Rewrite k8s-certs-renew script in Python (#13502)

Signed-off-by: Ali Afsharzadeh <afsharzadeh8@gmail.com>

roles/kubernetes/control-plane/templates/k8s-certs-renew.service.j2

@@ -3,4 +3,9 @@ Description=Renew K8S control plane certificates
 
 [Service]
 Type=oneshot
-ExecStart={{ bin_dir }}/k8s-certs-renew.sh
+ExecStart={{ '/opt/bin/python' if ansible_facts['os_family'] == 'Flatcar' else '/usr/bin/python3' }} {{ bin_dir }}/k8s-certs-renew.py \
+    --kubeadm {{ bin_dir }}/kubeadm \
+    --calendar "{{ auto_renew_certificates_systemd_calendar }}" \
+    --admin-conf {{ kube_config_dir }}/admin.conf \
+    --apiserver-port {{ kube_apiserver_port }} \
+    --crictl {{ bin_dir }}/crictl

roles/kubernetes/control-plane/templates/k8s-certs-renew.sh.j2

@@ -1,47 +0,0 @@
-#!/bin/bash
-
-echo "## Check Expiration before renewal ##"
-
-{{ bin_dir }}/kubeadm certs check-expiration
-
-days_buffer=7 # set a time margin, because we should not renew at the last moment
-# systemctl show reports an empty NextElapseUSecRealtime while the timer's unit is
-# running, so use the calendar spec to get the next scheduled run.
-next_time=$(LC_ALL=C systemd-analyze calendar "{{ auto_renew_certificates_systemd_calendar }}" | grep -oP 'Next elapse:\s*\K.*\S')
-
-if [ "${next_time}" == "" ] || [ "${next_time}" == "never" ]; then
-	echo "## Skip expiry comparison due to fail to parse next elapse from systemd calendar,do renewal directly ##"
-else
-	current_time=$(date +%s)
-	target_time=$(date -d "${next_time} + ${days_buffer} days" +%s) # $next_time - $days_buffer days
-	expiry_threshold=$(( ${target_time} - ${current_time} ))
-	# super-admin.conf only exists on the node where "kubeadm init" ran, the other
-	# control plane nodes see it as missing (residualTime 0). Don't let missing
-	# certs force a renewal here, kubeadm can't renew them anyway.
-	expired_certs=$({{ bin_dir }}/kubeadm certs check-expiration -o jsonpath="{range .certificates[?(@.residualTime<${expiry_threshold}.0)]}{.name}={.missing}{\"\n\"}{end}" | sed -n 's/=false$//p')
-    if [ "${expired_certs}" == "" ];then
-		echo "## Skip cert renew and K8S container restart, since all residualTimes are beyond threshold ##"
-		exit 0
-	fi
-	echo "## Certificates to renew: ##"
-	echo "${expired_certs}"
-fi
-
-echo "## Renewing certificates managed by kubeadm ##"
-{{ bin_dir }}/kubeadm certs renew all
-
-echo "## Restarting control plane pods managed by kubeadm ##"
-{% if container_manager == "docker" %}
-{{ docker_bin_dir }}/docker ps -af 'name=k8s_POD_(kube-apiserver|kube-controller-manager|kube-scheduler|etcd)-*' -q | /usr/bin/xargs {{ docker_bin_dir }}/docker rm -f
-{% else %}
-{{ bin_dir }}/crictl pods --namespace kube-system --name 'kube-scheduler-*|kube-controller-manager-*|kube-apiserver-*|etcd-*' -q | /usr/bin/xargs {{ bin_dir }}/crictl rmp -f
-{% endif %}
-
-echo "## Updating /root/.kube/config ##"
-cp {{ kube_config_dir }}/admin.conf /root/.kube/config
-
-echo "## Waiting for apiserver to be up again ##"
-until printf "" 2>>/dev/null >>/dev/tcp/127.0.0.1/{{ kube_apiserver_port | default(6443) }}; do sleep 1; done
-
-echo "## Expiration after renewal ##"
-{{ bin_dir }}/kubeadm certs check-expiration