@@ -2086,18 +2086,54 @@ spec:
 
           svcs=$(kubectl -n "$ns" get svc -l "$sel" \
             -o jsonpath='{range .items[*]}{.metadata.name}{"\n"}{end}')
-          adm=$(printf '%s\n' "$svcs" | grep -- '-admission$' | head -1 || true)
+          adm_candidates=$(printf '%s\n' "$svcs" | grep -- '-admission$' || true)
           # -metrics is excluded explicitly rather than relying on
-          # ingress-nginx-controller sorting before ingress-nginx-controller-metrics
-          # under head -1: the positive control has to be the Service that
-          # actually exposes the controller's https port.
-          ctl=$(printf '%s\n' "$svcs" | grep -v -- '-admission$' | grep -v -- '-metrics$' | grep . | head -1 || true)
-          [ -n "$adm" ] || { echo "SETUP FAILURE: no ingress-nginx admission Service in $ns" >&2; exit 1; }
-          [ -n "$ctl" ] || { echo "SETUP FAILURE: no ingress-nginx controller Service in $ns" >&2; exit 1; }
+          # ingress-nginx-controller sorting before a metrics Service: the
+          # positive control has to be the one unambiguous controller Service.
+          ctl_candidates=$(printf '%s\n' "$svcs" | grep -v -- '-admission$' | grep -v -- '-metrics$' | grep . || true)
+          adm_count=$(printf '%s\n' "$adm_candidates" | grep -c . || true)
+          ctl_count=$(printf '%s\n' "$ctl_candidates" | grep -c . || true)
+          [ "$adm_count" -eq 1 ] || {
+            echo "SETUP FAILURE: expected one ingress-nginx admission Service in $ns, found $adm_count" >&2
+            printf '  candidates: %s\n' "${adm_candidates:-<none>}" >&2
+            exit 1
+          }
+          [ "$ctl_count" -eq 1 ] || {
+            echo "SETUP FAILURE: expected one ingress-nginx controller Service in $ns, found $ctl_count" >&2
+            printf '  candidates: %s\n' "${ctl_candidates:-<none>}" >&2
+            exit 1
+          }
+          adm=$adm_candidates
+          ctl=$ctl_candidates
 
-          adm_port=$(kubectl -n "$ns" get svc "$adm" -o jsonpath='{.spec.ports[0].port}')
-          ctl_port=$(kubectl -n "$ns" get svc "$ctl" -o jsonpath='{.spec.ports[?(@.name=="https")].port}')
-          [ -n "$ctl_port" ] || { echo "SETUP FAILURE: $ctl exposes no https port" >&2; exit 1; }
+          service_port() {
+            kubectl -n "$ns" get svc "$1" -o json | jq -r --arg port_name "$2" '
+              [.spec.ports[]?
+               | select(.name == $port_name)
+               | select((.protocol // "TCP") == "TCP")
+               | .port
+               | select(type == "number")]
+              | if length == 1 then .[0] else empty end
+            '
+          }
+          adm_port=$(service_port "$adm" https-webhook)
+          ctl_port=$(service_port "$ctl" https)
+          adm_cluster_ip=$(kubectl -n "$ns" get svc "$adm" -o jsonpath='{.spec.clusterIP}')
+          [ -n "$adm_cluster_ip" ] && [ "$adm_cluster_ip" != None ] || {
+            echo "SETUP FAILURE: $adm must have a real ClusterIP, found ${adm_cluster_ip:-<empty>}" >&2
+            kubectl -n "$ns" get svc "$adm" -o yaml >&2 2>&1 || true
+            exit 1
+          }
+          [ -n "$adm_port" ] || {
+            echo "SETUP FAILURE: $adm must expose exactly one TCP https-webhook port" >&2
+            kubectl -n "$ns" get svc "$adm" -o yaml >&2 2>&1 || true
+            exit 1
+          }
+          [ -n "$ctl_port" ] || {
+            echo "SETUP FAILURE: $ctl must expose exactly one TCP https port" >&2
+            kubectl -n "$ns" get svc "$ctl" -o yaml >&2 2>&1 || true
+            exit 1
+          }
 
           # Ready endpoint addresses behind a Service, from EndpointSlice rather
           # than from pod readiness: this is the state the API server and the
@@ -2110,13 +2146,48 @@ spec:
             echo "$n"
           }
 
