diff --git a/pkg/cli/cert/cert.go b/pkg/cli/cert/cert.go
index 140cc138df..ca4fe746a2 100644
--- a/pkg/cli/cert/cert.go
+++ b/pkg/cli/cert/cert.go
@@ -77,7 +77,7 @@ func rotate(app *cli.Context, cfg *cmds.Server) error {
 
 	serverConfig.ControlConfig.DataDir = serverDataDir
 	serverConfig.ControlConfig.Runtime = &config.ControlRuntime{}
-	deps.CreateRuntimeCertFiles(&serverConfig.ControlConfig, serverConfig.ControlConfig.Runtime)
+	deps.CreateRuntimeCertFiles(&serverConfig.ControlConfig)
 
 	if err := validateCertConfig(); err != nil {
 		return err
diff --git a/pkg/cluster/bootstrap.go b/pkg/cluster/bootstrap.go
index 01a60078db..d2ecd2dc09 100644
--- a/pkg/cluster/bootstrap.go
+++ b/pkg/cluster/bootstrap.go
@@ -196,7 +196,7 @@ func createTmpDataDir(src, dst string) error {
 func (c *Cluster) shouldBootstrapLoad(ctx context.Context) (bool, bool, error) {
 	// Non-nil managedDB indicates that the database is either initialized, initializing, or joining
 	if c.managedDB != nil {
-		c.runtime.HTTPBootstrap = true
+		c.config.Runtime.HTTPBootstrap = true
 
 		isInitialized, err := c.managedDB.IsInitialized(ctx, c.config)
 		if err != nil {
@@ -363,7 +363,7 @@ func (c *Cluster) ReconcileBootstrapData(ctx context.Context, buf io.ReadSeeker,
 	if c.managedDB != nil && !isHTTP {
 		token := c.config.Token
 		if token == "" {
-			tokenFromFile, err := readTokenFromFile(c.runtime.ServerToken, c.runtime.ServerCA, c.config.DataDir)
+			tokenFromFile, err := readTokenFromFile(c.config.Runtime.ServerToken, c.config.Runtime.ServerCA, c.config.DataDir)
 			if err != nil {
 				return err
 			}
@@ -600,7 +600,7 @@ func (c *Cluster) httpBootstrap(ctx context.Context) error {
 
 func (c *Cluster) retrieveInitializedDBdata(ctx context.Context) (*bytes.Buffer, error) {
 	var buf bytes.Buffer
-	if err := bootstrap.ReadFromDisk(&buf, &c.runtime.ControlRuntimeBootstrap); err != nil {
+	if err := bootstrap.ReadFromDisk(&buf, &c.config.Runtime.ControlRuntimeBootstrap); err != nil {
 		return nil, err
 	}
 
@@ -612,7 +612,7 @@ func (c *Cluster) bootstrap(ctx context.Context) error {
 	c.joining = true
 
