When joining a cluster with versions of
kubeadm and/ or
kubelet which don't match the master, you get an error like:
[kubelet] Downloading configuration for the kubelet from the "kubelet-config-1.11" ConfigMap in the kube-system namespace configmaps "kubelet-config-1.11" is forbidden: User "system:bootstrap:tn8mhk" cannot get configmaps in the namespace "kube-system"
This can be fixed by installing matching versions (e.g.
apt-cache madison kubeadm then
apt-get install kubeadm=OUTPUT_FROM_APT-CACHE
apt-cache policy PACKAGE_NAME to get the currently installed version on the master.