A cert-manager renewal job stays Pending (webhook-networkpolicy-still-whitelisted-old-apiserver-cidr)

Pods can curl the webhook, yet the control plane cannot because the apiserver now originates from a different CIDR range than the old cluster.