code: func createConfigMapRBACRules(client clientset.Interface, k8sVersion *version.Version) error {
  	if err := apiclient.CreateOrUpdateRole(client, &rbac.Role{
  		ObjectMeta: metav1.ObjectMeta{
  			Name:      configMapRBACName(k8sVersion),
  			Namespace: metav1.NamespaceSystem,
  		},
  		Rules: []rbac.PolicyRule{
  			rbachelper.NewRule("get").Groups("").Resources("configmaps").Names(kubeadmconstants.GetKubeletConfigMapName(k8sVersion)).RuleOrDie(),
  		},
  	}); err != nil {
  		return err
  	}
  
  	return apiclient.CreateOrUpdateRoleBinding(client, &rbac.RoleBinding{
  		ObjectMeta: metav1.ObjectMeta{
  			Name:      configMapRBACName(k8sVersion),
  			Namespace: metav1.NamespaceSystem,
  		},
  		RoleRef: rbac.RoleRef{
  			APIGroup: rbac.GroupName,
  			Kind:     "Role",
  			Name:     configMapRBACName(k8sVersion),
  		},
  		Subjects: []rbac.Subject{
  			{
  				Kind: rbac.GroupKind,
  				Name: kubeadmconstants.NodesGroup,
  			},
  			{
  				Kind: rbac.GroupKind,
  				Name: kubeadmconstants.NodeBootstrapTokenAuthGroup,
  			},
  		},
  	})
  }
docs: // createConfigMapRBACRules creates the RBAC rules for exposing the base kubelet ConfigMap in the kube-system namespace to unauthenticated users