title: Installing ingress-nginx via Helm - error retrieving secret
body: <p>We're trying to install the <code>ingress-nginx</code> controller onto an Azure Kubernetes Service (AKS) cluster, following the steps from the <a href="https://docs.microsoft.com/en-us/azure/aks/ingress-internal-ip#create-an-ingress-controller" rel="nofollow noreferrer">Azure documentation</a>.</p>
  <p>Kubernetes version: 1.21.1
  Chart version: 3.36.</p>
  <p>The command we're using:</p>
  <pre><code>SET REGISTRY_NAME=
  SET ACR_URL=%REGISTRY_NAME%.azurecr.io
  SET CONTROLLER_REGISTRY=k8s.gcr.io
  SET CONTROLLER_IMAGE=ingress-nginx/controller
  SET CONTROLLER_TAG=v0.48.1
  SET PATCH_REGISTRY=docker.io
  SET PATCH_IMAGE=jettech/kube-webhook-certgen
  SET PATCH_TAG=v1.5.1
  SET DEFAULTBACKEND_REGISTRY=k8s.gcr.io
  SET DEFAULTBACKEND_IMAGE=defaultbackend-amd64
  SET DEFAULTBACKEND_TAG=1.5
  
  SET NAMESPACE=ingress-basic
  
  kubectl create namespace %NAMESPACE%
  kubectl apply -n %NAMESPACE% -f .\limitRanges.yaml
  
  helm install nginx-ingress ingress-nginx/ingress-nginx ^
      --namespace %NAMESPACE% ^
      --version 3.36.0 ^
      --set controller.replicaCount=2 ^
      --set controller.nodeSelector.&quot;kubernetes\.io/os&quot;=linux ^
      --set controller.image.registry=%ACR_URL% ^
      --set controller.image.image=%CONTROLLER_IMAGE% ^
      --set controller.image.tag=%CONTROLLER_TAG% ^
      --set controller.image.digest=&quot;&quot; ^
      --set controller.admissionWebhooks.patch.nodeSelector.&quot;kubernetes\.io/os&quot;=linux ^
      --set controller.admissionWebhooks.patch.image.registry=%ACR_URL% ^
      --set controller.admissionWebhooks.patch.image.image=%PATCH_IMAGE% ^
      --set controller.admissionWebhooks.patch.image.tag=%PATCH_TAG% ^
      --set controller.admissionWebhooks.patch.image.digest=&quot;&quot; ^
      --set defaultBackend.nodeSelector.&quot;kubernetes\.io/os&quot;=linux ^
      --set defaultBackend.image.registry=%ACR_URL% ^
      --set defaultBackend.image.image=%DEFAULTBACKEND_IMAGE% ^
      --set defaultBackend.image.tag=%DEFAULTBACKEND_TAG% ^
      --set defaultBackend.image.digest=&quot;&quot; ^
      -f internal-load-balancer.yaml ^
      --debug 
  </code></pre>
  <p>When running, the output is:</p>
  <pre><code>install.go:173: [debug] Original chart version: &quot;3.36.0&quot;
  install.go:190: [debug] CHART PATH: C:\Users\......\AppData\Local\Temp\helm\repository\ingress-nginx-3.36.0.tgz
  
  client.go:290: [debug] Starting delete for &quot;nginx-ingress-ingress-nginx-admission&quot; ServiceAccount
  client.go:319: [debug] serviceaccounts &quot;nginx-ingress-ingress-nginx-admission&quot; not found
  client.go:128: [debug] creating 1 resource(s)
  client.go:290: [debug] Starting delete for &quot;nginx-ingress-ingress-nginx-admission&quot; ClusterRole
  client.go:128: [debug] creating 1 resource(s)
  client.go:290: [debug] Starting delete for &quot;nginx-ingress-ingress-nginx-admission&quot; ClusterRoleBinding
  client.go:128: [debug] creating 1 resource(s)
  client.go:290: [debug] Starting delete for &quot;nginx-ingress-ingress-nginx-admission&quot; Role
  client.go:319: [debug] roles.rbac.authorization.k8s.io &quot;nginx-ingress-ingress-nginx-admission&quot; not found
  client.go:128: [debug] creating 1 resource(s)
  client.go:290: [debug] Starting delete for &quot;nginx-ingress-ingress-nginx-admission&quot; RoleBinding
  client.go:319: [debug] rolebindings.rbac.authorization.k8s.io &quot;nginx-ingress-ingress-nginx-admission&quot; not found
  client.go:128: [debug] creating 1 resource(s)
  client.go:290: [debug] Starting delete for &quot;nginx-ingress-ingress-nginx-admission-create&quot; Job
  client.go:319: [debug] jobs.batch &quot;nginx-ingress-ingress-nginx-admission-create&quot; not found
  client.go:128: [debug] creating 1 resource(s)
  client.go:519: [debug] Watching for changes to Job nginx-ingress-ingress-nginx-admission-create with timeout of 5m0s
  client.go:547: [debug] Add/Modify event for nginx-ingress-ingress-nginx-admission-create: ADDED
  client.go:586: [debug] nginx-ingress-ingress-nginx-admission-create: Jobs active: 0, jobs failed: 0, jobs succeeded: 0
  client.go:547: [debug] Add/Modify event for nginx-ingress-ingress-nginx-admission-create: MODIFIED
  client.go:586: [debug] nginx-ingress-ingress-nginx-admission-create: Jobs active: 1, jobs failed: 0, jobs succeeded: 0
  </code></pre>
  <p>If I look at the pod logs for the job <code>nginx-ingress-ingress-nginx-admission-create</code>, I see the following log:</p>
  <pre><code>W0909 06:34:24.393154       1 client_config.go:608] Neither --kubeconfig nor --master was specified.  Using the inClusterConfig.  This might not work.
  {&quot;err&quot;:&quot;an error on the server (\&quot;\&quot;) has prevented the request from succeeding (get secrets nginx-ingress-ingress-nginx-admission)&quot;,&quot;level&quot;:&quot;fatal&quot;,&quot;msg&quot;:&quot;error getting secret&quot;,&quot;source&quot;:&quot;k8s/k8s.go:109&quot;,&quot;time&quot;:&quot;2021-09-09T06:34:34Z&quot;}
  </code></pre>
  <p>I'm a little lost on where to look for additional information. I can see the error seems to be relating to getting a secret, and I can't see that secret under a <code>kubectl get secrets -A</code> command. I'm assuming the <code>\&quot;\&quot;</code> portion is supposed to be the error message, but it's not helping.</p>
  <p>I have been able to install this chart successfully on a brand new, throwaway cluster. My guess is that it's an RBAC or permissions type problem, but without anything further about where to look, I'm out of ideas.</p>