diff --git a/kube/cockroachdb.libsonnet b/kube/cockroachdb.libsonnet
index c5d2e35..a62e79c 100644
--- a/kube/cockroachdb.libsonnet
+++ b/kube/cockroachdb.libsonnet
@@ -240,17 +240,17 @@
                                     mountPath: "/cockroach/cockroach-data",
                                 },
                                 {
-                                    name: "cockroachdb-node-cert",
+                                    name: "certs",
                                     mountPath: "/cockroach/cockroach-certs/node.crt",
                                     subPath: "tls.crt",
                                 },
                                 {
-                                    name: "cockroachdb-node-cert",
+                                    name: "certs",
                                     mountPath: "/cockroach/cockroach-certs/node.key",
                                     subPath: "tls.key",
                                 },
                                 {
-                                    name: "cockroachdb-node-cert",
+                                    name: "certs",
                                     mountPath: "/cockroach/cockroach-certs/ca.crt",
                                     subPath: "ca.crt",
                                 },
@@ -272,11 +272,11 @@
                             emptyDir: {},
                         },
                         {
-                            name: "cockroachdb-node-cert",
+                            name: "certs",
                             secret: {
                                 secretName: crdb.pki.nodeCertificate.spec.secretName,
-                                defaultMode: kube.parseOctal("400")
-                            }
+                                defaultMode: kube.parseOctal("400"),
+                            },
                         },
                     ],
                 },
@@ -309,17 +309,17 @@
                             ],
                             volumeMounts: [
                                 {
-                                    name: "cockroachdb-client-cert",
+                                    name: "certs",
                                     mountPath: "/cockroach/cockroach-certs/ca.crt",
                                     subPath: "ca.crt",
                                 },
                                 {
-                                    name: "cockroachdb-client-cert",
+                                    name: "certs",
                                     mountPath: "/cockroach/cockroach-certs/client.root.crt",
                                     subPath: "tls.crt",
                                 },
                                 {
-                                    name: "cockroachdb-client-cert",
+                                    name: "certs",
                                     mountPath: "/cockroach/cockroach-certs/client.root.key",
                                     subPath: "tls.key",
                                 },
@@ -343,17 +343,17 @@
                             ],
                             volumeMounts: [
                                 {
-                                    name: "cockroachdb-client-cert",
+                                    name: "certs",
                                     mountPath: "/cockroach/cockroach-certs/ca.crt",
                                     subPath: "ca.crt",
                                 },
                                 {
-                                    name: "cockroachdb-client-cert",
+                                    name: "certs",
                                     mountPath: "/cockroach/cockroach-certs/client.root.crt",
                                     subPath: "tls.crt",
                                 },
                                 {
-                                    name: "cockroachdb-client-cert",
+                                    name: "certs",
                                     mountPath: "/cockroach/cockroach-certs/client.root.key",
                                     subPath: "tls.key",
                                 },
@@ -363,7 +363,7 @@
                     restartPolicy: "OnFailure",
                     volumes: [
                         {
-                            name: "cockroachdb-client-cert",
+                            name: "certs",
                             secret: {
                                 secretName: crdb.pki.clientCertificate.spec.secretName,
                                 defaultMode: kube.parseOctal("400")
@@ -378,6 +378,7 @@
     clientPod: kube.Pod(crdb.makeName("cockroachdb-client")) {
         metadata+: crdb.metadata,
         spec: {
+            terminationGracePeriodSeconds: 5,
             containers: [
                 kube.Container("cockroachdb-client") {
                     image: cfg.image,
@@ -387,17 +388,17 @@
                     command: ["sleep", "2147483648"], //(FIXME) keep the client pod running indefinitely
                     volumeMounts: [
                         {
-                            name: "cockroachdb-client-cert",
+                            name: "certs",
                             mountPath: "/cockroach/cockroach-certs/ca.crt",
                             subPath: "ca.crt",
                         },
                         {
-                            name: "cockroachdb-client-cert",
+                            name: "certs",
                             mountPath: "/cockroach/cockroach-certs/client.root.crt",
                             subPath: "tls.crt",
                         },
                         {
-                            name: "cockroachdb-client-cert",
+                            name: "certs",
                             mountPath: "/cockroach/cockroach-certs/client.root.key",
                             subPath: "tls.key",
                         },
@@ -406,7 +407,7 @@
             ],
             volumes: [
                 {
-                    name: "cockroachdb-client-cert",
+                    name: "certs",
                     secret: {
                         secretName: crdb.pki.clientCertificate.spec.secretName,
                         defaultMode: kube.parseOctal("400")