This message was deleted.

Found the solution. controlplane pool must also get a worker label so that rke-ingress-controller runs on controlplanes as well. Then the VIP from the controlplane forwards requests to the correct service!