diff --git a/Dockerfile b/Dockerfile
index e0b6d1178230..9ab90c146943 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -55,7 +55,8 @@ RUN if [ $(arch.sh) = ppc64le ] || [ $(arch.sh) = s390x ]; then \
     fi && \
     tar --extract --file docker.tgz --strip-components 1 --directory /usr/local/bin/ && \
     rm docker.tgz
-RUN curl -o /usr/local/bin/kubectl https://storage.googleapis.com/kubernetes-release/release/v${KUBECTL_VERSION}/bin/$(os.sh)/$(arch.sh)/kubectl
+RUN curl -o /usr/local/bin/kubectl https://storage.googleapis.com/kubernetes-release/release/v${KUBECTL_VERSION}/bin/$(os.sh)/$(arch.sh)/kubectl && \
+    chmod +x /usr/local/bin/kubectl
 RUN rm /bin/arch.sh /bin/os.sh
 
 COPY hack/ssh_known_hosts /etc/ssh/
diff --git a/workflow/executor/resource.go b/workflow/executor/resource.go
index ce9dc0712080..056bcf78fff7 100644
--- a/workflow/executor/resource.go
+++ b/workflow/executor/resource.go
@@ -39,9 +39,12 @@ func (we *WorkflowExecutor) ExecResource(action string, manifestPath string, fla
 
 	out, err := cmd.Output()
 	if err != nil {
-		exErr := err.(*exec.ExitError)
-		errMsg := strings.TrimSpace(string(exErr.Stderr))
-		return "", "", "", errors.New(errors.CodeBadRequest, errMsg)
+		if exErr, ok := err.(*exec.ExitError); ok {
+			errMsg := strings.TrimSpace(string(exErr.Stderr))
+			return "", "", "", errors.New(errors.CodeBadRequest, errMsg)
+		} else {
+			return "", "", "", errors.New(errors.CodeBadRequest, err.Error())
+		}
 	}
 	if action == "delete" {
 		return "", "", "", nil