To inject ca.crt into container when projected volume was specified, configmap should be created in each namespace.
This patch add a controller called "root-ca-cert-publisher" to complete above job as well as some bootstrap rbac policies.