* MWI: Bound Keypair - Registration Secrets
This adds support for initial joining via registration secrets. These
one time use secrets emulate traditional token joining and allow
clients to perform their initial join
With this, no options are required for bound keypair-type tokens.
While admins can specify a joining secret if they wish, if none is
provided, one will be generated on the server and can be found in
`status.bound_keypair.registration_secret` on the token resource.
When joining, this secret can be shared with clients in addition to
the (no longer sensitive) token name. This secret is verified and
a keypair rotation is requested, prompting the client to generate a
new keypair, provide the public key to the server, and complete a
joining challenge. It then joins the cluster as usual.
* Remove unnecessary token validation checks
* Rename tbot flag to --registration-secret
* Fix reference to renamed flag
* Various fixes, mostly more unwanted checks
* Add test cases for registration secrets
* Fix broken test
Onboarding config is no longer required, so fix the now-broken test
* Allow empty .spec.bound_keypair field for bound keypair tokens
This allows .spec.bound_keypair to be empty or entirely unset,
since we can build defaults at creation time.
* Add test for secret expiry enforcement
* Handle nonexistent client state when using a registration secret
* Fix test lints
* Hide exact registration secret rejection reason from client
Registration secret errors now return a single error message to the
client and log a more specific message on the server.
Tim Buckley
a8f4b27ca1