kube-apiserver not authenticating correctly in multi master cluster
I eventually got to the bottom of this. I had not copied the same Service Account signing keys onto each master node (sa.key, sa.pub).
These keys are documented here: https://github.com/kubernetes/kubeadm/blob/master/docs/design/design_v1.7.md
a private key for signing ServiceAccount Tokens (sa.key) along with its public key (sa.pub)
And the step that I had missed is documented here: https://kubernetes.io/docs/setup/independent/high-availability/
Copy the contents of /etc/kubernetes/pki/ca.crt, /etc/kubernetes/pki/ca.key, /etc/kubernetes/pki/sa.key and /etc/kubernetes/pki/sa.pub and create these files manually on master1 and master2