configMapName:      name,
		callback:           callback,
	}

	c.configmaps = kclient.NewFiltered[*v1.ConfigMap](client, kclient.Filter{
		Namespace:     namespace,
		FieldSelector: fields.OneTermEqualSelector(metav1.ObjectNameField, name).String(),
	})

	c.queue = controllers.NewQueue("configmap "+name, controllers.WithReconciler(c.processItem))

	secrets := informers.Core().V1().Secrets()
	configMaps := informers.Core().V1().ConfigMaps()
	bsc, err := NewSigner(cl, secrets, configMaps, options)
	if err != nil {
		return nil, nil, nil, nil, err
	}
	return bsc, cl, secrets, configMaps, nil
}

func newConfigMap(tokenID, signature string) *v1.ConfigMap {
	ret := &v1.ConfigMap{

- apiGroups:
  - ""
  resources:
  - namespaces
  - configmaps
  verbs:
  - get
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  labels:
    addonmanager.kubernetes.io/mode: Reconcile
  name: system:cloud-controller-manager
  namespace: kube-system
rules:
- apiGroups:
  - ""
  resources:
  - configmaps
  verbs:
  - watch
- apiGroups:
  - ""
  resources:

	expectConfigMap(t, nc.configmaps, CACertNamespaceConfigMap, "selected", expectedData)
	expectConfigMapNotExist(t, nc.configmaps, "not-selected")

	meshWatcher.Update(&meshconfig.MeshConfig{
		DiscoverySelectors: []*meshconfig.LabelSelector{{
			MatchLabels: map[string]string{"kubernetes.io/metadata.name": "not-selected"},
		}},
	}, time.Second)

)

func TestNewInformer(t *testing.T) {
	c := kube.NewFakeClient()
	ConfigMaps := krt.NewInformer[*corev1.ConfigMap](c)
	c.RunAndWait(test.NewStop(t))
	cmt := clienttest.NewWriter[*corev1.ConfigMap](t, c)
	tt := assert.NewTracker[string](t)
	ConfigMaps.Register(TrackerHandler[*corev1.ConfigMap](tt))

	assert.Equal(t, ConfigMaps.List(), nil)

	cmA := &corev1.ConfigMap{
		ObjectMeta: metav1.ObjectMeta{

	// WARNING: Register/UnregisterPod functions should be efficient,
	// i.e. should not block on network operations.

	// RegisterPod registers all configmaps from a given pod.
	RegisterPod(pod *v1.Pod)

	// UnregisterPod unregisters configmaps from a given pod that are not
	// used by any other registered pod.
	UnregisterPod(pod *v1.Pod)
}

// simpleConfigMapManager implements ConfigMap Manager interface with

    name: system:controller:bootstrap-signer
    namespace: kube-public
  rules:
  - apiGroups:
    - ""
    resources:
    - configmaps
    verbs:
    - get
    - list
    - watch
  - apiGroups:
    - ""
    resourceNames:
    - cluster-info
    resources:
    - configmaps
    verbs:
    - update
  - apiGroups:
    - ""
    - events.k8s.io
    resources:
    - events
    verbs:

func (nc *NamespaceController) Run(stopCh <-chan struct{}) {
	if !kube.WaitForCacheSync("namespace controller", stopCh, nc.namespaces.HasSynced, nc.configmaps.HasSynced) {
		return
	}

	go nc.startCaBundleWatcher(stopCh)
	nc.queue.Run(stopCh)
	controllers.ShutdownAll(nc.configmaps, nc.namespaces)
}

// startCaBundleWatcher listens for updates to the CA bundle and update cm in each namespace

	pod := &v1.Pod{
		ObjectMeta: metav1.ObjectMeta{
			Namespace: ns,
			Name:      podName,
		},
		Spec: v1.PodSpec{},
	}
	for i, configMaps := range toAttach.containerEnvConfigMaps {
		container := v1.Container{
			Name: fmt.Sprintf("container-%d", i),
		}
		for _, name := range configMaps.envFromNames {
			envFrom := v1.EnvFromSource{
				ConfigMapRef: &v1.ConfigMapEnvSource{
					LocalObjectReference: v1.LocalObjectReference{

    reported the following error on shutdown: failed to properly clean up distribution report: configmaps 
    "istiod-xxx-yyy-distribution" is forbidden: User "system:serviceaccount:istio-system:istiod" cannot