For now i'm using ansible to configure the apiserver parameters.
After an ansible re-run found this:
- --enable-admission-plugins=NodeRestriction,MutatingAdmissionPolicy,MutatingAdmissionPolicy,ImagePolicyWebhook
Responsible file: scripts/bootstrap/k8s-enable-admission-plugins.sh
Issue must be caused to a recent addition of more than one plugin name for insertion. It was likely mishandled by the insertion script.