<p>I followed exactly like <a href="https://akomljen.com/kubernetes-nginx-ingress-controller/" rel="nofollow noreferrer">this_tutorial</a> to deploy nginx ingress contoller. The yaml files used for deploying the ingress controller and describe output are copied to <a href="https://github.com/get2arun/nginx-ingress" rel="nofollow noreferrer">repo</a>.</p>

<p>After creating the ingress-controller, pod is running but seeing the below error in the ingress-controller log. The error says serviceaccount "nginx" have no permission to create resource "configmaps" in namespace "ingress".</p>

<p>Question I have,</p>

<ul>
<li>what verbs are required in the ClusterRole to allow service account
"nginx" to create configmaps in my namespace? </li>
<li>Why serviceaccount "nginx" has to create configmaps in the
namespace? Because,the ingress controller already has configmap in the namespace then why is the ingress controller tries to create again?</li>
</ul>

<blockquote>
  <p>E1115 15:05:49.678247       7 leaderelection.go:228] error initially
  creating leader election record: configmaps is forbidden: User
  "system:serviceaccount:ingress:nginx" cannot create resource
  "configmaps" in API group "" in the namespace "ingress"</p>
  
  <p>(truncated)</p>
  
  <p>I1115 15:05:49.742498       7 controller.go:220] ingress backend
  successfully reloaded... E1115 15:06:03.379102       7
  leaderelection.go:228] error initially creating leader election
  record: configmaps is forbidden: User
  "system:serviceaccount:ingress:nginx" cannot create resource
  "configmaps" in API group "" in the namespace "ingress"</p>
</blockquote>

<p>detailed kubectl log  can be accessed from <a href="https://github.com/get2arun/nginx-ingress/blob/master/nginx-deployment-describe-pod.log" rel="nofollow noreferrer">this_file</a>.</p>

<p>[EDIT]</p>

<pre><code>root@desktop:~/github/# kubectl get -n ingress all
NAME                                            READY   STATUS    RESTARTS   AGE
pod/default-backend-7fcd7954d6-gdmvt            1/1     Running   0          3d14h
pod/default-backend-7fcd7954d6-hf65b            1/1     Running   0          3d14h
pod/nginx-ingress-controller-65bfcb57ff-9nz88   1/1     Running   0          2d22h


NAME                      TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)   AGE
service/default-backend   ClusterIP   10.100.x.y   &lt;none&gt;        80/TCP    3d14h


NAME                                       DESIRED   CURRENT   UP-TO-DATE   AVAILABLE   AGE
deployment.apps/default-backend            2         2         2            2           3d14h
deployment.apps/nginx-ingress-controller   1         1         1            1           2d22h

NAME                                                  DESIRED   CURRENT   READY   AGE
replicaset.apps/default-backend-7fcd7954d6            2         2         2       3d14h
replicaset.apps/nginx-ingress-controller-65bfcb57ff   1         1         1       2d22h

root@desktop:~/github# kubectl get -n ingress configmap
NAME                            DATA   AGE
nginx-ingress-controller-conf   1      3d14h
</code></pre>

<p>It looks like the <code>nginx</code> service account isn't granted permission to create configmap resources in the namespace.</p>

<ol>
<li><p>Take a look at this <a href="https://github.com/kubernetes/ingress-nginx/blob/master/deploy/cloud-generic/role.yaml" rel="nofollow noreferrer">role definition</a> and the <a href="https://github.com/kubernetes/ingress-nginx/blob/master/deploy/cloud-generic/role-binding.yaml" rel="nofollow noreferrer">role binding</a> files. Apply them after making any necessary adjustments, like for the service account name (from <code>nginx-ingress-serviceaccount</code> to <code>nginx</code>).</p></li>
<li><p>The <a href="https://github.com/get2arun/nginx-ingress/blob/master/nginx-ingress-controller-deployment.yaml#L34" rel="nofollow noreferrer">Deployment</a> configuration has this argument: <code>--configmap=\$(POD_NAMESPACE)/nginx-ingress-controller-conf</code>. According to the nginx ingress controller <a href="https://github.com/kubernetes/ingress-nginx/blob/f2d3454520a6fbbda6a48c357da6beae59a8fbf6/docs/user-guide/cli-arguments.md" rel="nofollow noreferrer">documentation</a>, that is the "...Name of the ConfigMap containing custom global configurations for the controller".</p></li>
</ol>
