I'm not sure if my cluster is super messed up or if rke just doesn't have everything up to date yet for 1.25, but I have had a few rbac cluster role issues. Namely for canal to work properly I had to add this to the calico clusterrole:

- apiGroups: [""]
    resources:
      - serviceaccounts/token
    verbs:
      - create

Also nginx ingress wasn't able to properly list endpoint slices. I had to add this to the ingress-nginx clusterrole:

- apiGroups:
      - <http://discovery.k8s.io|discovery.k8s.io>
    resources:
      - endpointslices
    verbs:
      - list
      - watch
      - get

I tracked the definitions down to here <https://github.com/rancher/kontainer-driver-metadata/tree/dev-v2.7/rke/templates> and indeed I don't see any endpoint slices for anything ingress-nginx related But again my cluster is a few years old now and It might just be falling apart after the hell I put it through upgrading from 1.23 to 1.25