 	// bootstrap managed database via HTTPS
-	if c.runtime.HTTPBootstrap {
+	if c.config.Runtime.HTTPBootstrap {
 		// Assuming we should just compare on managed databases
 		if err := c.compareConfig(); err != nil {
 			return errors.Wrap(err, "failed to validate server configuration")
diff --git a/pkg/cluster/cluster.go b/pkg/cluster/cluster.go
index eb2a5a4c71..47bb3f18c4 100644
--- a/pkg/cluster/cluster.go
+++ b/pkg/cluster/cluster.go
@@ -18,7 +18,6 @@ import (
 type Cluster struct {
 	clientAccessInfo *clientaccess.Info
 	config           *config.Control
-	runtime          *config.ControlRuntime
 	managedDB        managed.Driver
 	EtcdConfig       endpoint.ETCDConfig
 	joining          bool
@@ -149,7 +148,6 @@ func (c *Cluster) startStorage(ctx context.Context) error {
 // New creates an initial cluster using the provided configuration.
 func New(config *config.Control) *Cluster {
 	return &Cluster{
-		config:  config,
-		runtime: config.Runtime,
+		config: config,
 	}
 }
diff --git a/pkg/cluster/https.go b/pkg/cluster/https.go
index fc9f844183..0a90312e1d 100644
--- a/pkg/cluster/https.go
+++ b/pkg/cluster/https.go
@@ -39,11 +39,11 @@ func (c *Cluster) newListener(ctx context.Context) (net.Listener, http.Handler,
 	if err != nil {
 		return nil, nil, err
 	}
-	cert, key, err := factory.LoadCerts(c.runtime.ServerCA, c.runtime.ServerCAKey)
+	cert, key, err := factory.LoadCerts(c.config.Runtime.ServerCA, c.config.Runtime.ServerCAKey)
 	if err != nil {
 		return nil, nil, err
 	}
-	storage := tlsStorage(ctx, c.config.DataDir, c.runtime)
+	storage := tlsStorage(ctx, c.config.DataDir, c.config.Runtime)
 	return dynamiclistener.NewListener(tcp, storage, cert, key, dynamiclistener.Config{
 		ExpirationDaysCheck: config.CertificateRenewDays,
 		Organization:        []string{version.Program},
diff --git a/pkg/cluster/managed.go b/pkg/cluster/managed.go
index 0c5e3519b7..222b9ae4fe 100644
--- a/pkg/cluster/managed.go
+++ b/pkg/cluster/managed.go
@@ -184,11 +184,11 @@ func (c *Cluster) deleteNodePasswdSecret(ctx context.Context) {
 		}
 		// the core factory may not yet be initialized so we
 		// want to wait until it is so not to evoke a panic.
-		if c.runtime.Core == nil {
+		if c.config.Runtime.Core == nil {
 			logrus.Infof("runtime is not yet initialized")
 			continue
 		}
-		secretsClient := c.runtime.Core.Core().V1().Secret()
+		secretsClient := c.config.Runtime.Core.Core().V1().Secret()
 		if err := nodepassword.Delete(secretsClient, nodeName); err != nil {
 			if apierrors.IsNotFound(err) {
 				logrus.Debugf("node password secret is not found for node %s", nodeName)
diff --git a/pkg/cluster/router.go b/pkg/cluster/router.go
index 2a894274e4..4fe2694a72 100644
--- a/pkg/cluster/router.go
+++ b/pkg/cluster/router.go
@@ -19,11 +19,11 @@ func (c *Cluster) getHandler(handler http.Handler) (http.Handler, error) {
 // if no additional handlers are available.
 func (c *Cluster) router() http.Handler {
 	return http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
-		if c.runtime.Handler == nil {
+		if c.config.Runtime.Handler == nil {
 			http.Error(rw, "starting", http.StatusServiceUnavailable)
 			return
 		}
 
-		c.runtime.Handler.ServeHTTP(rw, req)
+		c.config.Runtime.Handler.ServeHTTP(rw, req)
 	})
 }
diff --git a/pkg/cluster/storage.go b/pkg/cluster/storage.go
index bc4049ac52..0bf66024a6 100644
--- a/pkg/cluster/storage.go
+++ b/pkg/cluster/storage.go
@@ -107,7 +107,7 @@ func (c *Cluster) storageBootstrap(ctx context.Context) error {
 
 	token := c.config.Token
 	if token == "" {
-		tokenFromFile, err := readTokenFromFile(c.runtime.ServerToken, c.runtime.ServerCA, c.config.DataDir)
+		tokenFromFile, err := readTokenFromFile(c.config.Runtime.ServerToken, c.config.Runtime.ServerCA, c.config.DataDir)
 		if err != nil {
 			return err
 		}
diff --git a/pkg/daemons/control/deps/deps.go b/pkg/daemons/control/deps/deps.go
index f188cc7074..f23fb9f3d1 100644
--- a/pkg/daemons/control/deps/deps.go
+++ b/pkg/daemons/control/deps/deps.go
@@ -94,7 +94,8 @@ func KubeConfig(dest, url, caCert, clientCert, clientKey string) error {
 
