"kubectl get" vs "kubectl logs" -- different behaviours
Solution 1:
I solved it. The problem was that I had not included 10.32.0.1 in the kubernetes.pem cert. I hadn't though I needed to do this but I did, presumably as connections initiated by the apiserver don't go through the haproxy, only inbound connections do.
I recreated kubernetes.pem and kubernetes-key.pem including the cluster IP as a kubernetes hostname, then distributed these certs to /etc/etcd and /var/lib/kubernetes on the controllers and restarted kube-apiserver. All good now :)
(this also solved the crashloop issue too)