-          # Pod identity plus restart count, as one string. Compared for
-          # equality across the probe window, so a restart AND a replacement
-          # both show up -- a crash-looping controller can satisfy a readiness
-          # check at both ends of a window it spent dying in the middle of.
+          # Exact ready admission coordinates. The Pod identity, IP and backend
+          # port come from the same EndpointSlice as the ready condition;
+          # selecting them independently from .items[0] could probe an unready
+          # replica while a different replica kept aggregate readiness above
+          # zero.
+          ready_admission_backends() {
+            kubectl -n "$ns" get endpointslice -l "kubernetes.io/service-name=$adm" -o json | jq -r '
+              .items[]? as $slice
+              | $slice.ports[]? as $port
+              | select($port.name == "https-webhook")
+              | select(($port.protocol // "TCP") == "TCP")
+              | select(($port.port | type) == "number")
+              | $slice.endpoints[]?
+              | select(.conditions.ready == true)
+              | select(.targetRef.kind == "Pod")
+              | select((.targetRef.name // "") != "")
+              | select((.targetRef.uid // "") != "")
+              | .targetRef.name as $pod
+              | .targetRef.uid as $uid
+              | .addresses[]?
+              | select(type == "string" and length > 0)
+              | [$pod, $uid, ., ($port.port | tostring)]
+              | @tsv
+            ' | sort -u
+          }
+
+          # Pod identity, IP and every container restart count, as one string.
+          # Compared for equality across the probe window, so a restart AND a
+          # replacement both show up -- a crash-looping controller can satisfy
+          # a readiness check at both ends of a window it spent dying in the
+          # middle of.
           controller_generation() {
-            kubectl -n "$ns" get pod -l "$sel" \
-              -o jsonpath='{range .items[*]}{.metadata.name}={.status.containerStatuses[0].restartCount}{" "}{end}'
+            generation=$(kubectl -n "$ns" get pod -l "$sel" \
+              -o jsonpath='{range .items[*]}{.metadata.name}/{.metadata.uid}/{.status.podIP}={range .status.containerStatuses[*]}{.name}:{.restartCount},{end}{"\n"}{end}') || {
+              echo "SETUP FAILURE: unable to read ingress-nginx controller generation" >&2
+              return 1
+            }
+            [ -n "$generation" ] || {
+              echo "SETUP FAILURE: ingress-nginx controller generation is empty" >&2
+              return 1
+            }
+            printf '%s\n' "$generation" | sort
           }
 
           # Precondition. Both Services are backed by the same controller pods,
@@ -2125,7 +2196,7 @@ spec:
           # backend to answer.
           deadline=$(( $(date +%s) + 120 ))
           while :; do
-            adm_ready=$(ready_backends "$adm")
+            adm_ready=$(ready_admission_backends | grep -c . || true)
             ctl_ready=$(ready_backends "$ctl")
             if [ "$adm_ready" -gt 0 ] && [ "$ctl_ready" -gt 0 ]; then break; fi
             [ "$(date +%s)" -lt "$deadline" ] || {
@@ -2140,17 +2211,58 @@ spec:
             sleep 5
           done
 
+          backend=$(ready_admission_backends | head -1)
+          [ -n "$backend" ] || { echo "SETUP FAILURE: $adm has no complete ready Pod/UID/IP/port coordinate" >&2; exit 1; }
+          tab=$(printf '\t')
+          backend_fields=$(printf '%s\n' "$backend" | awk -F "$tab" '{ print NF }')
+          [ "$backend_fields" -eq 4 ] || { echo "SETUP FAILURE: malformed ready backend coordinate: $backend" >&2; exit 1; }
+          pod_name=$(printf '%s\n' "$backend" | cut -f1)
+          pod_uid=$(printf '%s\n' "$backend" | cut -f2)
+          pod_ip=$(printf '%s\n' "$backend" | cut -f3)
+          hook_port=$(printf '%s\n' "$backend" | cut -f4)
+          [ -n "$pod_name" ] && [ -n "$pod_uid" ] && [ -n "$pod_ip" ] && [ -n "$hook_port" ] || {
+            echo "SETUP FAILURE: incomplete ready backend coordinate: $backend" >&2
+            exit 1
+          }
+
+          selected_backend_ready() {
+            ready_admission_backends | awk -F "$tab" \
+              -v pod="$pod_name" -v uid="$pod_uid" -v ip="$pod_ip" -v port="$hook_port" '
+                $1 == pod && $2 == uid && $3 == ip && $4 == port { found = 1 }
+                END { exit !found }
+              '
+          }
+
+          require_selected_backend() {
+            selected_backend_ready && return 0
+            echo "SETUP FAILURE: selected admission backend $pod_name/$pod_uid ($pod_ip:$hook_port) was not ready $1" >&2
+            kubectl -n "$ns" get endpointslice -l "kubernetes.io/service-name=$adm" -o yaml >&2 2>&1 || true
+            kubectl -n "$ns" get pod "$pod_name" -o wide >&2 2>&1 || true
+            exit 1
+          }
+
+          require_selected_backend "before the stability window"
+
           # Stability: the same evidence held across a window, not at one
           # instant. Six samples over 30s, all of which must be live and show no
           # restart or replacement.
           gen_before=$(controller_generation)
+          printf '%s\n' "$gen_before" | awk \
+            -v prefix="${pod_name}/${pod_uid}/${pod_ip}=" '
+              index($0, prefix) == 1 { found = 1 }
+              END { exit !found }
+            ' || {
+              echo "SETUP FAILURE: selected admission backend is not a current controller Pod: $backend" >&2
+              exit 1
+            }
           i=0
           while [ "$i" -lt 6 ]; do
             sleep 5
             i=$(( i + 1 ))
-            n=$(ready_backends "$adm")
+            require_selected_backend "during the stability window (sample $i)"
+            n=$(ready_backends "$ctl")
             [ "$n" -gt 0 ] || {
-              echo "SETUP FAILURE: $adm lost its ready backend during the stability window (sample $i)" >&2
+              echo "SETUP FAILURE: $ctl lost its ready backend during the stability window (sample $i)" >&2
               kubectl -n "$ns" get pod -l "$sel" -o wide >&2 2>&1 || true
               exit 1
             }
@@ -2164,14 +2276,7 @@ spec:
             exit 1
           }
 
