code: func (e *Signer) signConfigMap() {
  	origCM := e.getConfigMap()
  
  	if origCM == nil {
  		return
  	}
  
  	var needUpdate = false
  
  	newCM := origCM.DeepCopy()
  
  	// First capture the config we are signing
  	content, ok := newCM.Data[bootstrapapi.KubeConfigKey]
  	if !ok {
  		klog.V(3).Infof("No %s key in %s/%s ConfigMap", bootstrapapi.KubeConfigKey, origCM.Namespace, origCM.Name)
  		return
  	}
  
  	// Next remove and save all existing signatures
  	sigs := map[string]string{}
  	for key, value := range newCM.Data {
  		if strings.HasPrefix(key, bootstrapapi.JWSSignatureKeyPrefix) {
  			tokenID := strings.TrimPrefix(key, bootstrapapi.JWSSignatureKeyPrefix)
  			sigs[tokenID] = value
  			delete(newCM.Data, key)
  		}
  	}
  
  	// Now recompute signatures and store them on the new map
  	tokens := e.getTokens()
  	for tokenID, tokenValue := range tokens {
  		sig, err := computeDetachedSig(content, tokenID, tokenValue)
  		if err != nil {
  			utilruntime.HandleError(err)
  		}
  
  		// Check to see if this signature is changed or new.
  		oldSig, _ := sigs[tokenID]
  		if sig != oldSig {
  			needUpdate = true
  		}
  		delete(sigs, tokenID)
  
  		newCM.Data[bootstrapapi.JWSSignatureKeyPrefix+tokenID] = sig
  	}
  
  	// If we have signatures left over we know that some signatures were
  	// removed.  We now need to update the ConfigMap
  	if len(sigs) != 0 {
  		needUpdate = true
  	}
  
  	if needUpdate {
  		e.updateConfigMap(newCM)
  	}
  }
docs: // signConfigMap computes the signatures on our latest cached objects and writes
  // back if necessary.