This message was deleted.

Everything is under /var/lib/rancher/rke2

The kube-ca.pem cert name must have changed since rke, under rke2 Is it /var/lib/rancher/rke2/server/tls/server-ca.crt ?

From investigating the certificate authority data cert in /etc/rancher/rke2/rke2.yaml matched the certificate in /var/lib/rancher/rke2/agent/server-ca.crt