What security/permissions are necessary to run and view Argo Workflows?

[wdma]

More information can be found about my system (yaml etc) can be found here (https://stackoverflow.com/questions/69094527/why-doesnt-this-argo-workflow-run), but in short, I am seeing the same error as described here (#6643).

bin/bash: /argo/staging/script: Permission denied

I have applied the following permissions to my user (ClusterRole), but in the absence of a comprehensive list of permissions, it is difficult to guess what Argo needs. Can you tell me which permission I need to add or can you point me to a list of possible permissions?

kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: argouser
rules:
  # pod get/watch is used to identify the container IDs of the current pod
  - apiGroups:
      - ""
    resources:
      - pods
      - volumes
      - persistentvolumes
    verbs:
      - get
      - create
      - watch
      - patch
  - apiGroups:
      - ""
    resources:
      - pods/log
    verbs:
      - get
      - watch
  - apiGroups:
      - ""
    resources:
      - pods/exec
    verbs:
      - create
  - apiGroups: ["argoproj.io"] 
    resources:
      - workflows
    verbs:
      - get
      - create
      - list
  - apiGroups: ["workflows.argoproj.io"] 
    resources:
      - workflows
    verbs:
      - get
      - list
      - create

[wdma]

For anyone who runs into the same issue, this is not a permissions problem. Rather, I was using the wrong command to run the container.

it looks like /argo/staging/script is a script that is applied to the end of the data in the "args" field

I am trying to trace the origin of that now.