-          pod_ip=$(kubectl -n "$ns" get pod -l "$sel" \
-            -o jsonpath='{.items[0].status.podIP}')
-          hook_port=$(kubectl -n "$ns" get pod -l "$sel" \
-            -o jsonpath='{.items[0].spec.containers[0].ports[?(@.name=="webhook")].containerPort}')
-          [ -n "$pod_ip" ] || { echo "SETUP FAILURE: no controller Pod IP in $ns" >&2; exit 1; }
-          [ -n "$hook_port" ] || { echo "SETUP FAILURE: controller declares no webhook port" >&2; exit 1; }
-
-          echo "probing from $ns: expect reachable ${ctl}:${ctl_port}, denied ${adm}:${adm_port}, denied ${pod_ip}:${hook_port}"
+          echo "probing from $ns: expect reachable ${ctl}:${ctl_port}, denied ${adm}@${adm_cluster_ip}:${adm_port}, denied ${pod_name}/${pod_uid}@${pod_ip}:${hook_port}"
 
           kubectl -n "$ns" delete pod "$probe" --ignore-not-found --wait=true --timeout=60s
           # busybox:musl is staged onto every node by hack/e2e-prepull-images.sh,
@@ -2205,7 +2310,7 @@ spec:
               - name: CTL_PORT
                 value: "${ctl_port}"
               - name: ADM_HOST
-                value: "${adm}.${ns}.svc"
+                value: "${adm_cluster_ip}"
               - name: ADM_PORT
                 value: "${adm_port}"
               - name: POD_IP
@@ -2241,9 +2346,10 @@ spec:
           deadline=$(( $(date +%s) + 180 ))
           phase=""
           while [ "$(date +%s)" -lt "$deadline" ]; do
-            n=$(ready_backends "$adm")
+            require_selected_backend "while the probe was running"
+            n=$(ready_backends "$ctl")
             [ "$n" -gt 0 ] || {
-              echo "SETUP FAILURE: $adm lost its ready backend while the probe was running, so an unreachable webhook proves nothing" >&2
+              echo "SETUP FAILURE: $ctl lost its ready backend while the probe was running, so an unreachable positive control proves nothing" >&2
               kubectl -n "$ns" get pod -l "$sel" -o wide >&2 2>&1 || true
               kubectl -n "$ns" logs "$probe" >&2 2>&1 || true
               exit 1
@@ -2270,9 +2376,10 @@ spec:
             kubectl -n "$ns" get pod -l "$sel" -o wide >&2 2>&1 || true
             exit 1
           }
-          n=$(ready_backends "$adm")
+          require_selected_backend "after the probe"
+          n=$(ready_backends "$ctl")
           [ "$n" -gt 0 ] || {
-            echo "SETUP FAILURE: $adm has no ready backend after the probe, so its unreachability proves nothing" >&2
+            echo "SETUP FAILURE: $ctl has no ready backend after the probe, so its unreachability proves nothing" >&2
             exit 1
           }
 
@@ -2287,9 +2394,9 @@ spec:
             }
           done
 
-          # From here every branch is a real verdict: the destination had a live
-          # backend before, throughout and after, on pods that neither restarted
-          # nor were replaced.
+          # From here every branch is a real verdict: the exact direct
+          # destination stayed ready before, throughout and after, and the
+          # controller pods neither restarted nor were replaced.
           rc=0
           if [ "$ctl_seen" = reachable ]; then
             echo "OK   unrelated 443 egress works (${ctl}:${ctl_port})"
 
@@ -88,21 +88,19 @@ spec:
 
