code: func setSelfHostedVolumesForControllerManager(podSpec *v1.PodSpec) {
  	for i, v := range podSpec.Volumes {
  		// If the volume name matches the expected one; switch the volume source from hostPath to cluster-hosted
  		if v.Name == kubeadmconstants.KubeCertificatesVolumeName {
  			podSpec.Volumes[i].VolumeSource = controllerManagerCertificatesVolumeSource()
  		} else if v.Name == kubeadmconstants.KubeConfigVolumeName {
  			podSpec.Volumes[i].VolumeSource = kubeConfigVolumeSource(kubeadmconstants.ControllerManagerKubeConfigFileName)
  		}
  	}
  
  	// Change directory for the kubeconfig directory to selfHostedKubeConfigDir
  	for i, vm := range podSpec.Containers[0].VolumeMounts {
  		if vm.Name == kubeadmconstants.KubeConfigVolumeName {
  			podSpec.Containers[0].VolumeMounts[i].MountPath = selfHostedKubeConfigDir
  		}
  	}
  
  	// Rewrite the --kubeconfig path as the volume mount path may not overlap with certs dir, which it does by default (/etc/kubernetes and /etc/kubernetes/pki)
  	// This is not a problem with hostPath mounts as hostPath supports mounting one file only, instead of always a full directory. Secrets and Projected Volumes
  	// don't support that.
  	podSpec.Containers[0].Command = kubeadmutil.ReplaceArgument(podSpec.Containers[0].Command, func(argMap map[string]string) map[string]string {
  		controllerManagerKubeConfigPath := filepath.Join(selfHostedKubeConfigDir, kubeadmconstants.ControllerManagerKubeConfigFileName)
  		argMap["kubeconfig"] = controllerManagerKubeConfigPath
  		if _, ok := argMap["authentication-kubeconfig"]; ok {
  			argMap["authentication-kubeconfig"] = controllerManagerKubeConfigPath
  		}
  		if _, ok := argMap["authorization-kubeconfig"]; ok {
  			argMap["authorization-kubeconfig"] = controllerManagerKubeConfigPath
  		}
  		return argMap
  	})
  }
docs: // setSelfHostedVolumesForControllerManager makes sure the self-hosted controller manager has the right volume source coming from a self-hosted cluster