Go 1.9 has some better checks for SAN extensions, notably:
https://github.com/golang/go/commit/630e93ed2d8a13226903451a0e85e62efd78cdcd

We recently added ServerName to the rest client TLSConfig:
https://github.com/dims/kubernetes/commit/186a0684d582272aa2fbfec390aea5fbb88a8bc6#diff-eb3573c6b11347dc3793c477726480efR262

So we need to be sure that the ServerName "webhook-test.default.svc" is
present in the certificates that we generate."