Unable to connect cluster when specified executor.serviceAccountName but autoMountServiceAccountToken: false

[maxsxu]

Pre-requisites

• I have double-checked my configuration
• I can confirm the issues exists when I tested with :latest
• I'd like to contribute the fix myself (see contributing guide)

What happened/what you expected to happen?

What happened

Occurred below errors while creating resource via container/script template

create-resources-via-container-template: error: failed to create serviceaccount: Post "http://localhost:8080/api/v1/namespaces/default/serviceaccounts?fieldManager=kubectl-create&fieldValidation=Strict": dia
l tcp 127.0.0.1:8080: connect: connection refused

what you expected to happen?

Able to create resource via container/script template successfully.

Version

latest

Paste a small workflow that reproduces the issue. We must be able to run the workflow; don't enter a workflows that uses private images.

metadata:
  name: create-resources-via-container-template
  namespace: argo
spec:
  executor:
    serviceAccountName: sa-writer
  serviceAccountName: sa-writer
  automountServiceAccountToken: false
  entrypoint: main
  templates:
    - name: main
      container:
        name: main
        image: bitnami/kubectl
        command:
          - sh
        args:
          - -c
          - |
           kubectl create sa test

Logs from the workflow controller

healthy

Logs from in your workflow's wait container

healthy

[maxsxu]

Related Discussion: #10885

[maxsxu]

I think I've figured out why: The main container didn't mount the exec-sa-token volume.

[terrytangyuan]

Would you like to submit a PR to fix it?

[maxsxu]

Would you like to submit a PR to fix it?

@terrytangyuan 👍 Please assign this issue to me.

[agilgur5]

Per #12848 (comment), this seems to have been incorrectly analyzed: an SA token shouldn't be mounted to the main container if automountServiceAccountToken: false -- you have literally instructed it not to. An error trying to reach the k8s API with no SA token would be correct behavior.