return err
			}
		}

		// If there is a configmap storing the CA cert from a previous
		// integration test, remove it. Ideally, CI should delete all
		// resources from a previous integration test, but sometimes
		// the resources from a previous integration test are not deleted.
		configMapName := "istio-ca-root-cert"
		err = cluster.Kube().CoreV1().ConfigMaps(systemNs.Name()).Delete(context.TODO(), configMapName,

	rootCert, err := kubeClient.Kube().CoreV1().ConfigMaps(wg.Namespace).Get(context.Background(), controller.CACertNamespaceConfigMap, metav1.GetOptions{})
	// errors if the requested configmap does not exist in the given namespace
	if err != nil {
		return fmt.Errorf("configmap %s was not found in namespace %s: %v", controller.CACertNamespaceConfigMap, wg.Namespace, err)
	}

	}

	if printManifest {
		return configMapBytes, nil
	}

	kubeproxyConfigMap := &v1.ConfigMap{}
	if err := kuberuntime.DecodeInto(clientsetscheme.Codecs.UniversalDecoder(), configMapBytes, kubeproxyConfigMap); err != nil {
		return []byte(""), errors.Wrap(err, "unable to decode kube-proxy configmap")
	}

	if !kubeProxyCfg.IsUserSupplied() {

    version: "v1.85.0"
    app.kubernetes.io/version: "v1.85.0"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/part-of: "kiali"
...
---
# Source: kiali-server/templates/configmap.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: kiali
  namespace: istio-system
  labels:
    helm.sh/chart: kiali-server-1.85.0
    app: kiali
    app.kubernetes.io/name: kiali
    app.kubernetes.io/instance: kiali

	}
	for _, deployment := range deployments.Items {
		scopingImpacted := false

		// Obtain configmap to verify if affected features are used
		configMapName := "istio"
		if rev := deployment.Labels[label.IoIstioRev.Name]; rev != "default" {
			configMapName += fmt.Sprintf("-%s", rev)
		}
		configMap, err := cli.Kube().CoreV1().ConfigMaps(namespace).Get(context.TODO(), configMapName, metav1.GetOptions{})
		if err != nil {

}

func checkCACert(t framework.TestContext, testNamespace namespace.Instance) error {
	configMapName := "istio-ca-root-cert"
	cm, err := t.Clusters().Default().Kube().CoreV1().ConfigMaps(testNamespace.Name()).Get(context.TODO(), configMapName,
		metav1.GetOptions{})
	if err != nil {
		return err
	}
	var certData string
	var pluginCert []byte
	var ok bool

		{
			name: "istio cm",
			obj: &v1.ConfigMap{
				ObjectMeta: metav1.ObjectMeta{
					Name: "istio",
				},
			},
			expect: true,
		},
		{
			name: "sidecar cm",
			obj: &v1.ConfigMap{
				ObjectMeta: metav1.ObjectMeta{
					Name: "istio-sidecar-injector",
				},
			},
			expect: true,
		},
		{
			name: "not istio cm",
			obj: &v1.ConfigMap{
				ObjectMeta: metav1.ObjectMeta{

    name: system:controller:legacy-service-account-token-cleaner
  rules:
  - apiGroups:
    - ""
    resourceNames:
    - kube-apiserver-legacy-service-account-token-tracking
    resources:
    - configmaps
    verbs:
    - get
  - apiGroups:
    - ""
    resources:
    - secrets
    verbs:
    - delete
    - patch
- apiVersion: rbac.authorization.k8s.io/v1
  kind: ClusterRole

}

// loadCABundle determines the next set of content for the file.
func (c *ConfigMapCAController) loadCABundle() error {
	configMap, err := c.configmapLister.ConfigMaps(c.configmapNamespace).Get(c.configmapName)
	if err != nil {
		return err
	}
	caBundle := configMap.Data[c.configmapKey]
	if len(caBundle) == 0 {
		return fmt.Errorf("missing content for CA bundle %q", c.Name())
	}

	}

	if configMap != "" {
		if configMap == "" {
			configMap = "Corefile"
		}
		_, err = client.CoreV1().ConfigMaps(metav1.NamespaceSystem).Create(context.TODO(), &v1.ConfigMap{
			TypeMeta: metav1.TypeMeta{
				Kind:       "ConfigMap",
				APIVersion: "v1",
			},
			ObjectMeta: metav1.ObjectMeta{
				Name: configMap,
				Labels: map[string]string{