 // CreateRuntimeCertFiles is responsible for filling out all the
 // .crt and .key filenames for a ControlRuntime.
-func CreateRuntimeCertFiles(config *config.Control, runtime *config.ControlRuntime) {
+func CreateRuntimeCertFiles(config *config.Control) {
+	runtime := config.Runtime
 	runtime.ClientCA = filepath.Join(config.DataDir, "tls", "client-ca.crt")
 	runtime.ClientCAKey = filepath.Join(config.DataDir, "tls", "client-ca.key")
 	runtime.ServerCA = filepath.Join(config.DataDir, "tls", "server-ca.crt")
@@ -156,8 +157,9 @@ func CreateRuntimeCertFiles(config *config.Control, runtime *config.ControlRunti
 
 // GenServerDeps is responsible for generating the cluster dependencies
 // needed to successfully bootstrap a cluster.
-func GenServerDeps(config *config.Control, runtime *config.ControlRuntime) error {
-	if err := genCerts(config, runtime); err != nil {
+func GenServerDeps(config *config.Control) error {
+	runtime := config.Runtime
+	if err := genCerts(config); err != nil {
 		return err
 	}
 
@@ -165,15 +167,15 @@ func GenServerDeps(config *config.Control, runtime *config.ControlRuntime) error
 		return err
 	}
 
-	if err := genUsers(config, runtime); err != nil {
+	if err := genUsers(config); err != nil {
 		return err
 	}
 
-	if err := genEncryptedNetworkInfo(config, runtime); err != nil {
+	if err := genEncryptedNetworkInfo(config); err != nil {
 		return err
 	}
 
-	if err := genEncryptionConfigAndState(config, runtime); err != nil {
+	if err := genEncryptionConfigAndState(config); err != nil {
 		return err
 	}
 
@@ -206,7 +208,8 @@ func getNodePass(config *config.Control, serverPass string) string {
 	return config.AgentToken
 }
 
-func genUsers(config *config.Control, runtime *config.ControlRuntime) error {
+func genUsers(config *config.Control) error {
+	runtime := config.Runtime
 	passwd, err := passwd.Read(runtime.PasswdFile)
 	if err != nil {
 		return err
@@ -234,7 +237,8 @@ func genUsers(config *config.Control, runtime *config.ControlRuntime) error {
 	return passwd.Write(runtime.PasswdFile)
 }
 
-func genEncryptedNetworkInfo(controlConfig *config.Control, runtime *config.ControlRuntime) error {
+func genEncryptedNetworkInfo(controlConfig *config.Control) error {
+	runtime := controlConfig.Runtime
 	if s, err := os.Stat(runtime.IPSECKey); err == nil && s.Size() > 0 {
 		psk, err := ioutil.ReadFile(runtime.IPSECKey)
 		if err != nil {
@@ -272,17 +276,17 @@ func getServerPass(passwd *passwd.Passwd, config *config.Control) (string, error
 	return serverPass, nil
 }
 
-func genCerts(config *config.Control, runtime *config.ControlRuntime) error {
-	if err := genClientCerts(config, runtime); err != nil {
+func genCerts(config *config.Control) error {
+	if err := genClientCerts(config); err != nil {
 		return err
 	}
-	if err := genServerCerts(config, runtime); err != nil {
+	if err := genServerCerts(config); err != nil {
 		return err
 	}
-	if err := genRequestHeaderCerts(config, runtime); err != nil {
+	if err := genRequestHeaderCerts(config); err != nil {
 		return err
 	}
-	return genETCDCerts(config, runtime)
+	return genETCDCerts(config)
 }
 
 func getSigningCertFactory(regen bool, altNames *certutil.AltNames, extKeyUsage []x509.ExtKeyUsage, caCertFile, caKeyFile string) signedCertFactory {
@@ -291,7 +295,8 @@ func getSigningCertFactory(regen bool, altNames *certutil.AltNames, extKeyUsage
 	}
 }
 
