A Kubernetes admission webhook serves valid TLS and requests still fail

A cluster rotates webhook serving certs in place and later admission failures appear even though the pod and service remain healthy.