[1.24] change windows calico setup to generate a sa token

[rosskirkpat]

Proposed Changes

As part of the 1.24 service account token changes, RKE2 Windows agents can no longer start up due to the calico-node service account token missing since secrets aren't created by default for SAs in 1.24. This PR gets the calico-node service account and generates a token for it using the TokenRequest API.

This is caused by a change in Kubernetes 1.24, documented in the upstream changelog:

The LegacyServiceAccountTokenNoAutoGeneration feature gate is beta, and enabled by default. When enabled, Secret API objects containing service account tokens are no longer auto-generated for every ServiceAccount. Use the TokenRequest API to acquire service account tokens, or if a non-expiring token is required, create a Secret API object for the token controller to populate with a service account token by following this guide. (kubernetes/kubernetes#108309, @zshihang)

Types of Changes

bugfix

Verification

Provisioning testing as well as upgrading from 1.23 -> 1.24. Commit testing is passing using b290b7925f9393c2ad935015cb4087631adfc2af

NAME              STATUS   ROLES                       AGE   VERSION          INTERNAL-IP   EXTERNAL-IP   OS-IMAGE                         KERNEL-VERSION    CONTAINER-RUNTIME
ec2amaz-ru7d335   Ready    <none>                      47s   v1.24.0          10.0.1.198    <none>        Windows Server 2019 Datacenter   10.0.17763.2928   containerd://1.6.4
ip-10-0-1-148     Ready    control-plane,etcd,master   8h    v1.24.0+rke2r1   10.0.1.148    <none>        Ubuntu 20.04.2 LTS               5.4.0-1045-aws    containerd://1.6.4-k3s1
ip-10-0-1-72      Ready    <none>                      8h    v1.24.0+rke2r1   10.0.1.72     <none>        Ubuntu 20.04.2 LTS               5.4.0-1045-aws    containerd://1.6.4-k3s1

Linked Issues

#2939

Further Comments

The RKE2 kubelet on windows throws an error regarding the image credential provider bin directory missing. This doesn't stop the node from becoming ready but I will open an issue for it: #2958

{Kubelet image credential provider bin directory check failed: CreateFile /var/lib/rancher/credentialprovider/bin: The system cannot find the path specified.}

{Running RKE2 kubelet [--cgroups-per-qos=false --enforce-node-allocatable= --file-check-frequency=5s --hairpin-mode=promiscuous-bridge --resolv-conf=
--sync-frequency=30s --address=0.0.0.0 --alsologtostderr=false --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook
--client-ca-file=C:\var\lib\rancher\rke2\agent\client-ca.crt --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime=remote
--container-runtime-endpoint=npipe:////./pipe/containerd-containerd --fail-swap-on=false --healthz-bind-address=127.0.0.1
--hostname-override=ec2amaz-ru7d335 --kubeconfig=C:\var\lib\rancher\rke2\agent\kubelet.kubeconfig --log-file=\var\lib\rancher\rke2\agent\logs\kubelet.log
--log-file-max-size=50 --logtostderr=false --node-labels= --pod-infra-container-image=index.docker.io/rancher/pause:3.6
--pod-manifest-path=C:\var\lib\rancher\rke2\agent\pod-manifests --read-only-port=0 --resolv-conf=C:\var\lib\rancher\rke2\agent\etc\resolv.conf
--serialize-image-pulls=false --stderrthreshold=FATAL --tls-cert-file=C:\var\lib\rancher\rke2\agent\serving-kubelet.crt
--tls-private-key-file=C:\var\lib\rancher\rke2\agent\serving-kubelet.key]}
{Running kubelet --address=0.0.0.0 --alsologtostderr=false --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook
--client-ca-file=C:\var\lib\rancher\rke2\agent\client-ca.crt --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime=remote
--container-runtime-endpoint=npipe:////./pipe/containerd-containerd --eviction-hard=imagefs.available<5%,nodefs.available<5%
--eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --healthz-bind-address=127.0.0.1
--hostname-override=ec2amaz-ru7d335 --kubeconfig=C:\var\lib\rancher\rke2\agent\kubelet.kubeconfig --log-file=\var\lib\rancher\rke2\agent\logs\kubelet.log
--log-file-max-size=50 --logtostderr=false --node-labels= --pod-infra-container-image=index.docker.io/rancher/pause:3.6
--pod-manifest-path=C:\var\lib\rancher\rke2\agent\pod-manifests --read-only-port=0 --resolv-conf=C:\var\lib\rancher\rke2\agent\etc\resolv.conf
--serialize-image-pulls=false --stderrthreshold=FATAL --tls-cert-file=C:\var\lib\rancher\rke2\agent\serving-kubelet.crt
--tls-private-key-file=C:\var\lib\rancher\rke2\agent\serving-kubelet.key}

[phillipsj]

LGTM!

[brandond]

Two nits on error returns but looks good other than that!

[brandond]

whoops, missed this one

[rosskirkpat]

NAME              STATUS   ROLES                       AGE   VERSION          INTERNAL-IP   EXTERNAL-IP   OS-IMAGE                         KERNEL-VERSION    CONTAINER-RUNTIME
ec2amaz-ru7d335   Ready    <none>                      47s   v1.24.0          10.0.1.198    <none>        Windows Server 2019 Datacenter   10.0.17763.2928   containerd://1.6.4
ip-10-0-1-148     Ready    control-plane,etcd,master   8h    v1.24.0+rke2r1   10.0.1.148    <none>        Ubuntu 20.04.2 LTS               5.4.0-1045-aws    containerd://1.6.4-k3s1
ip-10-0-1-72      Ready    <none>                      8h    v1.24.0+rke2r1   10.0.1.72     <none>        Ubuntu 20.04.2 LTS               5.4.0-1045-aws    containerd://1.6.4-k3s1

With the latest commit, it's working!

[phillipsj]

LGTM!