Validating webhook rejects new workloads after certificate rotation

The webhook service is reachable, but admissions fail because the CABundle in the configuration no longer matches the serving certificate chain.