microk8s.enable ingress does not include permissions to update configmap in ingress namespace

The role nginx-ingress-microk8s-role in the ingress namespace must include update for configmaps.

- apiGroups:
  - ""
  resources:
  - configmaps
  verbs:
  - create
  - update

It appears that the nginx ingress controller does this as part of its leader election. create alone is insufficient.

Snap:

Name      Version  Rev    Tracking       Publisher   Notes
microk8s  v1.20.0  1866   1.20/stable    canonical✓  classic

[strainovic]

@balchua Sure, no problem. I’ll create PR till EOD.

Thanks 😃

[vdavy]

Hello,

There is also an error with nginx can’t get the default ingress class. The nginx-ingress-microk8s-clusterrole is missing the ingressclasses resource from networking.k8s.io.

To get it properly working, I had to edit the nginx-ingress-microk8s-clusterrole and add the ingressclasses in the resources part of the 4th rule. Here is my new cluster role :

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: nginx-ingress-microk8s-clusterrole
rules:
- apiGroups:
  - ""
  resources:
  - nodes
  - services
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - ""
  resources:
  - configmaps
  - endpoints
  - nodes
  - pods
  - secrets
  verbs:
  - list
  - watch
- apiGroups:
  - ""
  resources:
  - events
  verbs:
  - create
  - patch
- apiGroups:
  - extensions
  - networking.k8s.io
  resources:
  - ingresses
  - ingressclasses
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - extensions
  - networking.k8s.io
  resources:
  - ingresses/status
  verbs:
  - update

Hope this can help.