ECR access for Argo workflows executor

Argo Workflows has an interesting option to fetch a container's entrypoint from the image definition so one does not need to specify command, but only args. In our case this would be pretty helpful, since our externally delivered containers do differ in how to execute them and we'd like to avoid hard-coding this in the workflow template.

However, it seems that Argo does fetch the image details via go-containerregistry and this does not work without specifying an imagePullSecret. Here are the references in the code:

https://github.com/argoproj/argo-workflows/blob/main/workflow/controller/entrypoint/container_registry_index.go#L17

https://github.com/google/go-containerregistry/blob/main/pkg/authn/kubernetes/keychain.go#L72

Now adding an imagePullSecret would work, we tested it. But since both the node's IAM role as well as the service account's role that's executing the pod have AmazonEC2ContainerRegistryReadOnly policy assigned, we'd ideally like to not add this secret at all.

So we have the following two questions:

1. Is it somehow possible to do the ECR image lookup from Argo without an imagePullSecret? (see discussion at https://github.com/argoproj/argo-workflows/issues/9802 without resolution so far)
2. If the secret is not avoidable, is there an easy way to maintain it? The only thing we could think of is basically a periodic job updating the secret and this has some risk associated with it (see options like https://skryvets.com/blog/2021/03/15/kubernetes-pull-image-from-private-ecr-registry/ or https://github.com/pfnet/image-pull-secrets-provisioner)

Thanks!