Where does the Kubernetes API server run in Rancher?

So the kube API server runs on all control plane nodes and you can access it directly. The Rancher server also provides a proxied connection via the cattle-cluster-agent pod as well.

So if Rancher is down/unavailable you can still access your cluster by pointing your kube Config directly to one of cp nodes.

Also, you can manually generate a kubeconfig using the script https://github.com/patrick0057/kubecert in the event Rancher is down.