diff --git a/app/models/concerns/deployment_platform.rb b/app/models/concerns/deployment_platform.rb
index b6245e29746ecc241a6de2e7696619537237e96d..d9c622f247a94a7d81fbfce79f8b30c5beee09b2 100644
--- a/app/models/concerns/deployment_platform.rb
+++ b/app/models/concerns/deployment_platform.rb
@@ -3,6 +3,8 @@
 module DeploymentPlatform
   # rubocop:disable Gitlab/ModuleWithInstanceVariables
   def deployment_platform(environment: nil)
+    return if Feature.disabled?(:certificate_based_clusters, default_enabled: :yaml, type: :ops)
+
     @deployment_platform ||= {}
 
     @deployment_platform[environment] ||= find_deployment_platform(environment)
diff --git a/config/feature_flags/ops/certificate_based_clusters.yml b/config/feature_flags/ops/certificate_based_clusters.yml
new file mode 100644
index 0000000000000000000000000000000000000000..eaf4151b80aa947c78713e25da80feaf11f15b0a
--- /dev/null
+++ b/config/feature_flags/ops/certificate_based_clusters.yml
@@ -0,0 +1,8 @@
+---
+name: certificate_based_clusters
+introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/81054
+rollout_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/353410
+milestone: '14.9'
+type: ops
+group: group::configure
+default_enabled: true
diff --git a/spec/lib/gitlab/ci/templates/auto_devops_gitlab_ci_yaml_spec.rb b/spec/lib/gitlab/ci/templates/auto_devops_gitlab_ci_yaml_spec.rb
index 6a4be1fa072cc3e4709a0e16ed4c3d60c15abd3a..78d3982a79f4f80bf085c08e5bc4db42772d3116 100644
--- a/spec/lib/gitlab/ci/templates/auto_devops_gitlab_ci_yaml_spec.rb
+++ b/spec/lib/gitlab/ci/templates/auto_devops_gitlab_ci_yaml_spec.rb
@@ -238,14 +238,34 @@
         end
 
         it_behaves_like 'pipeline with Kubernetes jobs'
+
+        context 'when certificate_based_clusters FF is disabled' do
+          before do
+            stub_feature_flags(certificate_based_clusters: false)
+          end
+
+          it 'does not include production job' do
+            expect(build_names).not_to include('production')
+          end
+        end
       end
 
-      context 'when project has an Agent is present' do
+      context 'when project has an Agent' do
         before do
           create(:cluster_agent, project: project)
         end
 
         it_behaves_like 'pipeline with Kubernetes jobs'
+
+        context 'when certificate_based_clusters FF is disabled' do
+          before do
+            stub_feature_flags(certificate_based_clusters: false)
+          end
+
+          it 'includes production job' do
+            expect(build_names).to include('production')
+          end
+        end
       end
     end
 
diff --git a/spec/models/concerns/deployment_platform_spec.rb b/spec/models/concerns/deployment_platform_spec.rb
index 7fa55184cf17ff2d83be627636623413c372e42e..bd1afe844ac656675c93ff1697bda14c748dc5d5 100644
--- a/spec/models/concerns/deployment_platform_spec.rb
+++ b/spec/models/concerns/deployment_platform_spec.rb
@@ -12,16 +12,28 @@
       let(:group) { create(:group) }
       let(:project) { create(:project, group: group) }
 
+      shared_examples 'certificate_based_clusters is disabled' do
+        before do
+          stub_feature_flags(certificate_based_clusters: false)
+        end
+
+        it { is_expected.to be_nil }
+      end
+
       shared_examples 'matching environment scope' do
         it 'returns environment specific cluster' do
           is_expected.to eq(cluster.platform_kubernetes)
         end
+
+        it_behaves_like 'certificate_based_clusters is disabled'
       end
 
       shared_examples 'not matching environment scope' do
         it 'returns default cluster' do
           is_expected.to eq(default_cluster.platform_kubernetes)
         end
+
+        it_behaves_like 'certificate_based_clusters is disabled'
       end
 
       context 'multiple clusters use the same management project' do