here we saw a few problems with how kubeadm handles download of configuration from the cluster and then defaults it:
#2323

a couple of task here are:

• do not download the kubeadm-config for worker nodes because they don't need it (not true because of things like feature gates, which are stored in the CM)
• (related to the above) do not grant bootstrap tokens access to the kube-proxy config map bootstrap role grants access to kube-system.kube-proxy configmap (and shouldn't?) #2305
• don't apply dynamic defaults on commands that don't need them (such as kubeadm config images...)