kube-vip runs on hv01, hv02, and hv03. It had elected hv02 as leader, and the errors above are happening. Killing hv02's pod, and when hv01 becomes leader, the errors subside.
I do also see errors in my fleet-agent logs on addon ranchers 'local' cluster, complaining it cannot find the bootstrap secret, then complaining about bad certs. What is odd, both the physical node which that pod is running on, as well the fleet-agent pod itself can curl the https url without any cert errors being reported. Normally i'd see complaints from curl as well from the underlying host or pod when i've had cert/ca issues.