Merge pull request #36101 from jbeda/bootstrap-signer

Automatic merge from submit-queue (batch tested with PRs 38252, 41122, 36101, 41017, 41264)

BootstrapSigner and TokenCleaner controllers

This is part of kubernetes/enhancements#130 and is an implementation of kubernetes/community#189.

Work that needs to be done yet in this PR:
* [ ] ~~e2e tests~~ Will come in new PR.
* [x] flag to disable this by default

```release-note
Native support for token based bootstrap flow.  This includes signing a well known ConfigMap in the `kube-public` namespace and cleaning out expired tokens.
```

@kubernetes/sig-cluster-lifecycle @dgoodwin @roberthbailey @mikedanese

Kubernetes-commit: 866aa735912e548a73ff54c4b6c9b338adfa19e3

pkg/apis/meta/v1/types.go

@@ -73,7 +73,7 @@ type ListMeta struct {
 
 // These are internal finalizer values for Kubernetes-like APIs, must be qualified name unless defined here
 const (
-	FinalizerOrphan     string        = "orphan"
+	FinalizerOrphan string = "orphan"
 )
 
 // ObjectMeta is metadata that all persisted resources must have, which includes all objects
@@ -233,6 +233,8 @@ const (
 	NamespaceNone string = ""
 	// NamespaceSystem is the system namespace where we place system components.
 	NamespaceSystem string = "kube-system"
+	// NamespacePublic is the namespace where we place public info (ConfigMaps)
+	NamespacePublic string = "kube-public"
 )
 
 // OwnerReference contains enough information to let you identify an owning