Quickstart is not easy for the noobs

[philippeflorent]

Hi,

following an argocd training, I am trying to test the argo workflows

https://argo-workflows.readthedocs.io/en/latest/quick-start/

the hello world example

argo submit -n argo --watch https://raw.githubusercontent.com/argoproj/argo-workflows/main/examples/hello-world.yaml

gave me this:

Name:                hello-world-95xh6
Namespace:           argo
ServiceAccount:      unset (will run with the default ServiceAccount)
Status:              Error
Message:             Error (exit code 64): workflowtaskresults.argoproj.io is forbidden: User "system:serviceaccount:argo:default" cannot create resource "workflowtaskresults" in API group "argoproj.io" in the namespace "argo"
Conditions:
 PodRunning          False
 Completed           True
Created:             Wed Jun 04 13:36:10 +0200 (10 seconds ago)
Started:             Wed Jun 04 13:36:10 +0200 (10 seconds ago)
Finished:            Wed Jun 04 13:36:20 +0200 (now)
Duration:            10 seconds
Progress:            0/1
ResourcesDuration:   0s*(1 cpu),4s*(100Mi memory)

STEP                  TEMPLATE     PODNAME            DURATION  MESSAGE
 ⚠ hello-world-95xh6  hello-world  hello-world-95xh6  4s        Error (exit code 64): workflowtaskresults.argoproj.io is forbidden: User "system:serviceaccount:argo:default" cannot create resource "workflowtaskresults" in API group "argoproj.io" in the namespace "argo"

my setup

kubectl create namespace argo
kubectl apply -n argo -f https://github.com/argoproj/argo-workflows/releases/latest/download/install.yaml
kubectl patch deployment argo-server --namespace argo --type='json' -p='[{"op": "replace", "path": "/spec/template/spec/containers/0/args", "value": ["server","--auth-mode=server"]}]'

The client I use is from https://github.com/argoproj/argo-workflows/releases/

argo: v3.6.7
  BuildDate: 2025-04-29T19:37:16Z
  GitCommit: 8d7dae690e152d19fb40f7affbb68fb783b32172
  GitTreeState: clean
  GitTag: v3.6.7
  GoVersion: go1.24.2
  Compiler: gc
  Platform: windows/amd64

I created a token for the auth (tested in ui and cli)

kubectl -n argo create token argo-server

why is the default conf missing a service account (if it is the issue at all)

thanks for your help

[philippeflorent]

thanks to chatgpt I found out I had to apply this manifest

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: argo-workflowtaskresults-role
  namespace: argo
rules:
  - apiGroups: ["argoproj.io"]
    resources: ["workflowtaskresults"]
    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: argo-workflowtaskresults-binding
  namespace: argo
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: argo-workflowtaskresults-role
subjects:
  - kind: ServiceAccount
    name: argo
    namespace: argo

and use the related sa

argo submit -n argo --watch https://raw.githubusercontent.com/argoproj/argo-workflows/main/examples/hello-world.yaml --serviceaccount argo

[oatnog]

Agreed, this is a problem with the Quickstart. It needs to either solve the issue, work around it with a reference to production recommendations, or just acknowledge it and tell users not to be concerned.

for example, one can work around it by giving the default Service Account admin, like it says here: https://argo-workflows.readthedocs.io/en/latest/service-accounts/#granting-admin-privileges

Which should then lead users who need finer-grained control (say, if they are sharing argo workflows with multiple teams) to a solution like your ChatGPT-inspired individual SA and namespace role