Comment 10 for bug 1512782

Turns out the fix may be more complicated than just now watching APIHostPorts. There could be racy conditions as the certupdater worker runs on each state server in an HA environment. This may need to be made a singular worker. Still determining best fix.

For immediate relief, you can modify the lxc bridge for the host to be "higher" than the lxc bridge for the kvm containers running the local provider. i.e. using 10.1.3.0/24 instead of 10.0.3.0/24.