# TODO provide distinct trust between this and the KCM itself
apiVersion: v1
kind: ConfigMap
metadata:
  name: kube-controller-cert-syncer-kubeconfig
  namespace: openshift-kube-controller-manager
data:
  kubeconfig: |
    apiVersion: v1
    clusters:
      - cluster:
          certificate-authority: /etc/kubernetes/static-pod-resources/secrets/localhost-recovery-client-token/ca.crt
          server: https://localhost:6443
          tls-server-name: localhost-recovery
        name: loopback
    contexts:
      - context:
          cluster: loopback
          user: kube-controller-manager
        name: kube-controller-manager
    current-context: kube-controller-manager
    kind: Config
    preferences: {}
    users:
      - name: kube-controller-manager
        user:
          tokenFile: /etc/kubernetes/static-pod-resources/secrets/localhost-recovery-client-token/token
