---
name: openshift-ts-ingress-esssmg
title: 'Ingress error: ESSSMG'
description: Troubleshoot Ingress ESSSMG (Exposed Service Set missing ServiceMonitor Group) errors.
last-updated: 2026-08-12
---

> ## Documentation Index
> The table of contents for this documentation set is at https://cloud.ibm.com/docs/openshift?format=markdown
> The index for all IBM Cloud docs is at: https://cloud.ibm.com/docs/llms.txt
> Use these files to discover more information as needed.

# Ingress error: ESSSMG
{: #ts-ingress-esssmg}
{: troubleshoot}
{: support}

[Virtual Private Cloud]{: tag-vpc} [Classic infrastructure]{: tag-classic-inf} [Satellite]{: tag-satellite}

Troubleshoot Ingress ESSSMG (Exposed Service Set missing ServiceMonitor Group) errors.
{: shortdesc}


When you check the status of your cluster's Ingress components by running the `ibmcloud oc ingress status-report get` command, you see an error similar to the following example.
{: tsSymptoms}

```sh
Could not find the secret group (ESSSMG).
```
{: screen}

Red Hat OpenShift on IBM Cloud is unable to access the secret group that was registered with the cluster to upload the default Ingress certificates.
{: tsCauses}

Review your service-to-service authorization policies and verify that communication between Red Hat OpenShift on IBM Cloud and Secrets Manager is enabled.
{: tsResolve}

1. [Follow the steps to ensure there is a service-to-service authorization policy](https://cloud.ibm.com/docs/openshift?topic=openshift-secrets-mgr&format=markdown#secrets-mgr_setup_s2s) configured to enable communication between Red Hat OpenShift on IBM Cloud and Secrets Manager.

1. If the policy exists, verify that the secret group registered with the cluster exists in the instance.
    - To view the instance registration details for your cluster run the **`ibmcloud oc ingress instance ls`** command.
    - To view and modify the secret groups available in your instance, see [Organizing your secrets](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-secret-groups&format=markdown).
    - To update the secret group for your cluster, run the **`ibmcloud oc ingress instance default set`** command and specify the `--secret-group` option.

1. If the issue persists, contact support. Open a [support case](https://cloud.ibm.com/docs/support?topic=support-using-avatar&format=markdown). In the case details, be sure to include any relevant log files, error messages, or command outputs.