Defer kubeadm join token creation to apply

bootstrap/cluster/main.tf

@@ -381,19 +381,6 @@ EOT
   }
 }
 
-data "external" "kubeadm_join_command" {
-  depends_on = [null_resource.kubeadm_control_plane]
-  program = [
-    "bash",
-    "-lc",
-    <<EOT
-set -euo pipefail
-cmd="$(sudo kubeadm token create --print-join-command)"
-printf '{"cmd":"%s"}\n' "$(printf '%s' "$cmd" | sed 's/\\/\\\\/g; s/"/\\"/g')"
-EOT
-  ]
-}
-
 resource "null_resource" "worker_nodes_required" {
   triggers = {
     worker_count = tostring(length(var.worker_nodes))
@@ -411,7 +398,7 @@ resource "null_resource" "kubeadm_worker" {
   for_each = var.worker_nodes
 
   depends_on = [
-    data.external.kubeadm_join_command,
+    null_resource.kubeadm_control_plane,
     null_resource.worker_nodes_required,
   ]
 
@@ -892,25 +879,48 @@ fi
 if [ ! -f /etc/kubernetes/kubelet.conf ] && [ -e /var/lib/kubelet/kubeadm-flags.env ]; then
   reset_worker_join_state
 fi
-
-if [ ! -f /etc/kubernetes/kubelet.conf ]; then
-  sudo systemctl stop kubelet 2>/dev/null || true
-  if ! sudo ${data.external.kubeadm_join_command.result.cmd} --node-name=${self.triggers.node_name}; then
-    sudo systemctl status kubelet --no-pager -l || true
-    sudo journalctl -u kubelet --no-pager -n 160 || true
-    exit 1
-  fi
-  if [ ! -f /etc/kubernetes/kubelet.conf ] || [ ! -f /var/lib/kubelet/config.yaml ]; then
-    echo "kubeadm join completed without creating kubelet configuration" >&2
-    sudo ls -la /etc/kubernetes /var/lib/kubelet 2>/dev/null || true
-    sudo systemctl status kubelet containerd --no-pager -l || true
-    sudo journalctl -u kubelet --no-pager -n 160 || true
-    exit 1
-  fi
-fi
 EOT
     ]
   }
+
+  provisioner "local-exec" {
+    command = <<EOT
+set -euo pipefail
+
+ssh_target='${self.triggers.user}@${self.triggers.host}'
+ssh_key='${self.triggers.ssh_key_path}'
+node_name='${self.triggers.node_name}'
+
+if ssh -i "$ssh_key" -o BatchMode=yes -o ConnectTimeout=10 -o StrictHostKeyChecking=accept-new "$ssh_target" \
+  'test -f /etc/kubernetes/kubelet.conf && test -f /var/lib/kubelet/config.yaml'; then
+  exit 0
+fi
+
+join_cmd="$(sudo kubeadm token create --print-join-command)"
+remote_join_script="$(mktemp)"
+trap 'rm -f "$remote_join_script"' EXIT
+
+cat >"$remote_join_script" <<JOIN_EOT
+set -eu
+sudo systemctl stop kubelet 2>/dev/null || true
+if ! sudo $join_cmd --node-name=$node_name; then
+  sudo systemctl status kubelet --no-pager -l || true
+  sudo journalctl -u kubelet --no-pager -n 160 || true
+  exit 1
+fi
+if [ ! -f /etc/kubernetes/kubelet.conf ] || [ ! -f /var/lib/kubelet/config.yaml ]; then
+  echo "kubeadm join completed without creating kubelet configuration" >&2
+  sudo ls -la /etc/kubernetes /var/lib/kubelet 2>/dev/null || true
+  sudo systemctl status kubelet containerd --no-pager -l || true
+  sudo journalctl -u kubelet --no-pager -n 160 || true
+  exit 1
+fi
+JOIN_EOT
+
+ssh -i "$ssh_key" -o BatchMode=yes -o ConnectTimeout=10 -o StrictHostKeyChecking=accept-new "$ssh_target" \
+  'bash -s' <"$remote_join_script"
+EOT
+  }
 }
 
 locals {