Dustin C. Hatch
84cd6022c0
Using the Kubernetes API to create bootstrap tokens makes it possible for the host-provisioner to automatically add new machines to the Kubernetes cluster. The host provisioner cannot connect to existing machines, and thus cannot run the `kubeadm token create` command on a control plane node. With the appropriate permissions assigned to the service account associated with the pod it runs in, though, it can directly create the secret via the API. There are actually two pieces of information required for a node to join a cluster, though: a bootstrap token and the CA certificate. When using the `kubeadm token create` command to issue a bootstrap token, it also provides (a hash of) the CA certificate with the command it prints. When creating the token manually, we need an alternative method for obtaining and distributing the CA certificate, so we use the `cluster-info` ConfigMap. This contains a stub `kubeconfig` file, which includes the CA certificate, which can be used by the `kubeadm join` command with a join configuration file. Generating both of these files may be a bit more involved than computing the CA certificate hash and passing that on the command line, but there are a couple of advantages. First, it's more extensible, as the join configuration file can specify additional configuration for the node (which we may want to use later). It's also somewhat more secure, since the token is not passed as a command-line argument. Interestingly, the most difficult part of this implementation was getting the expiration timestamp. Ansible exposes very little date math capability; notably lacking is the ability to construct a `timedelta` object, so the only way to get a timestamp in the future is to convert the `datetime` object returned by `now` to a Unix timestamp and add some number of seconds to it. Further, there is no direct way to get a `datetime` object from the computed Unix timestamp value, but we can rely on the fact that Python class methods can be called on instances, too, so `now().fromtimestamp()` works the same as `datetime.fromtimestamp()`.