notAfter = startTime.Add(validityPeriod)
			}

			// if the kubeconfig file for an additional user has to use a token, use it
			if token != "" {
				return kubeconfigphase.WriteKubeConfigWithToken(out, internalCfg, clientName, token, notAfter)
			}

			// Otherwise, write a kubeconfig file with a generate client cert