<p>I have a kubeadm deployed master (v1.10.12) and I'm trying to add a new node to the cluster:</p>
<p>on the master I do:</p>
<pre><code>sudo kubeadm token create
sudo kubeadm token list
TOKEN                     TTL       EXPIRES                USAGES                   DESCRIPTION   EXTRA GROUPS
2txs62.83q81hpici7a0u5q   23h       2018-12-20T23:37:46Z   authentication,signing   &lt;none&gt;        system:bootstrappers:kubeadm:default-node-token
</code></pre>
<p>and then on the new node, I run:</p>
<pre><code>sudo yum install -y kubeadm-1.10.12-0
sudo yum install -y kubelet-1.10.12-0

sudo kubeadm reset

sudo kubeadm join --token 2txs62.83q81hpici7a0u5q W.X.Y.Z:6443 --discovery-token-unsafe-skip-ca-verification
[preflight] Running pre-flight checks
[discovery] Trying to connect to API Server &quot;W.X.Y.Z:6443&quot;
[discovery] Created cluster-info discovery client, requesting info from &quot;https://W.X.Y.Z:6443&quot;
[discovery] Cluster info signature and contents are valid and no TLS pinning was specified, will use API Server &quot;W.X.Y.Z:6443&quot;
[discovery] Successfully established connection with API Server &quot;W.X.Y.Z:6443&quot;
[join] Reading configuration from the cluster...
[join] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -oyaml'
unable to fetch the kubeadm-config ConfigMap: failed to get config map: configmaps &quot;kubeadm-config&quot; is forbidden: User &quot;system:bootstrap:2txs62&quot; cannot get configmaps in the namespace &quot;kube-system&quot;
</code></pre>
<p>on the master:</p>
<pre><code>kubectl -n kube-system get cm kubeadm-config -oyaml
apiVersion: v1
data:
  MasterConfiguration: |
    api:
      advertiseAddress: W.X.Y.Z
      bindPort: 6443
      controlPlaneEndpoint: &quot;&quot;
    auditPolicy:
      logDir: /var/log/kubernetes/audit
      logMaxAge: 2
      path: &quot;&quot;
    authorizationModes:
    - Node
    - RBAC
    certificatesDir: /etc/kubernetes/pki
    cloudProvider: &quot;&quot;
    criSocket: /var/run/dockershim.sock
    etcd:
      caFile: &quot;&quot;
      certFile: &quot;&quot;
      dataDir: /var/lib/etcd
      endpoints: null
      image: &quot;&quot;
      keyFile: &quot;&quot;
    imageRepository: gcr.io/google_containers
    kubeProxy:
      config:
        bindAddress: 0.0.0.0
        clientConnection:
          acceptContentTypes: &quot;&quot;
          burst: 10
          contentType: application/vnd.kubernetes.protobuf
          kubeconfig: /var/lib/kube-proxy/kubeconfig.conf
          qps: 5
        clusterCIDR: &quot;&quot;
        configSyncPeriod: 15m0s
        conntrack:
          max: null
          maxPerCore: 32768
          min: 131072
          tcpCloseWaitTimeout: 1h0m0s
          tcpEstablishedTimeout: 24h0m0s
        enableProfiling: false
        featureGates:
          &quot;&quot;: false
        healthzBindAddress: 0.0.0.0:10256
        hostnameOverride: &quot;&quot;
        iptables:
          masqueradeAll: false
          masqueradeBit: 14
          minSyncPeriod: 0s
          syncPeriod: 30s
        ipvs:
          minSyncPeriod: 0s
          scheduler: &quot;&quot;
          syncPeriod: 30s
        metricsBindAddress: 127.0.0.1:10249
        mode: &quot;&quot;
        nodePortAddresses: null
        oomScoreAdj: -999
        portRange: &quot;&quot;
        resourceContainer: /kube-proxy
        udpIdleTimeout: 250ms
    kubeletConfiguration: {}
    kubernetesVersion: v1.10.12
    networking:
      dnsDomain: cluster.local
      podSubnet: &quot;&quot;
      serviceSubnet: 10.96.0.0/12
    nodeName: kube-master.novalocal
    privilegedPods: false
    token: &quot;&quot;
    tokenGroups:
    - system:bootstrappers:kubeadm:default-node-token
    tokenTTL: 24h0m0s
    tokenUsages:
    - signing
    - authentication
    unifiedControlPlaneImage: &quot;&quot;
kind: ConfigMap
metadata:
  creationTimestamp: 2018-03-28T06:37:58Z
  name: kubeadm-config
  namespace: kube-system
  resourceVersion: &quot;105798137&quot;
  selfLink: /api/v1/namespaces/kube-system/configmaps/kubeadm-config
  uid: 8dc493f2-3252-11e8-a270-fa163e21c438
</code></pre>
<p>Help!?
Cheers.</p>

<p>Sounds like you have a version mismatch and running into something like <a href="https://github.com/kubernetes/kubeadm/issues/907" rel="nofollow noreferrer">this</a>.</p>

<p>You can manually try to create a <code>Role</code> in the <code>kube-system</code> namespace with the name <code>kubeadm:kubeadm-config</code>. For example:</p>

<pre><code>cat &lt;&lt;EOF | kubectl apply -f -
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: kube-system
  name: kubeadm:kubeadm-config
rules:
- apiGroups:
  - ""
  resourceNames:
  - kubeadm-config
  resources:
  - configmaps
  verbs:
  - get
EOF
</code></pre>

<p>and then create a matching <code>RoleBinding</code>:</p>

<pre><code>cat &lt;&lt;EOF | kubectl apply -f -
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  namespace: kube-system
  name: kubeadm:kubeadm-config
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: kubeadm:kubeadm-config
subjects:
- apiGroup: rbac.authorization.k8s.io
  kind: Group
  name: system:nodes
- apiGroup: rbac.authorization.k8s.io
  kind: Group
  name: system:bootstrappers:kubeadm:default-node-token
EOF
</code></pre>
