code: func For(cfg *kubeadmapi.JoinConfiguration) (*clientcmdapi.Config, error) {
  	// TODO: Print summary info about the CA certificate, along with the checksum signature
  	// we also need an ability for the user to configure the client to validate received CA cert against a checksum
  	config, err := DiscoverValidatedKubeConfig(cfg)
  	if err != nil {
  		return nil, errors.Wrap(err, "couldn't validate the identity of the API Server")
  	}
  
  	if len(cfg.Discovery.TLSBootstrapToken) == 0 {
  		return config, nil
  	}
  	clusterinfo := kubeconfigutil.GetClusterFromKubeConfig(config)
  	return kubeconfigutil.CreateWithToken(
  		clusterinfo.Server,
  		kubeadmapiv1beta2.DefaultClusterName,
  		TokenUser,
  		clusterinfo.CertificateAuthorityData,
  		cfg.Discovery.TLSBootstrapToken,
  	), nil
  }
docs: // For returns a kubeconfig object that can be used for doing the TLS Bootstrap with the right credentials
  // Also, before returning anything, it makes sure it can trust the API Server