-func genClientCerts(config *config.Control, runtime *config.ControlRuntime) error {
+func genClientCerts(config *config.Control) error {
+	runtime := config.Runtime
 	regen, err := createSigningCertKey(version.Program+"-client", runtime.ClientCA, runtime.ClientCAKey)
 	if err != nil {
 		return err
@@ -367,8 +372,9 @@ func genClientCerts(config *config.Control, runtime *config.ControlRuntime) erro
 	return nil
 }
 
-func genServerCerts(config *config.Control, runtime *config.ControlRuntime) error {
-	regen, err := createServerSigningCertKey(config, runtime)
+func genServerCerts(config *config.Control) error {
+	runtime := config.Runtime
+	regen, err := createServerSigningCertKey(config)
 	if err != nil {
 		return err
 	}
@@ -393,7 +399,8 @@ func genServerCerts(config *config.Control, runtime *config.ControlRuntime) erro
 	return nil
 }
 
-func genETCDCerts(config *config.Control, runtime *config.ControlRuntime) error {
+func genETCDCerts(config *config.Control) error {
+	runtime := config.Runtime
 	regen, err := createSigningCertKey("etcd-server", runtime.ETCDServerCA, runtime.ETCDServerCAKey)
 	if err != nil {
 		return err
@@ -431,7 +438,8 @@ func genETCDCerts(config *config.Control, runtime *config.ControlRuntime) error
 	return nil
 }
 
-func genRequestHeaderCerts(config *config.Control, runtime *config.ControlRuntime) error {
+func genRequestHeaderCerts(config *config.Control) error {
+	runtime := config.Runtime
 	regen, err := createSigningCertKey(version.Program+"-request-header", runtime.RequestHeaderCA, runtime.RequestHeaderCAKey)
 	if err != nil {
 		return err
@@ -449,7 +457,8 @@ func genRequestHeaderCerts(config *config.Control, runtime *config.ControlRuntim
 
 type signedCertFactory = func(commonName string, organization []string, certFile, keyFile string) (bool, error)
 
-func createServerSigningCertKey(config *config.Control, runtime *config.ControlRuntime) (bool, error) {
+func createServerSigningCertKey(config *config.Control) (bool, error) {
+	runtime := config.Runtime
 	TokenCA := filepath.Join(config.DataDir, "tls", "token-ca.crt")
 	TokenCAKey := filepath.Join(config.DataDir, "tls", "token-ca.key")
 
@@ -653,7 +662,8 @@ func expired(certFile string, pool *x509.CertPool) bool {
 	return certutil.IsCertExpired(certificates[0], config.CertificateRenewDays)
 }
 
-func genEncryptionConfigAndState(controlConfig *config.Control, runtime *config.ControlRuntime) error {
+func genEncryptionConfigAndState(controlConfig *config.Control) error {
+	runtime := controlConfig.Runtime
 	if !controlConfig.EncryptSecrets {
 		return nil
 	}
diff --git a/pkg/daemons/control/server.go b/pkg/daemons/control/server.go
index c5b4fb6cf3..b0a32c8d93 100644
--- a/pkg/daemons/control/server.go
+++ b/pkg/daemons/control/server.go
@@ -35,46 +35,45 @@ var localhostIP = net.ParseIP("127.0.0.1")
 
 func Server(ctx context.Context, cfg *config.Control) error {
 	rand.Seed(time.Now().UTC().UnixNano())
-	runtime := cfg.Runtime
 
