From 6ce7116c4bdc9e7e02a5c93a067971334ac6b362 Mon Sep 17 00:00:00 2001 From: Vaibhav Pathak Date: Mon, 19 Jan 2026 16:20:23 +0530 Subject: [PATCH] Fix RBAC: add argo-workflow SA, pods/exec, and nodes permissions --- environment-provisioner/workflow-rbac.yaml | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/environment-provisioner/workflow-rbac.yaml b/environment-provisioner/workflow-rbac.yaml index 4f93f96..d01c029 100644 --- a/environment-provisioner/workflow-rbac.yaml +++ b/environment-provisioner/workflow-rbac.yaml @@ -42,8 +42,13 @@ rules: # Pods for verification and workflow execution - apiGroups: [""] - resources: ["pods", "pods/log"] - verbs: ["get", "list", "watch", "patch", "update"] + resources: ["pods", "pods/log", "pods/exec"] + verbs: ["get", "list", "watch", "create", "patch", "update"] + + # Nodes - for getting node IPs for IP registration + - apiGroups: [""] + resources: ["nodes"] + verbs: ["get", "list"] # ArgoCD Applications (CRDs) - apiGroups: ["argoproj.io"] @@ -69,6 +74,9 @@ subjects: - kind: ServiceAccount name: default namespace: argo-workflows + - kind: ServiceAccount + name: argo-workflow + namespace: argo-workflows - kind: ServiceAccount name: argo-workflows namespace: argo-workflows