Argo Workflow权限问题：system:serviceaccount:default:default无Pod Patch权限

错误信息：

Error (exit code 1): pods "argo-cron-test-1720194660-run-script-2326994143" is forbidden: User "system:serviceaccount:default:default" cannot patch resource "pods" in API group "" in the namespace "default"

已排查的配置：

kubectl get rolebindings -n argo

NAME                       ROLE                            AGE
argo-binding               Role/argo-role                  12d
agent-default              Role/agent                      12d
artifactgc-default         Role/artifactgc                 12d
executor-default           Role/executor                   12d
github.com                 Role/submit-workflow-template   12d
pod-manager-default        Role/pod-manager                12d
workflow-manager-default   Role/workflow-manager           12d

kubectl get serviceaccounts -n argo
NAME          SECRETS   AGE
default       0         12d
argo          0         12d
argo-server   0         12d
github.com    0         12d

kubectl describe rolebinding agent-default -n argo
Name:         agent-default
Labels:       <none>
Annotations:  <none>
Role:
  Kind:  Role
  Name:  agent
Subjects:
  Kind            Name     Namespace
  ----            ----     ---------
  ServiceAccount  default

kubectl describe rolebinding executor-default -n argo
Name:         executor-default
Labels:       <none>
Annotations:  <none>
Role:
  Kind:  Role
  Name:  executor
Subjects:
  Kind            Name     Namespace
  ----            ----     ---------
  ServiceAccount  default

kubectl describe role executor -n argo
Name:         executor
Labels:       <none>
Annotations:  workflows.argoproj.io/description: Recomended minimum permissions for the `emissary` executor.
PolicyRule:
  Resources                        Non-Resource URLs  Resource Names  Verbs
  ---------                        -----------------  --------------  -----
  workflowtaskresults.argoproj.io  []                 []              [create patch]

问题原因 #

你当前排查的是argo命名空间下的角色与角色绑定，但错误提示的是default:default服务账户在default命名空间没有pod的patch权限。Kubernetes的Role是命名空间级别的资源，argo命名空间下的角色绑定仅对该命名空间内的资源生效，无法作用于default命名空间的pod。

另外，你查看的executor角色仅授权了workflowtaskresults.argoproj.io资源的create和patch权限，根本没有包含pod资源的操作权限，这也是核心问题之一。

解决办法 #

1. 检查default命名空间的权限配置
   执行以下命令查看default命名空间下default服务账户的角色绑定情况：

   kubectl get rolebindings -n default
   kubectl describe rolebindings -n default | grep -A5 -B5 "default"
   

2. 为default命名空间的default服务账户添加pod权限
   创建一个包含pod patch权限的Role：

   apiVersion: rbac.authorization.k8s.io/v1
   kind: Role
   metadata:
     name: pod-patcher
     namespace: default
   rules:
   - apiGroups: [""]
     resources: ["pods"]
     verbs: ["patch"]
   

   然后绑定到default服务账户：

   apiVersion: rbac.authorization.k8s.io/v1
   kind: RoleBinding
   metadata:
     name: default-pod-patcher
     namespace: default
   subjects:
   - kind: ServiceAccount
     name: default
     namespace: default
   roleRef:
     kind: Role
     name: pod-patcher
     apiGroup: rbac.authorization.k8s.io
   

3. 确认Argo Workflow的服务账户配置
   检查你的CronWorkflow定义，是否指定了使用argo命名空间下的服务账户（比如argo服务账户），而不是默认的default命名空间的default账户。在Workflow/CronWorkflow的spec中添加：

   spec:
     serviceAccountName: argo
     # 其他配置...
   

内容的提问来源于stack exchange，提问作者Allan Xu