An admission webhook serves the right certificate and still times out

Pod level checks pass, yet admission calls fail because the apiserver network path does not use the same resolution or routing assumptions as ordinary workloads.