How Do I properly enable the ability to create a WF from an existing & running workflow

[ni-todo-spot]

Hey All,

New to this project & trying to use for my purposes.
One of the WFT I'm working is triggering an additional WFT as a step.
When trying to do so initially - I got a permissions error:

time="2024-07-17T13:30:50 UTC" level=info msg="Starting Workflow Executor" version=v3.5.8
time="2024-07-17T13:30:50 UTC" level=info msg="Using executor retry strategy" Duration=1s Factor=1.6 Jitter=0.5 Steps=5
time="2024-07-17T13:30:50 UTC" level=info msg="Executor initialized" deadline="2024-07-19 13:27:41 +0000 UTC" includeScriptOutput=false namespace=argo podName=analysis-runner-nkkhb-trigger-rule-engine-workflow-844489694 templateName=trigger-rule-engine-workflow version="&Version{Version:v3.5.8,BuildDate:2024-06-18T03:43:17Z,GitCommit:3bb637c0261f8c08d4346175bb8b1024719a1f11,GitTag:v3.5.8,GitTreeState:clean,GoVersion:go1.21.10,Compiler:gc,Platform:linux/amd64,}"
time="2024-07-17T13:30:50 UTC" level=info msg="Loading manifest to /tmp/manifest.yaml"
time="2024-07-17T13:30:50 UTC" level=info msg="kubectl create -f /tmp/manifest.yaml -o json"
Error from server (Forbidden): error when creating "/tmp/manifest.yaml": workflows.argoproj.io is forbidden: User "system:serviceaccount:argo:argo-workflow" cannot create resource "workflows" in API group "argoproj.io" in the namespace "argo"
{"argo":true,"error":null,"level":"info","msg":"sub-process exited","time":"2024-07-17T13:30:51.714Z"}
Error: exit status 1

So, I tried playing with the deployment a little manually and found that when I edit this Role

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: argo-workflows-workflow
  namespace: argo
rules:
  - verbs:
      - get
      - watch
      - patch
    apiGroups:
      - ''
    resources:
      - pods
  - verbs:
      - get
      - watch
    apiGroups:
      - ''
    resources:
      - pods/log

To be this:

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: argo-workflows-workflow
  namespace: argo
rules:
  - verbs:
      - get
      - watch
      - patch
    apiGroups:
      - ''
    resources:
      - pods
  - verbs:
      - get
      - watch
    apiGroups:
      - ''
    resources:
      - pods/log
  - verbs:
      - create
      - get
    apiGroups:
      - argoproj.io
    resources:
      - workflows

I managed to trigger.

Clearly this is not the helm way of doing so - but I was wondering what is the right way to do it?

Thanks in advance!

[yu-croco]

Hi @ni-todo-spot

So, I tried playing with the deployment a little manually and found that when I edit this Role

To be this:

I cannot recognize the differences between the 2 manifests at all...

[ni-todo-spot]

@yu-croco my apologies! I edited the relevant manifest

[yu-croco]

@ni-todo-spot

I edited the relevant manifest

Thank you.

Clearly this is not the helm way of doing so - but I was wondering what is the right way to do it?

I am not so sure what helm way means to you, but it depends on the use cease of workflow which permission workflow sa needs. So I wonder you can make on-demand workflow's sa/role for the workflow outside of argo-helm and assign it to the workflow.
e.g.) https://github.com/argoproj/argo-helm/tree/main/charts/argo-workflows#serviceaccount-for-workflow-spec

[ni-todo-spot]

interesting option - will check it out.
Can We open a feature request for additional rules on the service account being created in the helm install command?

[yu-croco]

Can We open a feature request for additional rules on the service account being created in the helm install command?

I think it makes sense to add additional optional rules to the workflow sa.

[yu-croco]

FYI; as a workaround, you can use extraObjects to deploy additional resources with argo-helm.

[ni-todo-spot]

@yu-croco COOL
So Theoretically I can redefine (override) the mentioned above SA with additional rules - I like that
THANKS!

[yu-croco]

So Theoretically I can redefine (override) the mentioned above SA with additional rules

Yes, instead of creating rbac for workflow sa in workflow.rbac.create , you can define in extraObjects.
*maybe you can also define sa/rolebinding in extraObjects instead of workflow. serviceAccount .create to align relation between sa/role/rolebinding