Describe the problem/challenge you have
Running flow aggregator as multi replica in proxy mode will only allow TLS to one of the N replicas.

Describe the solution you'd like
Only one replica should modify any of the shared resource and the others react to the change and update themselves accordingly.

Anything else you would like to add?
The flow aggregator is regenerating the ca, client and server certs on startup so the last flow aggregator "wins" by clobbering the certs for the other Flow Aggregators. This expands beyond multi-replica FA in proxy mode, as additional deployments to the same namespace should work/function similarly. The CA should be shared amongst all FA replicas (regardless of same deployment or not).