Support composition of bootstrapping of kubeadm, cloud-init/ignition/talos/etc... and secrets transport

[randomvariable]

User Story

As a Kubernetes distribution developer, I would like to support different bootstrappers to CloudInit as well as ensure Cluster API's secret data is delivered to the instance securely and is not readable by unauthorised persons. I however do not want to re-implement all of kubeadm bootstrap provider, or make big assumptions about what the instance initialisation system is.

Detailed Description

Provide a method by which different parts of a bootstrapping mechanism could be composed together:

• The part of the bootstrapping process that launches Kubernetes, i.e. kubeadm
• The machine's bootstrapping system, e.g. Cloud-Init, Cloud-Base, Ignition, Talos
• The infrastructure provider's mechanism to secure the bootstrap data: AWS Secrets Manager, Azure etc...
• Something on the machine that is able to download from the secure source

Anything else you would like to add:

[Miscellaneous information that will assist in solving the issue.]

/kind feature

[randomvariable]

Related to #3430

[vincepri]

/milestone v0.4.0
/kind design

[vbatts]

@vincepri what is the approach needed to move this forward? (happy to help)

[vincepri]

We'll probably need to meet + have a conversation on what the actual deliverable we'd expect from this initiative is

@randomvariable might have some ideas, we might want to schedule a one off meeting to discuss it a bit