{{- define "kubernetes.waitForAdminKubeconfig" -}}
+- name: wait-for-kubeconfig
+  image: "{{ .Files.Get "images/busybox.tag" | trim }}"
+  command:
+  - sh
+  - -c
+  - |
+    set -eu
+    deadline=$(( $(date +%s) + 600 ))
+    until [ -s /etc/kubernetes/kubeconfig/super-admin.svc ]; do
+      if [ "$(date +%s)" -ge "$deadline" ]; then
+        echo "admin kubeconfig was not provisioned within 10m; exiting so the pod goes CrashLoopBackOff and surfaces in dashboards" >&2
+        exit 1
+      fi
+      echo "waiting for admin kubeconfig (provisioned by Kamaji, visible after kubelet Secret refresh)..."
+      sleep 5
+    done
+  volumeMounts:
+  - name: kubeconfig
+    mountPath: /etc/kubernetes/kubeconfig
+    readOnly: true
+{{- end }}
diff --git a/packages/apps/kubernetes/templates/cluster-autoscaler/deployment.yaml b/packages/apps/kubernetes/templates/cluster-autoscaler/deployment.yaml
index 277b6df8..348b017d 100644
--- a/packages/apps/kubernetes/templates/cluster-autoscaler/deployment.yaml
+++ b/packages/apps/kubernetes/templates/cluster-autoscaler/deployment.yaml
@@ -24,26 +24,7 @@ spec:
           operator: Exists
           effect: "NoSchedule"
       initContainers:
-      - name: wait-for-kubeconfig
-        image: "{{ $.Files.Get "images/busybox.tag" | trim }}"
-        command:
-        - sh
-        - -c
-        - |
-          set -eu
-          deadline=$(( $(date +%s) + 1200 ))
-          until [ -s /etc/kubernetes/kubeconfig/super-admin.svc ]; do
-            if [ "$(date +%s)" -ge "$deadline" ]; then
-              echo "admin kubeconfig was not provisioned within 20m; exiting so the pod goes CrashLoopBackOff and surfaces in dashboards" >&2
-              exit 1
-            fi
-            echo "waiting for admin kubeconfig to be provisioned by Kamaji..."
-            sleep 5
-          done
-        volumeMounts:
-        - name: kubeconfig
-          mountPath: /etc/kubernetes/kubeconfig
-          readOnly: true
+      {{- include "kubernetes.waitForAdminKubeconfig" $ | nindent 6 }}
       containers:
       - image: "{{ $.Files.Get "images/cluster-autoscaler.tag" | trim }}"
         name: cluster-autoscaler
diff --git a/packages/apps/kubernetes/templates/csi/deploy.yaml b/packages/apps/kubernetes/templates/csi/deploy.yaml
index ff170cb8..c1af7f13 100644
--- a/packages/apps/kubernetes/templates/csi/deploy.yaml
+++ b/packages/apps/kubernetes/templates/csi/deploy.yaml
@@ -25,26 +25,7 @@ spec:
           operator: Exists
           effect: "NoSchedule"
       initContainers:
-        - name: wait-for-kubeconfig
-          image: "{{ $.Files.Get "images/busybox.tag" | trim }}"
-          command:
-          - sh
-          - -c
-          - |
-            set -eu
-            deadline=$(( $(date +%s) + 1200 ))
-            until [ -s /etc/kubernetes/kubeconfig/super-admin.svc ]; do
-              if [ "$(date +%s)" -ge "$deadline" ]; then
-                echo "admin kubeconfig was not provisioned within 20m; exiting so the pod goes CrashLoopBackOff and surfaces in dashboards" >&2
-                exit 1
-              fi
-              echo "waiting for admin kubeconfig to be provisioned by Kamaji..."
-              sleep 5
-            done
-          volumeMounts:
-          - name: kubeconfig
-            mountPath: /etc/kubernetes/kubeconfig
-            readOnly: true
+      {{- include "kubernetes.waitForAdminKubeconfig" $ | nindent 6 }}
       containers:
         - name: csi-driver
           imagePullPolicy: Always
diff --git a/packages/apps/kubernetes/templates/kccm/manager.yaml b/packages/apps/kubernetes/templates/kccm/manager.yaml
index 67321647..20ac0a1e 100644
--- a/packages/apps/kubernetes/templates/kccm/manager.yaml
+++ b/packages/apps/kubernetes/templates/kccm/manager.yaml
@@ -23,26 +23,7 @@ spec:
           operator: Exists
           effect: "NoSchedule"
       initContainers:
-      - name: wait-for-kubeconfig
-        image: "{{ $.Files.Get "images/busybox.tag" | trim }}"
-        command:
-        - sh
-        - -c
-        - |
-          set -eu
-          deadline=$(( $(date +%s) + 1200 ))
-          until [ -s /etc/kubernetes/kubeconfig/super-admin.svc ]; do
-            if [ "$(date +%s)" -ge "$deadline" ]; then
-              echo "admin kubeconfig was not provisioned within 20m; exiting so the pod goes CrashLoopBackOff and surfaces in dashboards" >&2
-              exit 1
-            fi
-            echo "waiting for admin kubeconfig to be provisioned by Kamaji..."
-            sleep 5
-          done
-        volumeMounts:
-        - name: kubeconfig
-          mountPath: /etc/kubernetes/kubeconfig
-          readOnly: true
+      {{- include "kubernetes.waitForAdminKubeconfig" $ | nindent 6 }}
       containers:
       - name: kubevirt-cloud-controller-manager
         args: