fix(server): Add list sa and create secret to argo-server roles. Closes #4526

[Boolman]

In 2.12.0-rc1 when using SSO RBAC - argo fails to create the secret, due to missing permissions in the argo-server-role
https://github.com/argoproj/argo/blob/0931baf5fbe48487278b9a6c2fa206ab02406e5b/server/auth/sso/sso.go#L135-L138

[CLAassistant]

All committers have signed the CLA.

[Boolman]

list permission is required on serviceaccounts:

https://github.com/argoproj/argo/blob/bfc13c3f5b9abe2980826dee1283433b7cb22385/server/auth/gatekeeper.go#L167-L171

[alexec]

Please run make codegen to fix build.

[alexec]

I'm not 100% sure we should add list sa and create secret to argo-server role. It is new privileges only needed for SSO + RBAC.

@jessesuen thoughts?

[alexec]

Needs back-porting to v2.12.0-rc3

[sarabala1979]

@Boolman Can you fix the codegen and DCO? We are targeting this PR for RC3 release

[Boolman]

I dont understand why the codegen fails, it reports no change in my local branch.
And the DCO says: 'Commit sha: af85335, Author: Alex Collins, Committer: GitHub; The sign-off is missing.'

[jessesuen]

I'm not 100% sure we should add list sa and create secret to argo-server role. It is new privileges only needed for SSO + RBAC.

So long as this is in the namespace of the argo-server, I don't see a problem with it

[alexec]

This looks good, but it needs either (a) run make codegen or (b) apply this patch:

diff --git a/manifests/quick-start-minimal.yaml b/manifests/quick-start-minimal.yaml
index f70741e9..5468fc25 100644
--- a/manifests/quick-start-minimal.yaml
+++ b/manifests/quick-start-minimal.yaml
@@ -612,7 +612,8 @@ spec:
         runAsNonRoot: true
       serviceAccountName: argo-server
       volumes:
-      - name: tmp
+      - emptyDir: {}
+        name: tmp
 ---
 apiVersion: apps/v1
 kind: Deployment
diff --git a/manifests/quick-start-mysql.yaml b/manifests/quick-start-mysql.yaml
index ae1b29f1..4021bb39 100644
--- a/manifests/quick-start-mysql.yaml
+++ b/manifests/quick-start-mysql.yaml
@@ -656,7 +656,8 @@ spec:
         runAsNonRoot: true
       serviceAccountName: argo-server
       volumes:
-      - name: tmp
+      - emptyDir: {}
+        name: tmp
 ---
 apiVersion: apps/v1
 kind: Deployment
diff --git a/manifests/quick-start-postgres.yaml b/manifests/quick-start-postgres.yaml
index c77ffede..12688edc 100644
--- a/manifests/quick-start-postgres.yaml
+++ b/manifests/quick-start-postgres.yaml
@@ -656,7 +656,8 @@ spec:
         runAsNonRoot: true
       serviceAccountName: argo-server
       volumes:
-      - name: tmp
+      - emptyDir: {}
+        name: tmp
 ---
 apiVersion: apps/v1
 kind: Deployment

[alexec]

Changes requested

[alexec]

LGTM