Improve status reporting around the auth-webhook and skip trying to c…

…reate secrets before apiserver is available

reactive/kubernetes_master.py

@@ -855,10 +855,10 @@ def set_final_status():
         )
         return
 
-    auth_setup = is_flag_set("authentication.setup")
-    webhook_tokens_setup = is_flag_set("kubernetes-master.auth-webhook-tokens.setup")
-    if auth_setup and not webhook_tokens_setup:
-        hookenv.status_set("waiting", "Failed to setup auth-webhook tokens; will retry")
+    is_leader = is_state("leadership.is_leader")
+    authentication_setup = is_state("authentication.setup")
+    if not is_leader and not authentication_setup:
+        hookenv.status_set("waiting", "Waiting on leader's crypto keys.")
         return
 
     if is_state("kubernetes-master.components.started"):
@@ -879,10 +879,10 @@ def set_final_status():
 
     # Note that after this point, kubernetes-master.components.started is
     # always True.
-    is_leader = is_state("leadership.is_leader")
-    authentication_setup = is_state("authentication.setup")
-    if not is_leader and not authentication_setup:
-        hookenv.status_set("waiting", "Waiting on leader's crypto keys.")
+
+    webhook_tokens_setup = is_flag_set("kubernetes-master.auth-webhook-tokens.setup")
+    if not webhook_tokens_setup:
+        hookenv.status_set("waiting", "Failed to setup auth-webhook tokens; will retry")
         return
 
     addons_configured = is_state("cdk-addons.configured")
@@ -1148,6 +1148,7 @@ def register_auth_webhook():
 
 @when(
     "kubernetes-master.apiserver.configured",
+    "kubernetes-master.components.started",
     "kubernetes-master.auth-webhook-service.started",
     "authentication.setup",
 )