-	if err := prepare(ctx, cfg, runtime); err != nil {
+	if err := prepare(ctx, cfg); err != nil {
 		return errors.Wrap(err, "preparing server")
 	}
 
 	cfg.Runtime.Tunnel = setupTunnel()
 	proxyutil.DisableProxyHostnameCheck = true
 
-	basicAuth, err := basicAuthenticator(runtime.PasswdFile)
+	basicAuth, err := basicAuthenticator(cfg.Runtime.PasswdFile)
 	if err != nil {
 		return err
 	}
-	runtime.Authenticator = basicAuth
+	cfg.Runtime.Authenticator = basicAuth
 
 	if !cfg.DisableAPIServer {
-		go waitForAPIServerHandlers(ctx, runtime)
+		go waitForAPIServerHandlers(ctx, cfg.Runtime)
 
-		if err := apiServer(ctx, cfg, runtime); err != nil {
+		if err := apiServer(ctx, cfg); err != nil {
 			return err
 		}
 
-		if err := waitForAPIServerInBackground(ctx, runtime); err != nil {
+		if err := waitForAPIServerInBackground(ctx, cfg.Runtime); err != nil {
 			return err
 		}
 	}
 
 	if !cfg.DisableScheduler {
-		if err := scheduler(ctx, cfg, runtime); err != nil {
+		if err := scheduler(ctx, cfg); err != nil {
 			return err
 		}
 	}
 	if !cfg.DisableControllerManager {
-		if err := controllerManager(ctx, cfg, runtime); err != nil {
+		if err := controllerManager(ctx, cfg); err != nil {
 			return err
 		}
 	}
 
 	if !cfg.DisableCCM {
-		if err := cloudControllerManager(ctx, cfg, runtime); err != nil {
+		if err := cloudControllerManager(ctx, cfg); err != nil {
 			return err
 		}
 	}
@@ -82,7 +81,8 @@ func Server(ctx context.Context, cfg *config.Control) error {
 	return nil
 }
 
-func controllerManager(ctx context.Context, cfg *config.Control, runtime *config.ControlRuntime) error {
+func controllerManager(ctx context.Context, cfg *config.Control) error {
+	runtime := cfg.Runtime
 	argsMap := map[string]string{
 		"feature-gates":                    "JobTrackingWithFinalizers=true",
 		"kubeconfig":                       runtime.KubeConfigController,
@@ -116,10 +116,11 @@ func controllerManager(ctx context.Context, cfg *config.Control, runtime *config
 	args := config.GetArgs(argsMap, cfg.ExtraControllerArgs)
 	logrus.Infof("Running kube-controller-manager %s", config.ArgString(args))
 
-	return executor.ControllerManager(ctx, runtime.APIServerReady, args)
+	return executor.ControllerManager(ctx, cfg.Runtime.APIServerReady, args)
 }
 
-func scheduler(ctx context.Context, cfg *config.Control, runtime *config.ControlRuntime) error {
+func scheduler(ctx context.Context, cfg *config.Control) error {
+	runtime := cfg.Runtime
 	argsMap := map[string]string{
 		"kubeconfig":                runtime.KubeConfigScheduler,
 		"authorization-kubeconfig":  runtime.KubeConfigScheduler,
@@ -134,10 +135,11 @@ func scheduler(ctx context.Context, cfg *config.Control, runtime *config.Control
 	args := config.GetArgs(argsMap, cfg.ExtraSchedulerAPIArgs)
 
 	logrus.Infof("Running kube-scheduler %s", config.ArgString(args))
-	return executor.Scheduler(ctx, runtime.APIServerReady, args)
+	return executor.Scheduler(ctx, cfg.Runtime.APIServerReady, args)
 }
 
-func apiServer(ctx context.Context, cfg *config.Control, runtime *config.ControlRuntime) error {
+func apiServer(ctx context.Context, cfg *config.Control) error {
+	runtime := cfg.Runtime
 	argsMap := map[string]string{
 		"feature-gates": "JobTrackingWithFinalizers=true",
 	}
@@ -225,7 +227,7 @@ func defaults(config *config.Control) {
 	}
 }
 
