A cert-manager renewal succeeds and the new certificate never reaches the app

A certificate rotates successfully in cluster state and the application continues presenting the old material until a restart.