Resources are not created when a validating webhook timed out

cluster.yaml

kind: Cluster
apiVersion: kind.sigs.k8s.io/v1alpha3
kubeadmConfigPatches:
- |
  apiVersion: kubeadm.k8s.io/v1beta2
  kind: ClusterConfiguration
  metadata:
    name: config
  apiServer:
    extraArgs:
      "enable-admission-plugins": "ValidatingAdmissionWebhook"
nodes:
- role: control-plane

config.yaml

apiVersion: admissionregistration.k8s.io/v1beta1
kind: ValidatingWebhookConfiguration
metadata:
  name: validating-webhook-configuration
webhooks:
- admissionReviewVersions:
  - v1beta1
  clientConfig:
    caBundle: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURZRENDQWtpZ0F3SUJBZ0lVRVozYXU2SC91MTFZVlY1R3I1OVdNdkhVTXdvd0RRWUpLb1pJaHZjTkFRRUwKQlFBd1NERUxNQWtHQTFVRUJoTUNTbEF4RVRBUEJnTlZCQWdUQ0VOb2RXOW9MV3QxTVE0d0RBWURWUVFIRXdWVQpiMnQ1YnpFV01CUUdBMVVFQXhNTlkyeDFjM1JsY2k1c2IyTmhiREFlRncweE9UQTRNekF3TmpJME1EQmFGdzB5Ck5EQTRNamd3TmpJME1EQmFNRWd4Q3pBSkJnTlZCQVlUQWtwUU1SRXdEd1lEVlFRSUV3aERhSFZ2YUMxcmRURU8KTUF3R0ExVUVCeE1GVkc5cmVXOHhGakFVQmdOVkJBTVREV05zZFhOMFpYSXViRzlqWVd3d2dnRWlNQTBHQ1NxRwpTSWIzRFFFQkFRVUFBNElCRHdBd2dnRUtBb0lCQVFDelBxck5VSnBSMTVmejBSbzlZNEtIVWJuU2VWK3BGdmk1Ck5oUkMzKzVLRVExWWdaQVovTlpQVkdjYzhKSkcvRW9BbjBVWGxLblJQK1JmU0h4emo0MlZlc1FHZ2xQdHdhUGwKWEJuS2pOYWdpajFxZzBGYXhTcDZRZkpmcWMzSVR0dTcwbnZSdm51aVQvYktTbDAzeURVLzB6M1dlbDU1UjI0SwpLV0o1RTJGalJLdzZ6UmRGbnFtamZmNTJqWEwzTlg2dDdFTmVWejJuek5vWVZJYXhHWWJIYVdtSU5DU1psb0RZCmdwcG5mOHJQL3F2U1UwV3crdUJMQmxxU2tFT2Zjb3NyQjBBR2hiQU81M0JJamFJNjN2bW1vLzZzSDV2WGkzbGEKOHlGSWNiM0dGT2srRDhodWtVTzZibWlmMG02MHdobGNHRmYyOEo2TnRtL0NpUzFiUXdwdEFnTUJBQUdqUWpCQQpNQTRHQTFVZER3RUIvd1FFQXdJQkJqQVBCZ05WSFJNQkFmOEVCVEFEQVFIL01CMEdBMVVkRGdRV0JCUVNoVXdqCjFraVZEWmExZllzU1dhdHBkUkdnS3pBTkJna3Foa2lHOXcwQkFRc0ZBQU9DQVFFQU5oMUpLbUsrRnU0VmtQeVkKaFJkbXVwSmUybHRadVhLanBxZENPbnZyeCtPWU1NaGhPZFhnYkFRUkpWalZnUnQ3Wm5FYU41eUhrcjB6WjYwSAp3SVc2M0Q1UUtRb1ZkdzNibHpDRnV1MDJZVlY2cjE3MzBiZko0RTlEVHpBSWtYS0RFcFdiM1FKRGk2ZFFEQTlZCjkwTHI2eWlYR2F2TEpMakZ1ZStFSnFsRjdHR21COVMvd1FldTZFcjRieFdYVzdiUE9MN3FYb3ZrVWlMK2I1K1gKeUNndUo0cWtON3ZmUWM5QUliTEpWMUNMRWw5NXdZaXRDenNNZUhNNHk5aWhRU0Y1WWJwSlphYjhyZGJoSUZ1WApQN1BTd2x2MU5hT2lmU29xZGsyeDgxbG8xSEt3am5MVHhwTk9YdW1FVFhUN2wwOXpucER4ZTRlRFUyNHZEb2JKCm5aMEFiQT09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
    service:
      name: testserver
      namespace: default
      path: /
      port: 443
  failurePolicy: Ignore
  matchPolicy: Exact
  name: validation.secrets.cybozu.com
  rules:
  - apiGroups:
    - ""
    apiVersions:
    - v1
    operations:
    - CREATE
    - UPDATE
    resources:
    - secrets
    scope: '*'
  sideEffects: Unknown
  timeoutSeconds: 30

Dockerfile

# Stage1: build from source
FROM quay.io/cybozu/golang:1.12-bionic AS build

COPY main.go /work/main.go

WORKDIR /work
RUN CGO_ENABLED=0 go build -o server ./main.go

# Stage2: setup runtime container
FROM scratch

COPY --from=build /work/server /server
EXPOSE 8000
USER 10000:10000

ENTRYPOINT ["/server"]

main.go

package main

import (
	"fmt"
	"io"
	"net/http"
	"time"
)

func main() {
	http.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
		time.Sleep(40 * time.Second)
		io.WriteString(w, "Hello\n")
	})
	err := http.ListenAndServeTLS(":8443", "/certs/tls.crt", "/certs/tls.key", nil)
	if err != nil {
		fmt.Println(err)
	}
}

tls.crt

-----BEGIN CERTIFICATE-----
MIIDxjCCAq6gAwIBAgIUM9bkl682bHKU8ParI6kxBBA38AUwDQYJKoZIhvcNAQEL
BQAwSDELMAkGA1UEBhMCSlAxETAPBgNVBAgTCENodW9oLWt1MQ4wDAYDVQQHEwVU
b2t5bzEWMBQGA1UEAxMNY2x1c3Rlci5sb2NhbDAeFw0xOTA4MzAwNjI0MDBaFw0y
OTA4MjcwNjI0MDBaMEUxCzAJBgNVBAYTAkpQMQ4wDAYDVQQIEwVUb2t5bzERMA8G
A1UEBxMIQ2h1b2gta3UxEzARBgNVBAMTCnRlc3RzZXJ2ZXIwggEiMA0GCSqGSIb3
DQEBAQUAA4IBDwAwggEKAoIBAQC/WJlWRvDVDzLiQDI2pHGRxQR76EaUQGUrcXuC
AD/VoUNn15O4bxraIY/BjE/qicUjyKs6m44jqv79e6BnZ0MTntKp/k3NiNK/8FTc
VXVYR6lGkfT4cjuIdGF6RO4mf5DNn0L5XqU2HzuVxQxuhdBYT3mAqYNhtkqTbtSU
YkDfN0Ofi5UvG+qUdICUcnvTcor9UeYkC9gYfRV8EJWIrqN+Hz6kFwFcL1zOtVUn
mQeXeXULkVzuiBgSHhND3oQY31Y9KDsr+tn9Io3Nf8GN59Jb379qTpQA2q1bXyMC
NoWFpFSTpyGF5ZfubB8o0bHz7b/sex+w7MGJ5IFiDIGSeZSxAgMBAAGjgaowgacw
DgYDVR0PAQH/BAQDAgWgMBMGA1UdJQQMMAoGCCsGAQUFBwMBMAwGA1UdEwEB/wQC
MAAwHQYDVR0OBBYEFACe1OsvngA/UhiqG1H7au7P5kKUMB8GA1UdIwQYMBaAFBKF
TCPWSJUNlrV9ixJZq2l1EaArMDIGA1UdEQQrMCmCCWxvY2FsaG9zdIIWdGVzdHNl
cnZlci5kZWZhdWx0LnN2Y4cEfwAAATANBgkqhkiG9w0BAQsFAAOCAQEARhSxZtZh
YqBf5sC7wwqepVBTmlQZCInjc089k+RHIX8DM128PGLqUlduDZHhgTGbcm5SFMCY
uJQYZIZXQz35MvsOiu95MzJt1kC1nR23+HdShpQlfPvjUvpjBY1f+BgTEqXX5GsB
LnuX2d029+z9yizpuzxelpkrqkClNnvzmEnzw2zXUEGF9v/MBpComYxGi54+/lzl
5IyHuZSw06v6K+mGHjwDGbR4jaCt5tgOSidkR0MBynUl3KBps5QQMB2QQuBlV2Pt
5pHQM6gIMv9RpO4gWsppFqEnXzK7ChZ/kroXr/WZjFdUqJ1krct2p8KOIsjbPEva
o4Nm1E360JrHeg==
-----END CERTIFICATE-----

tls.key

-----BEGIN RSA PRIVATE KEY-----
MIIEpAIBAAKCAQEAv1iZVkbw1Q8y4kAyNqRxkcUEe+hGlEBlK3F7ggA/1aFDZ9eT
uG8a2iGPwYxP6onFI8irOpuOI6r+/XugZ2dDE57Sqf5NzYjSv/BU3FV1WEepRpH0
+HI7iHRhekTuJn+QzZ9C+V6lNh87lcUMboXQWE95gKmDYbZKk27UlGJA3zdDn4uV
LxvqlHSAlHJ703KK/VHmJAvYGH0VfBCViK6jfh8+pBcBXC9czrVVJ5kHl3l1C5Fc
7ogYEh4TQ96EGN9WPSg7K/rZ/SKNzX/BjefSW9+/ak6UANqtW18jAjaFhaRUk6ch
heWX7mwfKNGx8+2/7HsfsOzBieSBYgyBknmUsQIDAQABAoIBAF5DqZbFcBOmXyzy
70nYDVMAukrIjSyv5KdYSr4qnUgDIA/iNhXgNlxLuGRjWWNz57jPPPuscoPD08bQ
xp7qUjMyRRoV/AJLa3e/UC8TsrGA7DWl5gcXT5jTrMntd11j7tQ9p2Lua3mUPWh1
IMC6D3/R90uZNu5GPcsQCI3pMYhE901gspHCMfH0ycebTH+Y/xH2KkkV5g71IXxg
heeUU9C+X/MNfVqCVXy2XakEt3EhudPBLm7xy2OmazDZQ5k+Doad/neueF3f7Xq8
Yzh0/oGA0xhhqFn0pwjuJ2swG0mMm5rD1qsSYvctlNOsNdp5evcacSFnWvUKlWJ3
4yJMA5kCgYEAwIwb7HRtKFNnDwueQGa1f8ZyPrCxO+VXTDqTNg+FZH2JQO7nnB8F
nvSYm8LXHgjzT90k4z7JkYa3LOej8PA6zDU7PF/g6RzoRNmcXRDsu6vmdfgOQpZM
5csJJ00O1KrvAI25+mgS7FqEbXr0H6taQ/9kNRr/m6x3SrBAfYAHrhsCgYEA/mcm
5tu5p+Fv7Oieyfe1XPTEP8Jj3MCDviy/PvaI5GExZYVAAv85H8jLz/b7ypY0vLYR
PcHSI7xv7rERIjZQttdQ6N4sHTZ+i0hVptUejlF2vKWkVI8poHHc2uLg0QSC9AWt
U+isa3dbGDmBU+AzyKzugfQ7S2oHlyr5yTh2xSMCgYEAhCFhpCC9K5gYN9XkMhOJ
Z3aZvXVpGk4mWvQzQzzhb/VJs9p967/KDquQ8gqBrmW7+kkqYBsdHZVRrCoFcXiZ
ELtSu/qbj7y7k0u1ppPPsHWlP70KpB0aBfMPg/24OK5YNowLXNAAdFslVy+xyO3A
krr2XA776yst7X4Hs1ehbZMCgYAcSW3q522KPCfMyMS3IkLZNiIIEN43snQzlhgh
sRnhgukSJ7HJY4V/gj0fP5AZo3/zp67dFgr+jDpJ6QhFrJJm8iP98I4pJWEGraFQ
bov6ORahvS07dbukKmTrNaTXuM+ywFrYZJufS2Mmm2ZE5D39xzSx4G0jYoO7jDy/
4fZazwKBgQCVd/Yf5Dqh0m8g8590LiNYeF2l5scwjVZwIQ5E0RmpqOGlCGiA3wUA
jYTj6rcw7dRCw2Kry8KQAoV2UgP25hNtmUsswhwu8qyQ4UdVwVU5VtnVOUNkf6Df
toQYe6tCV2wjKFkMshFOqP/jiLvnxIL1qnQo4XFhpsD3+TL1rtmUqg==
-----END RSA PRIVATE KEY-----

webhook.yaml

apiVersion: apps/v1
kind: Deployment
metadata:
  name: testserver
spec:
  replicas: 1
  selector:
    matchLabels:
      app: testserver
  template:
    metadata:
      labels:
        app: testserver
    spec:
      containers:
        - name: server
          image: testserver:v1
          ports:
            - containerPort: 8443
          volumeMounts:
            - name: server-secret
              mountPath: /certs/
      volumes:
      - name: server-secret
        secret:
          secretName: server-secret
---
apiVersion: v1
kind: Service
metadata:
  name: testserver
  namespace: default
spec:
  ports:
  - port: 443
    protocol: TCP
    targetPort: 8443
  selector:
    app: testserver
  type: ClusterIP