Argo seems to try to access my imagePullSecret from the wrong namespace

[Matt-STN]

I have installed Argo Workflows today, and I've been trying to setup a job. This job would run a container using an image that is stored in a private repository, and then run some scripts in its steps.

My Argo is installed in the argo namespace, and my app runs in the myapp namespace (so that's the namespace I'd like to run my job into).
Running jobs in myapp works fine (I've followed the guide and ran all of the example jobs without issues).
When I specified my imagePullSecret, though, I have started getting the following error:

step group deemed errored due to child restorebind-zkzsr[0].restore-bind error: failed to look-up entrypoint/cmd for image "myrepo/kubeworker", you must either explicitly specify the command, or list the image's command in the index: https://argo-workflows.readthedocs.io/en/latest/workflow-executors/#emissary-emissary: secrets "myregcred" is forbidden: User "system:serviceaccount:argo:argo" cannot get resource "secrets" in API group "" in the namespace "myapp"

I have a serviceaccount in the myapp namespace, which has access to myregcred, but from what I understand here, Argo tries to access that secret, which is in the myapp namespace, from system:serviceaccount:argo:argo, which seems to be in argo namespace. I also tried setting the same secret with the same name (myregcred) in argo namespace, but the error was still the same.

Is there something I am missing ? I am quite a beginner at Kubernetes so maybe I did something wrong.

[jswxstw]

It seems that you are using cluster install mode, and cluster role argo does not have permission to access the secret myregcred.
You can try adding the following permissions to the cluster role argo:

  - apiGroups:
      - ''
    resourceNames:
      - myregcred
    resources:
      - secrets
    verbs:
      - get

[Matt-STN]

Looks like it worked ! Thanks