"create",
                "update"
            ]
        },
        {
            "apiGroups": [
                ""
            ],
            "resources": [
                "configmaps",
                "endpoints",
                "events",
                "namespaces",
                "pods",
                "pods/proxy",
                "pods/portforward",

  - rolebindings
  verbs:
  - '*'
- apiGroups:
  - coordination.k8s.io
  resources:
  - leases
  verbs:
  - get
  - create
  - update
- apiGroups:
  - ""
  resources:
  - configmaps
  - endpoints
  - events
  - namespaces
  - pods
  - pods/proxy
  - pods/portforward
  - persistentvolumeclaims
  - secrets
  - services
  - serviceaccounts
  - resourcequotas

	watcher, err := fsnotify.NewWatcher()
	if err != nil {
		return nil, err
	}
	// watch the parent directory of the target files so we can catch
	// symlink updates of k8s ConfigMaps volumes.
	watchDir, _ := filepath.Split(configFile)
	if err := watcher.Add(watchDir); err != nil {
		return nil, fmt.Errorf("could not watch %v: %v", watchDir, err)
	}
	return &fileWatcher{
		watcher:    watcher,

										Duration: 3 * time.Second,
									},
									Endpoint: "unix:///tmp/testprovider.sock",
								},
							},
						},
					},
					{
						Resources: []string{"configmaps"},
						Providers: []apiserver.ProviderConfiguration{
							{
								KMS: &apiserver.KMSConfiguration{
									Name:       "kms",
									APIVersion: "v1",
									Timeout: &metav1.Duration{

		{
			"successful case should have no error",
			true,
			nil,
			false,
		},
		{
			"if configmap already exists, return error",
			true,
			apierrors.NewAlreadyExists(schema.GroupResource{Resource: "configmaps"}, "test"),
			true,
		},
		{
			"unexpected error should be returned",
			true,
			apierrors.NewUnauthorized("go away!"),
			true,
		},
		{
			"if the file does not exist, return error",
			false,

	return err
}

func writeConfigMap(configMapClient corev1client.ConfigMapsGetter, required *corev1.ConfigMap) error {
	_, err := configMapClient.ConfigMaps(required.Namespace).Update(context.TODO(), required, metav1.UpdateOptions{})
	if apierrors.IsNotFound(err) {
		_, err := configMapClient.ConfigMaps(required.Namespace).Create(context.TODO(), required, metav1.CreateOptions{})
		return err
	}

    verbs: ["create"]
  - apiGroups: ["authorization.k8s.io"]
    resources: ["subjectaccessreviews"]
    verbs: ["create"]
{{- if .Values.global.externalIstiod }}
  - apiGroups: [""]
    resources: ["configmaps"]
    verbs: ["create", "get", "list", "watch", "update"]
  - apiGroups: ["admissionregistration.k8s.io"]
    resources: ["mutatingwebhookconfigurations"]
    verbs: ["get", "list", "watch", "update", "patch"]

          "{{$data.Name}}":
            {{$data.Match}}: {{$data.Value}}
        {{- end }}
      {{- end }}
    route:
    - destination:
        host: {{ .dstSvc }}
---
`
	configAll := configRoute + `
apiVersion: security.istio.io/v1beta1
kind: RequestAuthentication
metadata:
  name: default
  namespace: {{.SystemNamespace | default "istio-system"}}
spec:
  jwtRules:

)

// legacyObjectCountAliases are what we used to do simple object counting quota with mapped to alias
var legacyObjectCountAliases = map[schema.GroupVersionResource]corev1.ResourceName{
	corev1.SchemeGroupVersion.WithResource("configmaps"):             corev1.ResourceConfigMaps,
	corev1.SchemeGroupVersion.WithResource("resourcequotas"):         corev1.ResourceQuotas,

	apiVersion: apiserver.config.k8s.io/v1
	resources:
	- resources:
	  - events
	  providers:
	  - identity: {}  # do not encrypt events even though *.* is specified below
	- resources:
	  - secrets
	  - configmaps
	  - pandas.awesome.bears.example
	  providers:
	  - aescbc:
	      keys:
	      - name: key1
	        secret: c2VjcmV0IGlzIHNlY3VyZQ==
	- resources:
	  - '*.apps'
	  providers:
	  - aescbc: