Fix: kubeadm_join: Correct node check for Kubernetes 1.32+

[teasonia]

Summary

This commit corrects the node check in kubeadm_join.pp to work correctly with Kubernetes 1.32 and later versions. The previous check relied on kubelet having permissions to list all nodes, which is no longer the case. The updated check uses kubectl get nodes <node_name> instead.

Additional Context

After upgrading kubernetes to version 1.32, applying puppet on existing nodes results in the node being added again. This happens because getting all nodes causes an error.

# KUBECONFIG=/etc/kubernetes/kubelet.conf kubectl get nodes
Error from server (Forbidden): nodes is forbidden: User "system:node:k8s-test" cannot list resource "nodes" in API group "" at the cluster scope: node 'k8s-test' cannot read all nodes, only its own Node object

Getting its own node happens without errors

# KUBECONFIG=/etc/kubernetes/kubelet.conf kubectl get nodes k8s-test
NAME       STATUS   ROLES    AGE    VERSION
k8s-test   Ready    <none>   461d   v1.32.1

[CLAassistant]

All committers have signed the CLA.

[deric]

@teasonia Thanks for your contribution! The modification needs to be backwards compatible. You should check $kubernetes_version and modify the command accordingly. Also such change should be covered by tests.

[cekstam]

Basically, this is what's needed;

  if versioncmp($kubernetes_version, '1.32.0') >= 0 {
    $kubeadm_get_node_command = "kubectl get nodes ${node_name}"
  } else {
    $kubeadm_get_node_command = "kubectl get nodes | grep ${node_name}"
  }

  exec { 'kubeadm join':
    command     => "kubeadm join ${kubeadm_join_flags}",
    environment => $env,
    path        => $path,
    logoutput   => true,
    timeout     => 0,
    unless      => $kubeadm_get_node_command,
  }
}

How do I get that into this PR?