-func prepare(ctx context.Context, config *config.Control, runtime *config.ControlRuntime) error {
+func prepare(ctx context.Context, config *config.Control) error {
 	var err error
 
 	defaults(config)
@@ -242,7 +244,7 @@ func prepare(ctx context.Context, config *config.Control, runtime *config.Contro
 	os.MkdirAll(filepath.Join(config.DataDir, "tls"), 0700)
 	os.MkdirAll(filepath.Join(config.DataDir, "cred"), 0700)
 
-	deps.CreateRuntimeCertFiles(config, runtime)
+	deps.CreateRuntimeCertFiles(config)
 
 	cluster := cluster.New(config)
 
@@ -250,7 +252,7 @@ func prepare(ctx context.Context, config *config.Control, runtime *config.Contro
 		return err
 	}
 
-	if err := deps.GenServerDeps(config, runtime); err != nil {
+	if err := deps.GenServerDeps(config); err != nil {
 		return err
 	}
 
@@ -259,8 +261,8 @@ func prepare(ctx context.Context, config *config.Control, runtime *config.Contro
 		return err
 	}
 
-	runtime.ETCDReady = ready
-	runtime.EtcdConfig = cluster.EtcdConfig
+	config.Runtime.ETCDReady = ready
+	config.Runtime.EtcdConfig = cluster.EtcdConfig
 	return nil
 }
 
@@ -282,7 +284,8 @@ func setupStorageBackend(argsMap map[string]string, cfg *config.Control) {
 	}
 }
 
-func cloudControllerManager(ctx context.Context, cfg *config.Control, runtime *config.ControlRuntime) error {
+func cloudControllerManager(ctx context.Context, cfg *config.Control) error {
+	runtime := cfg.Runtime
 	argsMap := map[string]string{
 		"profiling":                    "false",
 		"allocate-node-cidrs":          "true",
@@ -313,7 +316,7 @@ func cloudControllerManager(ctx context.Context, cfg *config.Control, runtime *c
 			select {
 			case <-ctx.Done():
 				return
-			case <-runtime.APIServerReady:
+			case <-cfg.Runtime.APIServerReady:
 				break apiReadyLoop
 			case <-time.After(30 * time.Second):
 				logrus.Infof("Waiting for API server to become available")
@@ -325,7 +328,7 @@ func cloudControllerManager(ctx context.Context, cfg *config.Control, runtime *c
 			select {
 			case <-ctx.Done():
 				return
-			case err := <-promise(func() error { return checkForCloudControllerPrivileges(ctx, runtime, 5*time.Second) }):
+			case err := <-promise(func() error { return checkForCloudControllerPrivileges(ctx, cfg.Runtime, 5*time.Second) }):
 				if err != nil {
 					logrus.Infof("Waiting for cloud-controller-manager privileges to become available: %v", err)
 					continue
diff --git a/pkg/etcd/etcd.go b/pkg/etcd/etcd.go
index 6aac98e11b..f97a963d96 100644
--- a/pkg/etcd/etcd.go
+++ b/pkg/etcd/etcd.go
@@ -84,7 +84,6 @@ type ETCD struct {
 	client  *clientv3.Client
 	config  *config.Control
 	name    string
-	runtime *config.ControlRuntime
 	address string
 	cron    *cron.Cron
 	s3      *S3
@@ -196,7 +195,7 @@ func (e *ETCD) IsInitialized(ctx context.Context, config *config.Control) (bool,
 func (e *ETCD) Reset(ctx context.Context, rebootstrap func() error) error {
 	// Wait for etcd to come up as a new single-node cluster, then exit
 	go func() {
-		<-e.runtime.AgentReady
+		<-e.config.Runtime.AgentReady
 		t := time.NewTicker(5 * time.Second)
 		defer t.Stop()
 		for range t.C {
@@ -219,7 +218,7 @@ func (e *ETCD) Reset(ctx context.Context, rebootstrap func() error) error {
 				}
 
 				// call functions to rewrite them from daemons/control/server.go (prepare())
-				if err := deps.GenServerDeps(e.config, e.runtime); err != nil {
+				if err := deps.GenServerDeps(e.config); err != nil {
 					logrus.Fatal(err)
 				}
 
@@ -320,7 +319,7 @@ func (e *ETCD) Start(ctx context.Context, clientAccessInfo *clientaccess.Info) e
 	}
 
 	go func() {
-		<-e.runtime.AgentReady
+		<-e.config.Runtime.AgentReady
 		if err := e.join(ctx, clientAccessInfo); err != nil {
 			logrus.Fatalf("ETCD join failed: %v", err)
 		}
@@ -344,7 +343,7 @@ func (e *ETCD) join(ctx context.Context, clientAccessInfo *clientaccess.Info) er
 		return err
 	}
 
-	client, err := GetClient(clientCtx, e.runtime, clientURLs...)
+	client, err := GetClient(clientCtx, e.config.Runtime, clientURLs...)
 	if err != nil {
 		return err
 	}
@@ -420,9 +419,8 @@ func (e *ETCD) join(ctx context.Context, clientAccessInfo *clientaccess.Info) er
 // Register configures a new etcd client and adds db info routes for the http request handler.
 func (e *ETCD) Register(ctx context.Context, config *config.Control, handler http.Handler) (http.Handler, error) {
 	e.config = config
-	e.runtime = config.Runtime
 
-	client, err := GetClient(ctx, e.runtime, endpoint)
+	client, err := GetClient(ctx, e.config.Runtime, endpoint)
 	if err != nil {
 		return nil, err
 	}
@@ -434,9 +432,9 @@ func (e *ETCD) Register(ctx context.Context, config *config.Control, handler htt
 	}
 	e.address = address
 	e.config.Datastore.Endpoint = endpoint
-	e.config.Datastore.BackendTLSConfig.CAFile = e.runtime.ETCDServerCA
-	e.config.Datastore.BackendTLSConfig.CertFile = e.runtime.ClientETCDCert
-	e.config.Datastore.BackendTLSConfig.KeyFile = e.runtime.ClientETCDKey
+	e.config.Datastore.BackendTLSConfig.CAFile = e.config.Runtime.ETCDServerCA
+	e.config.Datastore.BackendTLSConfig.CertFile = e.config.Runtime.ClientETCDCert
+	e.config.Datastore.BackendTLSConfig.KeyFile = e.config.Runtime.ClientETCDKey
 
 	tombstoneFile := filepath.Join(DBDir(e.config), "tombstone")
 	if _, err := os.Stat(tombstoneFile); err == nil {
@@ -623,7 +621,7 @@ func (e *ETCD) migrateFromSQLite(ctx context.Context) error {
 	}
 	defer sqliteClient.Close()
 
-	etcdClient, err := GetClient(ctx, e.runtime, "https://localhost:2379")
+	etcdClient, err := GetClient(ctx, e.config.Runtime, "https://localhost:2379")
 	if err != nil {
 		return err
 	}
@@ -733,7 +731,7 @@ func (e *ETCD) RemovePeer(ctx context.Context, name, address string, allowSelfRe
 // being promoted to full voting member. The checks only run on the cluster member that is
 // the etcd leader.
 func (e *ETCD) manageLearners(ctx context.Context) error {
-	<-e.runtime.AgentReady
+	<-e.config.Runtime.AgentReady
 	t := time.NewTicker(manageTickerTime)
 	defer t.Stop()
 
@@ -937,9 +935,6 @@ func (e *ETCD) preSnapshotSetup(ctx context.Context, config *config.Control) err
 		}
 		e.client = client
 	}
-	if e.runtime == nil {
-		e.runtime = config.Runtime
-	}
 	return nil
 }
 
@@ -1069,7 +1064,7 @@ func (e *ETCD) Snapshot(ctx context.Context, config *config.Control) error {
 		return errors.Wrap(err, "failed to get the snapshot dir")
 	}
 
