This message was deleted.

is this a Rancher-provisioned cluster?

yes. Rancher provisioned, custom.

then you need to initiate rotation from rancher. there are rancher-managed certs that rke2's internal rotation do not handle, because it is not responsible for creating them

yes, it was set up last year as part of a proof of concept production system and runs a second production cluster. they've got a conference coming up (as is often the case) and need to minimize risks.