How to categorize this issue?

/area os robustness
/kind enhancement

What would you like to be added:
Custom CA certs provided via CloudProfile or Shoot to be installed also on existing nodes.

Why is this needed:
#1515 installed custom CA from cloudProfile/shoot only on newly created nodes, the reason was that docker daemon had to be restarted to activate the newly installed certs, however restarting docker daemon triggers restart for all containers which was causing issues for the already existing workload. Now, containerd can be restarted without restarting the already running containers, see moby/moby#46449 (comment).