createErr error
		expectErr bool
	}{
		{
			"successful case should have no error",
			true,
			nil,
			false,
		},
		{
			"if configmap already exists, return error",
			true,
			apierrors.NewAlreadyExists(schema.GroupResource{Resource: "configmaps"}, "test"),
			true,
		},
		{
			"unexpected error should be returned",
			true,
			apierrors.NewUnauthorized("go away!"),
			true,
		},
		{

	scopes.Framework.Infof("clean up cluster %s", c.Name())
	errG.Go(func() (err error) {
		if e := i.installer.Close(c); e != nil {
			err = multierror.Append(err, e)
		}

		// Cleanup all secrets and configmaps - these are dynamically created by tests and/or istiod so they are not captured above
		// This includes things like leader election locks (allowing next test to start without 30s delay),
		// custom cacerts, custom kubeconfigs, etc.

                "create",
                "update"
            ]
        },
        {
            "apiGroups": [
                ""
            ],
            "resources": [
                "configmaps",
                "endpoints",
                "events",
                "namespaces",
                "pods",
                "pods/proxy",
                "pods/portforward",

  - rolebindings
  verbs:
  - '*'
- apiGroups:
  - coordination.k8s.io
  resources:
  - leases
  verbs:
  - get
  - create
  - update
- apiGroups:
  - ""
  resources:
  - configmaps
  - endpoints
  - events
  - namespaces
  - pods
  - pods/proxy
  - pods/portforward
  - persistentvolumeclaims
  - secrets
  - services
  - serviceaccounts
  - resourcequotas

		NewListFunc:               func() runtime.Object { return &api.ConfigMapList{} },
		PredicateFunc:             configmap.Matcher,
		DefaultQualifiedResource:  api.Resource("configmaps"),
		SingularQualifiedResource: api.Resource("configmap"),

		CreateStrategy: configmap.Strategy,
		UpdateStrategy: configmap.Strategy,
		DeleteStrategy: configmap.Strategy,

    verbs: ["create"]
  - apiGroups: ["authorization.k8s.io"]
    resources: ["subjectaccessreviews"]
    verbs: ["create"]
{{- if .Values.global.externalIstiod }}
  - apiGroups: [""]
    resources: ["configmaps"]
    verbs: ["create", "get", "list", "watch", "update"]
  - apiGroups: ["admissionregistration.k8s.io"]
    resources: ["mutatingwebhookconfigurations"]
    verbs: ["get", "list", "watch", "update", "patch"]

	}

	// configmap informer
	i := informers.NewSharedInformerFactoryWithOptions(kubernetes.NewForConfigOrDie(restConfig), 1*time.Minute,
		informers.WithNamespace(namespace),
		informers.WithTweakListOptions(func(listOptions *metav1.ListOptions) {
			listOptions.LabelSelector = labels.Set(map[string]string{labelKey: "true"}).AsSelector().String()
		})).
		Core().V1().ConfigMaps()
	c.cmInformer = i.Informer()

	apiVersion: apiserver.config.k8s.io/v1
	resources:
	- resources:
	  - events
	  providers:
	  - identity: {}  # do not encrypt events even though *.* is specified below
	- resources:
	  - secrets
	  - configmaps
	  - pandas.awesome.bears.example
	  providers:
	  - aescbc:
	      keys:
	      - name: key1
	        secret: c2VjcmV0IGlzIHNlY3VyZQ==
	- resources:
	  - '*.apps'
	  providers:
	  - aescbc:

    verbs: ["create"]
  - apiGroups: ["authorization.k8s.io"]
    resources: ["subjectaccessreviews"]
    verbs: ["create"]
{{- if .Values.global.externalIstiod }}
  - apiGroups: [""]
    resources: ["configmaps"]
    verbs: ["create", "get", "list", "watch", "update"]
  - apiGroups: ["admissionregistration.k8s.io"]
    resources: ["mutatingwebhookconfigurations"]
    verbs: ["get", "list", "watch", "update", "patch"]

	apiVersion: apiserver.config.k8s.io/v1
	resources:
	- resources:
	  - events
	  providers:
	  - identity: {}  # do not encrypt events even though *.* is specified below
	- resources:
	  - secrets
	  - configmaps
	  - pandas.awesome.bears.example
	  providers:
	  - aescbc:
	      keys:
	      - name: key1
	        secret: c2VjcmV0IGlzIHNlY3VyZQ==
	- resources:
	  - '*.apps'
	  providers:
	  - aescbc: