func (nc *NamespaceController) Run(stopCh <-chan struct{}) {
	if !kube.WaitForCacheSync("namespace controller", stopCh, nc.namespaces.HasSynced, nc.configmaps.HasSynced) {
		return
	}

	go nc.startCaBundleWatcher(stopCh)
	nc.queue.Run(stopCh)
	controllers.ShutdownAll(nc.configmaps, nc.namespaces)
}

// startCaBundleWatcher listens for updates to the CA bundle and update cm in each namespace

	pod := &v1.Pod{
		ObjectMeta: metav1.ObjectMeta{
			Namespace: ns,
			Name:      podName,
		},
		Spec: v1.PodSpec{},
	}
	for i, configMaps := range toAttach.containerEnvConfigMaps {
		container := v1.Container{
			Name: fmt.Sprintf("container-%d", i),
		}
		for _, name := range configMaps.envFromNames {
			envFrom := v1.EnvFromSource{
				ConfigMapRef: &v1.ConfigMapEnvSource{
					LocalObjectReference: v1.LocalObjectReference{

    reported the following error on shutdown: failed to properly clean up distribution report: configmaps 
    "istiod-xxx-yyy-distribution" is forbidden: User "system:serviceaccount:istio-system:istiod" cannot 

				core.NewCreateAction(schema.GroupVersionResource{Version: "v1", Resource: "configmaps"}, metav1.NamespaceSystem, &corev1.ConfigMap{ObjectMeta: metav1.ObjectMeta{Namespace: metav1.NamespaceSystem, Name: ConfigMapName}, Data: map[string]string{ConfigMapDataKey: now.Format(dateFormat)}}),

		// role for the cloud providers to access/create kube-system configmaps
		// Deprecated starting Kubernetes 1.10 and will be deleted according to GA deprecation policy.
		ObjectMeta: metav1.ObjectMeta{Name: saRolePrefix + "cloud-provider"},
		Rules: []rbacv1.PolicyRule{
			rbacv1helpers.NewRule("create", "get", "list", "watch").Groups(legacyGroup).Resources("configmaps").RuleOrDie(),
		},
	})

apiVersion: release-notes/v2
kind: feature
area: installation
issue:
- 31410
releaseNotes:
- |
  **Improved** configmaps to be read directly rather than from volume mounts. This improves the speed

				client.PrependReactor("create", "configmaps", func(clientgotesting.Action) (bool, runtime.Object, error) {
					return true, nil, nil
				})
				client.PrependReactor("get", "configmaps", func(clientgotesting.Action) (bool, runtime.Object, error) {
					return true, nil, nil
				})
				client.PrependReactor("update", "configmaps", func(clientgotesting.Action) (bool, runtime.Object, error) {

			cms := []*v1.ConfigMap{}
			if features.SharedMeshConfig != "" {
				cms = AppendNonNil(cms, krt.FetchOne(ctx, ConfigMaps,
					krt.FilterObjectName(types.NamespacedName{Name: features.SharedMeshConfig, Namespace: options.SystemNamespace})))
			}
			cms = AppendNonNil(cms, krt.FetchOne(ctx, ConfigMaps,
				krt.FilterObjectName(types.NamespacedName{Name: cmName, Namespace: options.SystemNamespace})))

			for _, c := range cms {

		configMapLister:    configMaps.Lister(),
		configMapSynced:    configMaps.Informer().HasSynced,
		syncQueue: workqueue.NewTypedRateLimitingQueueWithConfig(
			workqueue.DefaultTypedControllerRateLimiter[string](),
			workqueue.TypedRateLimitingQueueConfig[string]{
				Name: "bootstrap_signer_queue",
			},
		),
	}

	configMaps.Informer().AddEventHandlerWithResyncPeriod(

		sysEndpoints    = resource("endpoints", "kube-system")
		services        = resource("services", "default")
		serviceStatus   = resource("services", "default", "", "status")
		configmaps      = resource("configmaps", "default")
		sysConfigmaps   = resource("configmaps", "kube-system")
		namespaces      = resource("namespaces")
		namespaceStatus = resource("namespaces", "", "", "status")
		namespaceFinal  = resource("namespaces", "", "", "finalize")