return err
		}
	} else {
		configMap := obj.(*corev1.ConfigMap)
		if _, err = time.Parse(dateFormat, configMap.Data[ConfigMapDataKey]); err != nil {
			configMap := configMap.DeepCopy()
			if configMap.Data == nil {
				configMap.Data = map[string]string{}
			}
			configMap.Data[ConfigMapDataKey] = now.UTC().Format(dateFormat)

		sysEndpoints    = resource("endpoints", "kube-system")
		services        = resource("services", "default")
		serviceStatus   = resource("services", "default", "", "status")
		configmaps      = resource("configmaps", "default")
		sysConfigmaps   = resource("configmaps", "kube-system")
		namespaces      = resource("namespaces")
		namespaceStatus = resource("namespaces", "", "", "status")
		namespaceFinal  = resource("namespaces", "", "", "finalize")

	ctx := context.Background()
	configMap, err := client.CoreV1().ConfigMaps(meta.Namespace).Get(ctx, meta.Name, metav1.GetOptions{})
	if err != nil {
		return errors.Wrap(err, "unable to get ConfigMap")
	}
	if err = mutator(configMap); err != nil {
		return errors.Wrap(err, "unable to mutate ConfigMap")
	}
	_, err = client.CoreV1().ConfigMaps(configMap.ObjectMeta.Namespace).Update(ctx, configMap, metav1.UpdateOptions{})

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  labels:
    addonmanager.kubernetes.io/mode: Reconcile
  name: gce:cloud-provider
  namespace: kube-system
rules:
- apiGroups:
  - ""
  resources:
  - configmaps
  verbs:
  - create
  - get
  - patch
  - update
  - list
  - watch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  labels:

    verbs: ["get", "list", "watch"]
  # misc access
  - apiGroups: [""]
    resources: ["events"]
    verbs: ["create", "update", "patch"]
  - apiGroups: [""]
    resources: ["configmaps"]
    verbs: ["create"]
  - apiGroups: [""]
    resources: ["configmaps"]
    resourceNames: ["cluster-autoscaler-status"]
    verbs: ["get", "update", "patch", "delete"]
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1

	BootstrapSignerClusterRoleName = "kubeadm:bootstrap-signer-clusterinfo"
)

// CreateBootstrapConfigMapIfNotExists creates the kube-public ConfigMap if it doesn't exist already
func CreateBootstrapConfigMapIfNotExists(client clientset.Interface, file string) error {

  - apiGroups: [""]
    resources:
      - pods
      - nodes
      - namespaces
    verbs:
      - get
  # calico/node checks configmaps for cluster CIDR.
  - apiGroups: [""]
    resources:
      - configmaps
    verbs:
      - get
  - apiGroups: [""]
    resources:
      - endpoints
      - services
    verbs:
      # Used to discover service IPs for advertisement.

						ParamKind: &admissionregistration.ParamKind{Kind: "ConfigMap", APIVersion: "v1"},
					},
				}, nil
			},
			resourceResolver: func(gvk schema.GroupVersionKind) (schema.GroupVersionResource, error) {
				return schema.GroupVersionResource{
					Group:    "",
					Version:  "v1",
					Resource: "configmaps",
				}, nil
			},
			expectErr: false,
		},
		{
			name:     "denied",

	c := kube.NewFakeClient()
	ConfigMaps := krt.NewInformer[*corev1.ConfigMap](c)
	stop := test.NewStop(t)
	c.RunAndWait(stop)
	cmt := clienttest.NewWriter[*corev1.ConfigMap](t, c)
	ConfigMapNames := krt.NewSingleton[string](
		func(ctx krt.HandlerContext) *string {
			cms := krt.Fetch(ctx, ConfigMaps)
			return ptr.Of(slices.Join(",", slices.Map(cms, func(c *corev1.ConfigMap) string {
				return config.NamespacedName(c).String()

    verbs: ["get", "update"]
  - apiGroups: ["apps"]
    resources: ["deployments/scale", "replicasets/scale"]
    verbs: ["get", "update"]
# Remove the configmaps rule once below issue is fixed:
# kubernetes-incubator/cluster-proportional-autoscaler#16
  - apiGroups: [""]
    resources: ["configmaps"]
    verbs: ["get", "create"]
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata: