fix(controller): podSpecPatch updates override the ref template in Secure mode

[chengjoey]

Fixes #13871

Motivation

podSpecPatch seems not to be set when referencing wf template and in Secure mode

Modifications

Verification

wf:

apiVersion: argoproj.io/v1alpha1
kind: Workflow
metadata:
  name: workflow-template-hello-world
spec:
  workflowTemplateRef:
    name: workflow-template-print-message
  podSpecPatch: |
    containers:
      - name: main
        image: alpine
        command: [echo]
        args: ["hello world"]

kubectl get wf

NAME                            STATUS   AGE   MESSAGE
workflow-template-hello-world   Error    6s    PodSpecPatch may not be setted during execution when the controller is set `templateReferencing: Secure`

[michaelncy]

This also applies to Strict mode right? MustUseReference is more suitable perhaps

[shuangkun]

I think templateReferencing: Secure has prohibited changes, maybe podSpecPatch can also exist in strict mode.

[chengjoey]

The definition of workflowRestrictions is here, I'm not very sure, but it seems that podSpecPatch can exist in strict mode.

argo-workflows/docs/workflow-controller-configmap.yaml

Lines 387 to 395 in b93ffd8

	# workflowRestrictions restricts the Workflows that the controller will process.
	# Current options:
	# Strict: Only Workflows using "workflowTemplateRef" will be processed. This allows the administrator of the controller
	# to set a "library" of templates that may be run by its operator, limiting arbitrary Workflow execution.
	# Secure: Only Workflows using "workflowTemplateRef" will be processed and the controller will enforce
	# that the WorkflowTemplate that is referenced hasn't changed between operations. If you want to make sure the operator of the
	# Workflow cannot run an arbitrary Workflow, use this option.
	workflowRestrictions: |
	templateReferencing: Strict

[sstarcher]

I would consider it a security concern if you allow podSpecPatch when Secure is set to Strict mode. Our use-case is we want to allow people to create workflows, but only from things that exist from workflow templates without any changes.

[MasonM]

@chengjoey The E2E test failures were due to a bug in Kit, which was just fixed. If you merge your changes with main, they should pass now.