To reschedule the tco pods to master nodes, run:
kubectl -n tectonic-system patch deployment tectonic-channel-operator -p '{"spec":{"template":{"spec":{"nodeSelector":{"node-role.kubernetes.io/master":""},"tolerations":[{"key":"node-role.kubernetes.io/master","operator":"Exists","effect":"NoSchedule"}]}}}}'
This works around the issue that tco can't run on rhel node because it expects a ssl cert dir that's not in rhel distros.