the correct path to the cert/key is /etc/kubernetes/pki and i put the certs there manually for now

roles/rke2/templates/config.yaml.j2

@@ -42,9 +42,9 @@ kube-apiserver-arg: "--feature-gates=ServiceAccountIssuerDiscovery=true,JobTrack
 #TODO write nice for-loop 
 kube-api:
   extra_args:
-    service-account-issuer: "kubernetes.default.svc"
-    service-account-signing-key-file: "/etc/kubernetes/ssl/kube-service-account-token-key.pem"
-    service-account-key-file:"/etc/kubernetes/ssl/kube-service-account-token"
+    service-account-issuer: "https://localhost:6443"
+    service-account-signing-key-file: "/etc/kubernetes/pki/sa.key"
+    service-account-key-file:"/etc/kubernetes/pki/sa.pub"
     service-account-jwks-uri: "https://localhost:6443/openid/v1/jwks"