nixos/kubernetes: don't delete the apitoken after its created

This was breaking the nixos-kubernetes-node-join script
the token gets copied, and then immediately overridden with /dev/null when certmgr restarts.

nixos/modules/services/cluster/kubernetes/pki.nix

@@ -192,7 +192,8 @@ in
         mkdir -p "$(dirname "${certmgrAPITokenPath}")"
         if [ -f "${cfsslAPITokenPath}" ]; then
           ln -fs "${cfsslAPITokenPath}" "${certmgrAPITokenPath}"
-        else
+        elif [ ! -f "${certmgrAPITokenPath}" ]; then
+          # Don't remove the token if it already exists
           install -m 600 /dev/null "${certmgrAPITokenPath}"
         fi
       ''