Generated ca-secret can contain empty key

[lennardk]

When creating control-plane and worker machines at the same time, for example by doing something along the lines of the following, cabpt can decide to generate the ${CLUSTER_NAME}-ca secret (TalosConfigReconciler.writeK8sCASecret) based on a workers machineconfig, thus containing an empty tls.key. This in turn causes trouble when generating the ${CLUSTER_NAME}-kubeconfig secret.

In my use case I'm using TalosConfigTemplate with generateType: none and data set to a full config.

Speculation on solutions could include:

• checking for type to be init or controlplane before deciding to generate the secret
• checking for the Machine to have a TalosControlPlane as ownerRefence
• checking for the Machine to have a 'anything in the controlplane.cluster.x-k8s.io/v1alpha3 namespace as ownerReference, for if someone invents a reason to use cabpt without cacppt.