code: func isClientConfigStillValid(kubeconfigPath string) (bool, error) {
  	_, err := os.Stat(kubeconfigPath)
  	if os.IsNotExist(err) {
  		return false, nil
  	}
  	if err != nil {
  		return false, fmt.Errorf("error reading existing bootstrap kubeconfig %s: %v", kubeconfigPath, err)
  	}
  	bootstrapClientConfig, err := loadRESTClientConfig(kubeconfigPath)
  	if err != nil {
  		utilruntime.HandleError(fmt.Errorf("Unable to read existing bootstrap client config: %v", err))
  		return false, nil
  	}
  	transportConfig, err := bootstrapClientConfig.TransportConfig()
  	if err != nil {
  		utilruntime.HandleError(fmt.Errorf("Unable to load transport configuration from existing bootstrap client config: %v", err))
  		return false, nil
  	}
  	// has side effect of populating transport config data fields
  	if _, err := transport.TLSConfigFor(transportConfig); err != nil {
  		utilruntime.HandleError(fmt.Errorf("Unable to load TLS configuration from existing bootstrap client config: %v", err))
  		return false, nil
  	}
  	certs, err := certutil.ParseCertsPEM(transportConfig.TLS.CertData)
  	if err != nil {
  		utilruntime.HandleError(fmt.Errorf("Unable to load TLS certificates from existing bootstrap client config: %v", err))
  		return false, nil
  	}
  	if len(certs) == 0 {
  		utilruntime.HandleError(fmt.Errorf("Unable to read TLS certificates from existing bootstrap client config: %v", err))
  		return false, nil
  	}
  	now := time.Now()
  	for _, cert := range certs {
  		if now.After(cert.NotAfter) {
  			utilruntime.HandleError(fmt.Errorf("Part of the existing bootstrap client certificate is expired: %s", cert.NotAfter))
  			return false, nil
  		}
  	}
  	return true, nil
  }
docs: // isClientConfigStillValid checks the provided kubeconfig to see if it has a valid
  // client certificate. It returns true if the kubeconfig is valid, or an error if bootstrapping
  // should stop immediately.