<p>I installed the default helm chart of Argo Workflow with only configuring init.serviceAccount as argo-sa, which I have created. (ServiceAccount with enough authorization)
However, running every Workflow runs as serviceaccount Default, which I can’t figure out where the setting is configured.
According to the README provided by Argo Helm Chart, specifying <code>init.serviceAccount</code> as the serviceaccount which I have created should solved the problem.
The workaround is to modify the Default serviceaccount, but it seems that it's not a great solution.
Is there anything that I understood incorrectly ? Thanks in advance.</p>

<p>The Argo installation does not control which ServiceAccount Workflows use. According to the <a href="https://github.com/argoproj/argo/blob/3507c3e6e8e9c420a6028a43b930a3ef6b221705/docs/service-accounts.md" rel="noreferrer">Argo docs</a>,</p>
<blockquote>
<p>When no ServiceAccount is provided [when the Workflow is submitted], Argo will use the default
ServiceAccount from the namespace from which it is run, which will
almost always have insufficient privileges by default.</p>
</blockquote>
<p>If you are using the <a href="https://argoproj.github.io/argo/cli/argo_submit/" rel="noreferrer">Argo CLI to submit Workflows</a>, you can specify the ServiceAccount with <code>--serviceaccount</code>.</p>
<p>If you are using <code>kubectl apply</code> or some other tool to install Workflows, you can <a href="https://github.com/argoproj/argo/blob/7abead2a564876a695201cf7539bd20d1fc67888/docs/workflow-rbac.md" rel="noreferrer">set the ServiceAccount name in the yaml definition</a>. See an <a href="https://github.com/argoproj/argo/blob/da43086a19f88c0b7ac71fdb888f913fd619962b/examples/cron-backfill.yaml#L52" rel="noreferrer">example from the documentation</a>, or this abbreviated example:</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: argoproj.io/v1alpha1
kind: Workflow
spec:
  serviceAccountName: some-serviceaccount
</code></pre>
<p>As a convenience, the Argo Helm chart <a href="https://github.com/argoproj/argo-helm/blob/master/charts/argo/values.yaml#L28-L33" rel="noreferrer">provides a way to create a ServiceAccount</a> with which to run your Workflows. But it does not actually <em>cause</em> your Workflows to use that ServiceAccount. You have to specify it when you submit the Workflow.</p>
<pre class="lang-yaml prettyprint-override"><code>  serviceAccount:
    create: false  # Specifies whether a service account should be created
    annotations: {}
    name: &quot;argo-workflow&quot;  # Service account which is used to run workflows
  rbac:
    create: false  # adds Role and RoleBinding for the above specified service account to be able to run workflows
</code></pre>
