This message was deleted.

answering my own question, the cluster was just over a year old, and the certs for kube-scheduler and kube-controller-manager were expired. moving

/var/lib/rancher/rke2/server/tls/kube-{scheduler,controller-manager}/*

out of the way and restarting the containers (

crictl rm -f $(crictl ps -q --name kube-scheduler)

and again for

kube-controller-manager

) worked