<p>I am new to Argo Workflows and following along with <a href="https://youtu.be/XySJb-WmL3Q?t=1247" rel="nofollow noreferrer">this tutorial</a>.</p>
<p>Following along with it, we are to create a service account and then attach the pre-existing <code>workflow-role</code> to the service account, like this:</p>
<pre class="lang-sh prettyprint-override"><code>&gt; kubectl create serviceaccount mike
serviceaccount/mike created # Response from my terminal

&gt; kubectl create rolebinding mike --serviceaccount=argo:mike --role=workflow-role
rolebinding.rbac.authorization.k8s.io/mike created # Response from my terminal
</code></pre>
<p>But then when I tried to submit a job using that service account, it said that there is no such role <code>workflow-role</code>:</p>
<pre class="lang-sh prettyprint-override"><code>Message:  Error (exit code 1): pods &quot;mike-cli-hello-svlmn&quot; is forbidden: User
&quot;system:serviceaccount:argo:mike&quot; cannot patch resource &quot;pods&quot; in API group &quot;&quot; in the namespace
&quot;argo&quot;: RBAC: role.rbac.authorization.k8s.io &quot;workflow-role&quot; not found
</code></pre>
<p>(I also do not understand why my default API group is null, but I'm assuming that is unrelated.)</p>
<p>I then checked, and indeed there is no such role:</p>
<pre class="lang-sh prettyprint-override"><code>❯ kubectl get role
NAME                       CREATED AT
agent                      2022-02-28T21:38:31Z
argo-role                  2022-02-28T21:38:31Z
argo-server-role           2022-02-28T21:38:32Z
executor                   2022-02-28T21:38:32Z
pod-manager                2022-02-28T21:38:32Z
submit-workflow-template   2022-02-28T21:38:32Z
workflow-manager           2022-02-28T21:38:32Z
</code></pre>
<p>Could it be that the role is <code>workflow-manager</code>? That sounds more like an automated service to manage the pipeline / DAG or something similar.</p>
<p>I am obviously quite new to Argo.  I have successfully launched jobs, but not when trying to use that newly created service account.</p>
<p>Should Argo have a default role of <code>workflow-role</code>?  How do I create it?</p>

Mike Williamson
<p>Actually, I think I got it, but if someone sees this, a confirmation would be nice.</p>
<p>I created a role file as follows:</p>
<pre class="lang-sh prettyprint-override"><code>role.yaml:

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: workflow
rules:
- apiGroups:
  - &quot;&quot;
  resources:
  - pods
  verbs:
  - get
  - watch
  - patch
- apiGroups:
  - &quot;&quot;
  resources:
  - pods/log
  verbs:
  - get
  - watch
</code></pre>
<p>I then created the role via the standard</p>
<pre class="lang-sh prettyprint-override"><code>kubectl apply -f role.yaml
</code></pre>
<p>Then created the role-binding same as above:</p>
<pre class="lang-sh prettyprint-override"><code>kubectl create rolebinding mike --serviceaccount=argo:mike --role=workflow
</code></pre>
<p>Then I could submit jobs with the new service account without a problem:</p>
<pre class="lang-sh prettyprint-override"><code>argo submit --serviceaccount mike --watch argo_tutorial.yaml
</code></pre>
