Hi, i'm transiting from step-functions to argo to manage our Metaflow Workflows. For step-functions, we can manipulate the METAFLOW_SFN_IAM_ROLE to not permit the creation of step-functions workflow from their local CLI. Is there something similar to not allow "argo-workflow create" to be run on user's local machine ? Is it something i have to manipulate on the METAFLOW_KUBERNETES_SERVICE_ACCOUNT itself ?

Metaflow will use whatever kubeconfig is available on your local machine to use K8S API to create Argo WorkflowTemplate resources. So if you set up those credentials so they don't have permissions to create WorkflowTemplates, that would effectively do that. METAFLOW_KUBERNETES_SERVICE_ACCOUNT is not what you want. This is the service account (kindof like a role in AWS) that will be used by the task code when it executes. It doesn't determine permissions that metaflow CLI code has when running on your machine

ic, so it's more of a RBAC role binding approach. in my context, it's an AWS EKS environment, with IAM role assigned to use resources in the K8 cluster. I would then need to attach/bind this IAM role to the proper RBAC that will then allow me to allow/disallow the creation of WorkflowTemplates ?

Yes. But first step is to somehow map your IAM principals (roles or users) to K8S users/ groups. Then you can attach permissions to those users/groups using K8S RBAC . For EKS the way it works, the IAM principal who created the cluster magically gets mapped to an invisible K8S user with admin-level access. You can configure additional mappings via aws-auth configmap in the cluster

yupe, mapping the IAM roles would be handling by some custom Terraform code we're writing. Thanks for the input. I think i roughly know how to proceed from here.