diff --git a/pkg/handlers/generic/mutation/extraapiservercertsans/inject.go b/pkg/handlers/generic/mutation/extraapiservercertsans/inject.go
index 547d80fe2..a25cc4f59 100644
--- a/pkg/handlers/generic/mutation/extraapiservercertsans/inject.go
+++ b/pkg/handlers/generic/mutation/extraapiservercertsans/inject.go
@@ -70,6 +70,7 @@ func (h *extraAPIServerCertSANsPatchHandler) Mutate(
 	if err := h.client.Get(ctx, clusterKey, cluster); err != nil {
 		return err
 	}
+        TODO: move the defaults to a mutating webhook
 	defaultAPICertSANs := getDefaultAPIServerSANs(cluster)
 	extraAPIServerCertSANsVar, found, err := variables.Get[v1alpha1.ExtraAPIServerCertSANs](
 		vars,