This bug will track the addition of the service ca configmap publisher to 4.7. The intention is that 4.7 clusters be upgraded to a release that includes the publisher so that subsequent upgrades to 4.8 will be assured of having all namespaces containing a service ca configmap. This will minimize disruption when kube-apiserver is updated to 4.8 and all new pods are supplied tokens via BoundServiceAccountProjectedVolume which will expect the service ca configmap to already exist.

Moving this modified ahead of the followup test changes. I'll detach those from the bug and we'll merge them as a test only change without a bug.

Tested in cluster 4.7.0-0.nightly-2021-07-07-214918
1. check configmap/openshift-service-ca.crt in every namespace, the test result is it's existed for each namespace 
$ oc get configmap/openshift-service-ca.crt -n each_namespace
NAME                       DATA   AGE
openshift-service-ca.crt   1      8m

2. check configmap/openshift-service-ca.crt is presented for new project
$ oc new-project mytest
$ oc get cm  | grep openshift-service-ca.crt
openshift-service-ca.crt   1      57s

3. check pod creation during the upgrade process to 4.8.0-0.nightly-2021-07-04-112043
$ oc adm upgrade --to-image=registry.ci.openshift.org/ocp/release:4.8.0-0.nightly-2021-07-04-112043 --force=true --allow-explicit-upgrade=true

create pod 22 minutes later after upgrade start, test result shows pod is Running status and configMap "openshift-service-ca.crt" is presented
$ oc get pod postgresql-1-9jpqm -o json | jq .spec.volumes
[
  {
    "emptyDir": {},
    "name": "data"
  },
  {
    "name": "kube-api-access-grcr7",
    "projected": {
      "defaultMode": 420,
      "sources": [
        {
          "serviceAccountToken": {
            "expirationSeconds": 3607,
            "path": "token"
          }
        },
        {
          "configMap": {
            "items": [
              {
                "key": "ca.crt",
                "path": "ca.crt"
              }
            ],
            "name": "kube-root-ca.crt"
          }
        },
        {
          "downwardAPI": {
            "items": [
              {
                "fieldRef": {
                  "apiVersion": "v1",
                  "fieldPath": "metadata.namespace"
                },
                "path": "namespace"
              }
            ]
          }
        },
        {
          "configMap": {
            "items": [
              {
                "key": "service-ca.crt",
                "path": "service-ca.crt"
              }
            ],
            "name": "openshift-service-ca.crt"
          }
        }
      ]
    }
  }
]

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (OpenShift Container Platform 4.7.21 bug fix update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2021:2762