A webhook signer rotates and only one subset of the cluster begins rejecting admissions with certificate trust errors.
An admission policy rollout breaks only one namespace
Most workloads admit fine, yet one namespace still fails because the namespace-scoped injection path has not propagated the new trust bundle.
Scenario
What to check first
- Identify the primary failure signal in the The Cluster Trusted the New Signer Before One Injection Path Did scenario.
- Separate visible symptoms from the underlying technical dependency.
- Describe the safest recovery path and the follow-up prevention work.
Checking checklist
- Summarize the current impact and the last known change.
- Collect direct evidence from logs, runtime state, and configuration before changing anything.
- Separate immediate recovery from permanent prevention work.
Recovery and prevention
Check each trust injection path separately before regenerating certificates again.
Questions worth viewing together
Community-field security problem inspired by Kubernetes community trust-rotation incidents where one CABundle injection path lagged behind the new signer. Distributed trust injection systems rarely converge everywhere at the same instant.
Teams often blame the certificate secret when the lagging component is the CABundle injection controller.
Webhook trust rotation should validate every namespace or scope-specific injection path, not only the global one.
Similar cases seen in the field