Comments

bootstrap/kubeadm/internal/controllers/kubeadmconfig_controller.go

@@ -331,6 +331,7 @@ func (r *KubeadmConfigReconciler) refreshBootstrapTokenIfNeeded(ctx context.Cont
 	if secretExpiration == "" {
 		log.Info(fmt.Sprintf("Token has no valid value for %s, writing new expiration timestamp", bootstrapapi.BootstrapTokenExpirationKey))
 	} else {
+		// Assuming UTC, since we create the label value with that timezone
 		expiration, err := time.Parse(time.RFC3339, secretExpiration)
 		if err != nil {
 			return ctrl.Result{}, errors.Wrapf(err, "can't parse expiration time of bootstrap token")
@@ -851,7 +852,7 @@ func (r *KubeadmConfigReconciler) resolveSecretPasswordContent(ctx context.Conte
 	return data, nil
 }
 
-// skipTokenRefreshIfExpiringAfter returns a duration from "now". If the token's expiry timestamp is after
+// skipTokenRefreshIfExpiringAfter returns a duration. If the token's expiry timestamp is after
 // `now + skipTokenRefreshIfExpiringAfter()`, it does not yet need a refresh.
 func (r *KubeadmConfigReconciler) skipTokenRefreshIfExpiringAfter() time.Duration {
 	// Choose according to how often reconciliation is "woken up" by `tokenCheckRefreshOrRotationInterval`.