kubernetes: always use lb for joining

The token given out by control-planes contains the node IP
as an endpoint. Since during this stage the joining node is
not connected to the WireGuard network, we cannot
communicate node-to-node. Therefore, we need to hop over the
load balancer again to have a src IP outside of the strict
range.

bootstrapper/internal/kubernetes/kubernetes.go

@@ -209,6 +209,9 @@ func (k *KubeWrapper) JoinCluster(ctx context.Context, args *kubeadm.BootstrapTo
 		return fmt.Errorf("retrieving own instance metadata: %w", err)
 	}
 
+	// override join endpoint to go over lb
+	args.APIServerEndpoint = net.JoinHostPort(loadBalancerHost, loadBalancerPort)
+
 	log.With(
 		zap.String("nodeName", nodeName),
 		zap.String("providerID", providerID),