This message was deleted.

I'd appreciate it if anyone could clear this up for me

Hmm... I was setting up HA for K8s clusters before we switched to Rancher, where I had keepalived on the control plane servers. With Rancher, though, the kubectl goes through the certificate available through the Rancher web site, with the servers connected to being the Rancher management control plane, which then interacts with the cluster concerned, so it's a different scenario for a Rancher-controlled cluster than an RKE2-standalone. You can, of course, still connect directly to the RKE2.

But you probably used keepalived for API requests coming from outside the cluster, right?

Indeed.

Yes, in this case I'm talking about reaching the API internally. So I'm guessing the kubernetes svc (default ns) should normally be enough for that.