diff --git a/build/root/BUILD.root b/build/root/BUILD.root
index 41b76e68ba5..4ab7f316be6 100644
--- a/build/root/BUILD.root
+++ b/build/root/BUILD.root
@@ -89,6 +89,12 @@ filegroup(
         "//cmd:all-srcs",
         "//docs:all-srcs",
         "//hack:all-srcs",
+        "//kubernetes/cluster:all-srcs",
+        "//kubernetes/docs:all-srcs",
+        "//kubernetes/hack:all-srcs",
+        "//kubernetes/test/e2e/testing-manifests:all-srcs",
+        "//kubernetes/test/images:all-srcs",
+        "//kubernetes/test/kubemark:all-srcs",
         "//pkg:all-srcs",
         "//plugin:all-srcs",
         "//staging:all-srcs",
diff --git a/pkg/kubectl/util/certificate/BUILD b/pkg/kubectl/util/certificate/BUILD
index cac97d41705..6df04e38cd7 100644
--- a/pkg/kubectl/util/certificate/BUILD
+++ b/pkg/kubectl/util/certificate/BUILD
@@ -1,13 +1,3 @@
-load("@io_bazel_rules_go//go:def.bzl", "go_library")
-
-go_library(
-    name = "go_default_library",
-    srcs = ["certificate.go"],
-    importpath = "k8s.io/kubernetes/pkg/kubectl/util/certificate",
-    visibility = ["//visibility:public"],
-    deps = ["//staging/src/k8s.io/api/certificates/v1beta1:go_default_library"],
-)
-
 filegroup(
     name = "package-srcs",
     srcs = glob(["**"]),
diff --git a/staging/src/k8s.io/kubectl/BUILD b/staging/src/k8s.io/kubectl/BUILD
index 0d865cbcc39..7a2d2e34cf3 100644
--- a/staging/src/k8s.io/kubectl/BUILD
+++ b/staging/src/k8s.io/kubectl/BUILD
@@ -9,6 +9,7 @@ filegroup(
     name = "all-srcs",
     srcs = [
         ":package-srcs",
+        "//staging/src/k8s.io/kubectl/pkg/util/certificate:all-srcs",
         "//staging/src/k8s.io/kubectl/pkg/util/deployment:all-srcs",
         "//staging/src/k8s.io/kubectl/pkg/util/event:all-srcs",
         "//staging/src/k8s.io/kubectl/pkg/util/hash:all-srcs",
diff --git a/staging/src/k8s.io/kubectl/pkg/util/certificate/BUILD b/staging/src/k8s.io/kubectl/pkg/util/certificate/BUILD
new file mode 100644
index 00000000000..49bda5e7cdd
--- /dev/null
+++ b/staging/src/k8s.io/kubectl/pkg/util/certificate/BUILD
@@ -0,0 +1,24 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_library")
+
+go_library(
+    name = "go_default_library",
+    srcs = ["certificate.go"],
+    importmap = "k8s.io/kubernetes/vendor/k8s.io/kubectl/pkg/util/certificate",
+    importpath = "k8s.io/kubectl/pkg/util/certificate",
+    visibility = ["//visibility:public"],
+    deps = ["//staging/src/k8s.io/api/certificates/v1beta1:go_default_library"],
+)
+
+filegroup(
+    name = "package-srcs",
+    srcs = glob(["**"]),
+    tags = ["automanaged"],
+    visibility = ["//visibility:private"],
+)
+
+filegroup(
+    name = "all-srcs",
+    srcs = [":package-srcs"],
+    tags = ["automanaged"],
+    visibility = ["//visibility:public"],
+)
diff --git a/pkg/kubectl/util/certificate/certificate.go b/staging/src/k8s.io/kubectl/pkg/util/certificate/certificate.go
similarity index 100%
rename from pkg/kubectl/util/certificate/certificate.go
rename to staging/src/k8s.io/kubectl/pkg/util/certificate/certificate.go