Controller least privilege

Kubernetes moves CA trust anchors out of per-namespace ConfigMaps and into one cluster-scoped object

KEP-3257 adds a ClusterTrustBundle object and a kubelet projected volume source, which lets a signer publish its roots without running a controller that holds create-ConfigMap permission in every namespace.