Add ability to create multiple workflow ServiceAccount resources per namespace

[jdaftari-confluent]

Is your feature request related to a problem?

Currently, we have the ability to create a single workflow ServiceAccount which can be installed in multiple namespaces. This workflow has the same name, annotations, etc. The following is a minimal config for achieving this

workflow:
  serviceAccount:
    create: true
    name: "argo-workflow"
  rbac:
    create: true
controller:
  workflowNamespaces:
    - default
    - foo
    - bar

However, we don't have the ability to create multiple ServiceAccount resources within a single namespace or multiple namespaces. Using a separate ServiceAccount (with separate annotations) gives ability to provide granular permissions.

Related helm chart

argo-workflows

Describe the solution you'd like

An example config may look like this

workflow:
  serviceAccounts:
    - name: "argo-workflow-read"
      rbac:
        create: true
      namespaces: ["foo", "bar"]
      annotations:
        "eks.amazonaws.com/role-arn": "arn:aws:iam::123456789012:role/argo-workflow-read"
    - name: "argo-workflow-update"
      rbac:
        create: true
      namespaces: ["bar"]
      annotations:
        "eks.amazonaws.com/role-arn": "arn:aws:iam::123456789012:role/argo-workflow-update"

This would mean that we deprecate workflow.serviceAccount, workflow.rbac and controller.workflowNamespaces config parameters.

Describe alternatives you've considered

No response

Additional context

No response

[github-actions]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.