<p>Getting the Below error:-</p>
<pre><code>Failed to update lock: configmaps &quot;ingress-controller-leader-internal-nginx-internal&quot; is forbidden: User &quot;system:serviceaccount:ingress-nginx-internal:ingress-nginx-internal&quot; cannot update resource &quot;configmaps&quot; in API group &quot;&quot; in the namespace &quot;ingress-nginx-internal&quot;
</code></pre>
<p>I am using multiple ingress controller in my setup with two different namespaces.
Ingress-Nginx-internal
Ingress-Nginx-external</p>
<p>After installation everything works fine till 15 hrs, getting the above error.</p>
<p>Ingress-nginx-internal.yaml</p>
<pre><code>https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-0.32.0/deploy/static/provider/aws/deploy.yaml
</code></pre>
<p>In the above deploy.YAML, I replace. sed 's/ingress-Nginx/ingress-Nginx-internal/g' deploy.yaml</p>
<p>the output of below command:-</p>
<pre><code># kubectl describe cm ingress-controller-leader-internal-nginx-internal -n ingress-nginx-internal
Name:         ingress-controller-leader-internal-nginx-internal
Namespace:    ingress-nginx-internal
Labels:       &lt;none&gt;
Annotations:  control-plane.alpha.kubernetes.io/leader:
                {&quot;holderIdentity&quot;:&quot;ingress-nginx-internal-controller-657&quot;,&quot;leaseDurationSeconds&quot;:30,&quot;acquireTime&quot;:&quot;2020-07-24T06:06:27Z&quot;,&quot;ren...

Data
====
Events:  &lt;none&gt;
</code></pre>
<p>Service:-</p>
<pre><code>apiVersion: v1
kind: ServiceAccount
metadata:
  labels:
    helm.sh/chart: ingress-nginx-internal-2.0.3
    app.kubernetes.io/name: ingress-nginx-internal
    app.kubernetes.io/instance: ingress-nginx-internal
    app.kubernetes.io/version: 0.32.0
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/component: controller
  name: ingress-nginx-internal
  namespace: ingress-nginx-internal
</code></pre>

<p>From the docs <a href="https://kubernetes.github.io/ingress-nginx/user-guide/multiple-ingress/#multiple-ingress-nginx-controllers" rel="noreferrer">here</a></p>
<p>To run multiple NGINX ingress controllers (e.g. one which serves public traffic, one which serves &quot;internal&quot; traffic) the option <code>--ingress-class</code> must be changed to a value unique for the cluster within the definition of the replication controller. Here is a partial example:</p>
<pre><code>spec:
  template:
     spec:
       containers:
         - name: nginx-ingress-internal-controller
           args:
             - /nginx-ingress-controller
             - '--election-id=ingress-controller-leader-internal'
             - '--ingress-class=nginx-internal'
             - '--configmap=ingress/nginx-ingress-internal-controller'
</code></pre>
<p>When you create the ingress resource for internal you need to specify the ingress class as specified above i.e <code>nginx-internal</code></p>
<p>Check the permission of the service account using below command. It it returns <code>no</code> then create the role and rolebinding.</p>
<pre><code>kubectl auth can-i update configmaps --as=system:serviceaccount:ingress-nginx-internal:ingress-nginx-internal -n ingress-nginx-internal
</code></pre>
<p>RBAC</p>
<pre><code>apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: cm-role
  namespace: ingress-nginx-internal
rules:
- apiGroups:
  - &quot;&quot;
  resources:
  - configmap
  verbs:
  - update
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: cm-rolebinding
  namespace: ingress-nginx-internal
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: cm-role
subjects:
- kind: ServiceAccount
  name: ingress-nginx-internal
  namespace: ingress-nginx-internal
</code></pre>
