User "system:serviceaccount:argo-workflows:default" cannot list resource "workflowartifactgctasks" in API group "argoproj.io" in the namespace "argo-workflows"

[himgov]

Hello,

In my workflow runs, I want to automatically clean up artifacts after a job completes. However, it seems that the default service account needs to have the workflowartifactgctasks role assigned to perform this action.

I’ve noticed that the controller-sa service account already has permissions to delete these artifacts, and the custom default service account I created for our use also includes this role.
So, why does the workflow still use the default service account for artifact cleanup?

Am I missing a configuration setting?

Below is example code.

spec:
  templates:
    - name: argosay
      inputs:
        parameters:
          - name: message
            value: "{{workflow.parameters.message}}"
      outputs:
        artifacts:
          - name:artifact-file
            path: /tmp/repos.json
            archive:
              none: {}
      metadata: {}
      script:
        name: ""
        image: anybashImage/bash:5.2
        command:
          - bash
        resources: {}
        source: |
          echo -n "Test something" > /tmp/repos.json
  entrypoint: argosay
  arguments:
    parameters:
      - name: message
        value: hello argo
  ttlStrategy:
    secondsAfterCompletion: 300
  podGC:
    strategy: OnPodCompletion
  workflowMetadata:
    labels:
      example: "true"
  artifactGC:
    strategy: OnWorkflowCompletion
    forceFinalizerRemoval: true

Error: workflowartifactgctasks.argoproj.io is forbidden: User "system:serviceaccount:argo-workflows:default" cannot list resource "workflowartifactgctasks" in API group "argoproj.io" in the namespace "argo-workflows"

[himgov]

Found the issue.

The artifact GC pod runs under its own separate service account, independent of spec.serviceAccountName (the workflow's service account). The GC pod's service account is only set if you explicitly configure spec.artifactGC.serviceAccountName.