Possible Bug in workflow cluster role missing permissions

[menzbua]

Describe the bug

Hi,

I have a problem with Argo workflows HTTP Template. When I run a workflow with using this template, the workflow lasts for 30 seconds or many minutes until it is finished. I researched the behavior and found an error message in the workflow-controller pod:

time="2024-07-11T11:35:07.711Z" level=warning msg="error updating taskset" error="failed patching taskset: workflowtasksets.argoproj.io \"http-template-5bskv\" is forbidden: User \"system:serviceaccount:argocd:argo-workflows-workflow-controller\" cannot patch resource \"workflowtasksets/status\" in API group \"argoproj.io\" in the namespace \"argocd\"" namespace=argocd workflow=http-template-5bskv

I've installed Argo workflows with the latest Helm-Chart. When I take a look into the file "charts/argo-workflows/templates/controller/workflow-controller-cluster-roles.yaml" I see that the permissions to patch the workflowtasksets is missing. In the namespaced role file "charts/argo-workflows/templates/controller/workflow-role.yaml" the permission is given

argo-helm/charts/argo-workflows/templates/controller/workflow-role.yaml

Lines 50 to 56 in 2653aef

	- apiGroups:
	- argoproj.io
	resources:
	- workflowtasksets/status
	- workflowartifactgctasks/status
	verbs:
	- patch

I've added the permission manually to the ClusteRole in my cluster, and all HTTP template workflows are now running without errors.

I think that the following permissions should be granted in the ClusterRole too:

- apiGroups:
  - argoproj.io
  resources:
    - workflowtasksets/status
    - workflowartifactgctasks/status
  verbs:
    - patch                  

I can resolve this issue for myself and send you a pull-request.

Related helm chart

argo-workflows

Helm chart version

0.41.11

To Reproduce

1. Add Workflow with HTTP Template
2. Check the logs of the workflow-controller POD
3. Check the time until the Workflow is finished. It should be a very long period of time if the job is carried out several times.

Expected behavior

The Workflow with HTTP Template JOB should finish in a few seconds without error messages in the workflow-controller logs.

Screenshots

No response

Additional context

No response