fix(argo-workflows): Remove excessive wf controller RBAC permissions

tico24 commented 4 days ago

The deleted privileges were used by the k8sapi Executor in older Argo Workflows versions <=3.3 when selected. In versions >=3.4, only the Emissary Executor is available, and it does not use any forms of elevated privileges. See also a summary of the Executors in an older version of the docs: https://argo-workflows.readthedocs.io/en/release-3.4/workflow-executors/.

Checklist:

[x] I have bumped the chart version according to versioning
[x] I have updated the documentation according to documentation
[x] I have updated the chart changelog with all the changes that come with this pull request according to changelog.
[x] Any new values are backwards compatible and/or have sensible default.
[x] I have signed off all my commits as required by DCO.
[x] My build is green (troubleshooting builds).

vladlosev commented 4 days ago

So which version of Argo Workflows do we support? This change will break any versions < 3.4, as they need the pod permissions.

tico24 commented 4 days ago

We have only ever supported the latest of each product. So workflows 3.6.0

agilgur5 commented 2 days ago

For reference, this resolves the now public https://github.com/argoproj/argo-helm/security/advisories/GHSA-fgrf-2886-4q7m (and the description seems to heavily copy from there as well) aka CVE-2024-52799

argoproj / argo-helm