code: func encodeTokenSecretData(token *BootstrapToken, now time.Time) map[string][]byte {
  	data := map[string][]byte{
  		bootstrapapi.BootstrapTokenIDKey:     []byte(token.Token.ID),
  		bootstrapapi.BootstrapTokenSecretKey: []byte(token.Token.Secret),
  	}
  
  	if len(token.Description) > 0 {
  		data[bootstrapapi.BootstrapTokenDescriptionKey] = []byte(token.Description)
  	}
  
  	// If for some strange reason both token.TTL and token.Expires would be set
  	// (they are mutually exlusive in validation so this shouldn't be the case),
  	// token.Expires has higher priority, as can be seen in the logic here.
  	if token.Expires != nil {
  		// Format the expiration date accordingly
  		// TODO: This maybe should be a helper function in bootstraputil?
  		expirationString := token.Expires.Time.Format(time.RFC3339)
  		data[bootstrapapi.BootstrapTokenExpirationKey] = []byte(expirationString)
  
  	} else if token.TTL != nil && token.TTL.Duration > 0 {
  		// Only if .Expires is unset, TTL might have an effect
  		// Get the current time, add the specified duration, and format it accordingly
  		expirationString := now.Add(token.TTL.Duration).Format(time.RFC3339)
  		data[bootstrapapi.BootstrapTokenExpirationKey] = []byte(expirationString)
  	}
  
  	for _, usage := range token.Usages {
  		data[bootstrapapi.BootstrapTokenUsagePrefix+usage] = []byte("true")
  	}
  
  	if len(token.Groups) > 0 {
  		data[bootstrapapi.BootstrapTokenExtraGroupsKey] = []byte(strings.Join(token.Groups, ","))
  	}
  	return data
  }
docs: // encodeTokenSecretData takes the token discovery object and an optional duration and returns the .Data for the Secret
  // now is passed in order to be able to used in unit testing