Fix RBAC: add argo-workflow SA, pods/exec, and nodes permissions

environment-provisioner/workflow-rbac.yaml

@@ -42,8 +42,13 @@ rules:
 
   # Pods for verification and workflow execution
   - apiGroups: [""]
-    resources: ["pods", "pods/log"]
-    verbs: ["get", "list", "watch", "patch", "update"]
+    resources: ["pods", "pods/log", "pods/exec"]
+    verbs: ["get", "list", "watch", "create", "patch", "update"]
+
+  # Nodes - for getting node IPs for IP registration
+  - apiGroups: [""]
+    resources: ["nodes"]
+    verbs: ["get", "list"]
 
   # ArgoCD Applications (CRDs)
   - apiGroups: ["argoproj.io"]
@@ -69,6 +74,9 @@ subjects:
   - kind: ServiceAccount
     name: default
     namespace: argo-workflows
+  - kind: ServiceAccount
+    name: argo-workflow
+    namespace: argo-workflows
   - kind: ServiceAccount
     name: argo-workflows
     namespace: argo-workflows