Kubeadm VIP Connectivity Fix

I’m running a four-node Kubernetes cluster built with kubeadm. Three control-plane nodes sit behind a single virtual IP in Site A, while a lone worker lives in Site B on another private network segment. All nodes are Linux and every required port between the two sites is open—ICMP and TCP flow fine.

The cluster is on v1.34.3. I’ve already installed cert-manager on the remote worker. The problem appears when I apply any manifest: kubectl throws “https://<service-name>:443 connection refused.” Cert-manager’s logs don’t show anything obvious, and I haven’t yet dug into the API-server logs. After three days of tracing traffic and double-checking firewalls I’m stuck.

I need an experienced Kubernetes troubleshooter to:
• identify the root cause of the 443 refusal (VIP, kube-proxy, API-server advertising, cert-manager webhook, or something I’ve overlooked)
• guide or implement the fix so manifests apply cleanly from any node
• verify the solution with me, walking through the logs and commands so I understand what was wrong and how it was resolved

If you’re comfortable with multi-site HA clusters, kubeadm, and cert-manager internals, I’d love your help getting this cluster healthy and fully functional again.