-	cfg, err := getClientConfig(ctx, e.runtime, endpoint)
+	cfg, err := getClientConfig(ctx, e.config.Runtime, endpoint)
 	if err != nil {
 		return errors.Wrap(err, "failed to get config for etcd snapshot")
 	}
diff --git a/pkg/etcd/etcd_test.go b/pkg/etcd/etcd_test.go
index fe4a711ed5..51b87b8d2b 100644
--- a/pkg/etcd/etcd_test.go
+++ b/pkg/etcd/etcd_test.go
@@ -244,8 +244,7 @@ func Test_UnitETCD_Start(t *testing.T) {
 				ctxInfo.ctx, ctxInfo.cancel = context.WithCancel(context.Background())
 				e.config.EtcdDisableSnapshots = true
 				testutil.GenerateRuntime(e.config)
-				e.runtime = e.config.Runtime
-				client, err := GetClient(ctxInfo.ctx, e.runtime, endpoint)
+				client, err := GetClient(ctxInfo.ctx, e.config.Runtime, endpoint)
 				e.client = client
 
 				return err
@@ -275,8 +274,7 @@ func Test_UnitETCD_Start(t *testing.T) {
 			setup: func(e *ETCD, ctxInfo *contextInfo) error {
 				ctxInfo.ctx, ctxInfo.cancel = context.WithCancel(context.Background())
 				testutil.GenerateRuntime(e.config)
-				e.runtime = e.config.Runtime
-				client, err := GetClient(ctxInfo.ctx, e.runtime, endpoint)
+				client, err := GetClient(ctxInfo.ctx, e.config.Runtime, endpoint)
 				e.client = client
 
 				return err
@@ -308,8 +306,7 @@ func Test_UnitETCD_Start(t *testing.T) {
 				if err := testutil.GenerateRuntime(e.config); err != nil {
 					return err
 				}
-				e.runtime = e.config.Runtime
-				client, err := GetClient(ctxInfo.ctx, e.runtime, endpoint)
+				client, err := GetClient(ctxInfo.ctx, e.config.Runtime, endpoint)
 				if err != nil {
 					return err
 				}
@@ -335,7 +332,6 @@ func Test_UnitETCD_Start(t *testing.T) {
 				client:  tt.fields.client,
 				config:  tt.fields.config,
 				name:    tt.fields.name,
-				runtime: tt.fields.config.Runtime,
 				address: tt.fields.address,
 				cron:    tt.fields.cron,
 				s3:      tt.fields.s3,
diff --git a/tests/util/unit.go b/tests/util/unit.go
index 102fc169e4..e4a6982536 100644
--- a/tests/util/unit.go
+++ b/tests/util/unit.go
@@ -43,7 +43,7 @@ func CleanupDataDir(cnf *config.Control) {
 // GenerateRuntime creates a temporary data dir and configures
 // config.ControlRuntime with all the appropriate certificate keys.
 func GenerateRuntime(cnf *config.Control) error {
-	runtime := &config.ControlRuntime{}
+	cnf.Runtime = &config.ControlRuntime{}
 	if err := GenerateDataDir(cnf); err != nil {
 		return err
 	}
@@ -51,13 +51,9 @@ func GenerateRuntime(cnf *config.Control) error {
 	os.MkdirAll(filepath.Join(cnf.DataDir, "tls"), 0700)
 	os.MkdirAll(filepath.Join(cnf.DataDir, "cred"), 0700)
 
-	deps.CreateRuntimeCertFiles(cnf, runtime)
+	deps.CreateRuntimeCertFiles(cnf)
 
-	if err := deps.GenServerDeps(cnf, runtime); err != nil {
-		return err
-	}
-	cnf.Runtime = runtime
-	return nil
+	return deps.GenServerDeps(cnf)
 }
 
 func ClusterIPNet() *net.IPNet {