corev1client "k8s.io/client-go/kubernetes/typed/core/v1"
)

// TODO: This is almost a exact replica of Endpoints lock.
// going forwards as we self host more and more components
// and use ConfigMaps as the means to pass that configuration
// data we will likely move to deprecate the Endpoints lock.

type ConfigMapLock struct {
	// ConfigMapMeta should contain a Name and a Namespace of a

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  labels:
    addonmanager.kubernetes.io/mode: Reconcile
  name: gce:cloud-provider
  namespace: kube-system
rules:
- apiGroups:
  - ""
  resources:
  - configmaps
  verbs:
  - create
  - get
  - patch
  - update
  - list
  - watch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  labels:

    verbs: ["get", "list", "watch"]
  # misc access
  - apiGroups: [""]
    resources: ["events"]
    verbs: ["create", "update", "patch"]
  - apiGroups: [""]
    resources: ["configmaps"]
    verbs: ["create"]
  - apiGroups: [""]
    resources: ["configmaps"]
    resourceNames: ["cluster-autoscaler-status"]
    verbs: ["get", "update", "patch", "delete"]
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1

  - apiGroups: [""]
    resources:
      - pods
      - nodes
      - namespaces
    verbs:
      - get
  # calico/node checks configmaps for cluster CIDR.
  - apiGroups: [""]
    resources:
      - configmaps
    verbs:
      - get
  - apiGroups: [""]
    resources:
      - endpoints
      - services
    verbs:
      # Used to discover service IPs for advertisement.

	created := false

	for _, action := range client.Actions() {
		t.Log(dump.Pretty(action))
		if action.Matches("create", "configmaps") {
			created = true
			obj := action.(clienttesting.CreateAction).GetObject().(*corev1.ConfigMap)
			ret[obj.Name] = obj
		}
		if action.Matches("update", "configmaps") {
			obj := action.(clienttesting.UpdateAction).GetObject().(*corev1.ConfigMap)
			ret[obj.Name] = obj
		}
	}

	klog.Info("Starting legacy_token_tracking_controller")
	defer klog.Infof("Shutting down legacy_token_tracking_controller")

	go c.configMapInformer.Run(stopCh)
	if !cache.WaitForNamedCacheSync("configmaps", stopCh, c.configMapSynced) {
		return
	}

	go wait.Until(c.runWorker, time.Second, stopCh)

	c.queue.Add(queueKey)

	<-stopCh
	klog.Info("Ending legacy_token_tracking_controller")
}

					Group:    "",
					Version:  "v1",
					Resource: "configmaps",
				}, nil
			},
			expectErr: false,
		},
		{
			name:     "denied",
			userInfo: &user.DefaultInfo{Groups: []string{user.AllAuthenticated}},
			auth: func(ctx context.Context, a authorizer.Attributes) (authorized authorizer.Decision, reason string, err error) {
				if a.GetResource() == "configmaps" {
					return authorizer.DecisionAllow, "", nil
				}

apiVersion: release-notes/v2
kind: bug-fix
area: istioctl
issue:
- 46563
releaseNotes:
- |

			ctx := context.Background()
			if _, err := client.CoreV1().ConfigMaps(cm.ObjectMeta.Namespace).Create(ctx, cm, metav1.CreateOptions{}); err != nil {
				if !apierrors.IsAlreadyExists(err) {
					lastError = errors.Wrap(err, "unable to create ConfigMap")
					return false, nil
				}
				if _, err := client.CoreV1().ConfigMaps(cm.ObjectMeta.Namespace).Update(ctx, cm, metav1.UpdateOptions{}); err != nil {

	"k8s.io/klog/v2"

	"k8s.io/kubernetes/cmd/kubeadm/app/util/apiclient"
)

const (
	// BootstrapSignerClusterRoleName sets the name for the ClusterRole that allows access to ConfigMaps in the kube-public ns
	BootstrapSignerClusterRoleName = "kubeadm:bootstrap-signer-clusterinfo"
)

// CreateBootstrapConfigMapIfNotExists creates the kube-public ConfigMap if it doesn't exist already