 {{- /*
 addons.cilium.valuesOverride is x-kubernetes-preserve-unknown-fields, so a
-tenant can set cilium.kubeProxyReplacement: false for its own cluster. That is
-the one path by which the value reaches a live cluster without a cozystack
-commit, and it is the path the guest cluster's own ingress-nginx admission deny
-depends on: that policy names the webhook backend port only, which covers a pod
-dialling the ClusterIP solely because Cilium performs the service DNAT ahead of
-its own egress hook. Override it and pods inside the guest cluster regain the
-ClusterIP path to the admission webhook while the backend deny keeps working --
-no failure, no log line, and the rendered policy unchanged.
+tenant can set cilium.kubeProxyReplacement: false for its own cluster. Cozystack
+does not support that value or supply an alternative service load balancer for
+it; guest ClusterIP connectivity can fail. The guest ingress-nginx policy's
+source-side deny also loses the pre-DNAT match, but its target-side ingressDeny
+continues to deny pods after any translation, so the override does not imply
+that the admission webhook becomes reachable.
 
 The mismatch is detectable here rather than in the guest cluster, because this
 HelmRelease's values are assembled on the management cluster, so the beacon is
 emitted next to the release that carries the override. Same mechanism and same
 reasoning as the -awaiting-etcd beacon in ../cluster.yaml: a ConfigMap an
-operator and an alert can both see, not a fail() that would take the tenant's
-only CNI down over a weakened defence-in-depth control.
+operator and an alert can both see. It is a diagnostic for an unsupported
+override, not an alternative compatibility mode.
 
 Absence is not a warning: the value is unset in both the override and
 cozystack.defaultCiliumValues on every supported path, and the cilium chart's
@@ -129,14 +127,15 @@ data:
     addons.cilium.valuesOverride sets cilium.kubeProxyReplacement to
     {{ toString $kpr | quote }} for cluster {{ .Release.Name }}.
 
-    Cilium in that guest cluster will not perform the ClusterIP DNAT ahead of
-    its own egress hook, so the admission-webhook deny the guest cluster's
-    ingress-nginx ships no longer covers traffic addressed to the webhook
-    Service ClusterIP. Pods in the guest cluster can reach
-    <webhook>.<namespace>.svc:443; the webhook's backend port stays denied.
+    Cozystack supports guest cluster networking only when
+    cilium.kubeProxyReplacement is "true". No supported alternative service load
+    balancer is supplied for this override, so ClusterIP connectivity may fail.
 
-    This is a deliberate override, so it is reported rather than refused. Clear
-    it to restore the control, or set the guest ingress-nginx addon's
-    admissionWebhookPolicy.enabled explicitly so the posture is recorded.
+    The guest ingress-nginx policy's source-side deny also loses its pre-DNAT
+    match, but its target-side ingressDeny remains. This override does not imply
+    that the admission webhook is reachable through its Service.
+
+    Clear the override or set cilium.kubeProxyReplacement back to true. Disabling
+    the webhook policy does not make this networking configuration supported.
 {{- end }}
 {{- end }}
@@ -1,17 +1,16 @@
 suite: tenant cilium kube-proxy-replacement override beacon
 # addons.cilium.valuesOverride is x-kubernetes-preserve-unknown-fields, so a
 # tenant can set cilium.kubeProxyReplacement: false for its own cluster. That is
-# the one path by which the value reaches a live cluster without a cozystack
-# commit, and it silently reopens the ClusterIP path to the guest cluster's own
-# ingress-nginx admission webhook -- the source-side deny there names the
-# backend port only, which covers the ClusterIP solely because Cilium performs
-# the service DNAT ahead of its own egress hook.
+# the one path by which the unsupported value reaches a live cluster without a
+# cozystack commit. It can break ClusterIP routing and removes the ingress-nginx
+# policy's source-side pre-DNAT match, but the target-side ingressDeny remains;
+# the override does not imply that the webhook becomes reachable.
 #
 # The override is assembled on the MANAGEMENT cluster, in this chart, which is
 # why the mismatch is detectable here at all. Same beacon mechanism as the
 # -awaiting-etcd ConfigMap in templates/cluster.yaml: something an operator and
-# an alert can both see, rather than a fail() that would take the tenant's only
-# CNI down over a weakened defence-in-depth control.
+# an alert can both see. It diagnoses an unsupported override rather than
+# defining an alternative compatibility mode.
 templates:
   - templates/helmreleases/cilium.yaml
 values:
@@ -61,7 +60,7 @@ tests:
           value: ConfigMap
       - matchRegex:
           path: data.message
-          pattern: "will not perform the ClusterIP DNAT ahead of"
+          pattern: "supports guest cluster networking only when"
         documentSelector:
           path: kind
           value: ConfigMap