WIP - Upload encrypted certs on init

[fabriziopandini]

This issue defines implementation details for "Upload encrypted certs on init" activity defined in #1373

PR#1: Extend v1beta1 and internal config for managing the encryption key with:

• add new field EncryptionKey string 'json:"encryptionKey,omitempty"' into the InitConfiguration object
• add new field EncryptionKey string 'json:"encryptionKey,omitempty"' into the JoinControlPlane object
• implement validation for the above fields (32bytes for key SHA-256 using AES-256/GCM as method)
• add a new command for pre-generating an encryption-key (location TBD)

PR#2: Create a new phase in the init workflow named upload-certs with:

• add new --experimental-upload-certs flag of type bool to kubeadm init
• make initData generate a new encryption key if not already provided by the user
• create a new phase named upload-certs
  • the phase should be executed after 'upload-config' only if --experimental-upload-certs is set;
  • the phase should create the TTL Token, The kubeadm-certssecret and related RBAC rules as described in the KEP
• print encryption key + usage instructions at the end of the init workflow
• allow hiding the encryption-key from the kubeadm output using the skip-token-print or (a similar flag)

[yagonobre]

I can take this

[fabriziopandini]

Thanks, @yagonobre! let's reach agreement on config changes before starting, so we can avoid some iteration on the PRs
/lifecycle active
/assign @yagonobre

[fabriziopandini]

NB, as discussed in kubeadm office hours, we are starting without changes to the config