v3.3 Cherry-picking

[sarabala1979]

• 6b08636 fix: Mutex is not initialized when controller restart (fix: Mutex is not initialized when controller restart #9873)
• ec51629 fix: P/R/C reporting in argo list -o wide. Fixes Does P/R/C reporting on argo list -o wide still work? #9281 (fix: P/R/C reporting in argo list -o wide. Fixes #9281 #9874)
• 6c432d2 fix: upgrade python openapiclient version, fixes Printing response of Python SDK list_workflows methods returns an error #9770 (fix: upgrade python openapiclient version, fixes #9770 #9840)
• 36646ef fix: Support Kubernetes v1.24. Fixes Kubernetes 1.24: Token-handling code assumes auto-created service account token secrets #8320 (fix: Support Kubernetes v1.24. Fixes #8320 #9620)
• a752a58 fix: exit code always be '0' in windows container. Fixes [bug] The command exit code always be '0' in windows container  #9797 (fix: exit code always be '0' in windows container. Fixes #9797 #9807)
• 102c3ec fix: migrated from distribution@v2.8.0 to distribution@v2.8.1. Fixes Package distribution is broken on v2.8.0 due to an incorrect sub-dependecy checksum. Migrate to v2.8.1 #9850 (fix: migrated from distribution@v2.8.0 to distribution@v2.8.1. Fixes #9850 #9851)
• d4a9074 fix: trigger startup.sh at devcontainer startup instead of create (fix: trigger startup.sh at devcontainer startup instead of create #9831)
• f6a8b01 fix: SDK CI workflow (fix: SDK CI workflow #9609)
• faa0294 fix: fixed url encoded link template (fix: fixed url encoded link template #9792)
• d4817ef fix: fix iam permissions to retrieve logs from aws s3 (fix: fix iam permissions to retrieve logs from aws s3 #9798)
• aa59b43 fix: enable when expressions to use expr; add new json variables to avoid expr conflicts (fix: enable when expressions to use expr; add new json variables to avoid expr conflicts #9761)
• 0fc883a fix: avoid nil pointer dereference. Fixes Error: runtime error: invalid memory address or nil pointer dereference (3.3.8) #9269 (fix: avoid nil pointer dereference. Fixes #9269 #9787)
• cd43bba fix: Send workflow UID to plugins. Fixes [plugin] add more workflow data in executor plugin #8573 (fix: Send workflow UID to plugins. Fixes #8573 #9784)
• f27fe08 fix: default not respected in setting global configmap params. Fixes default not respected in configMapKeyRef when used to set global parameters #9745 (fix: default not respected in setting global configmap params. Fixes #9745 #9758)
• dc48c8c fix: Set scheduling constraints to the agent pod by the workflow. Fixes Set wf.spec.affinity.nodeAffinity, but agent pod has no nodeAffinity #9704 (fix: Set scheduling constraints to the agent pod by the workflow. Fixes #9704 #9771)
• f767f39 fix: artifactory not working. Fixes using Artifactory as an artifactRepository not working for v3.4.0. #9681 (fix: artifactory not working. Fixes #9681 #9782)
• 1fc6460 fix: Log early abort. Fixes logs incomplete comparing kubectl logs xxx #9573 (fix: Log early abort. Fixes #9573 #9575)
• f1bab89 fix: a WorkflowTemplate doesn't need to define workflow-level input p… (fix: a WorkflowTemplate doesn't need to define workflow-level input p… #9762)
• b12b5f9 fix: SSO integration not considering HTTP_PROXY when making requests. Fixes The SSO integration does not consider HTTP_PROXY env vars when making requests #9259 (fix: SSO integration not considering HTTP_PROXY when making requests. Fixes #9259 #9760)
• a8e37e9 fix: Concurrent map read and map write in agent. Fixes "fatal error: concurrent map read and map write" in agent #9685 (fix: Concurrent map read and map write in agent. Fixes #9685 #9689)
• d64b8d3 fix: quick-start-* manifests pointing to invalid httpbin image tag. Fixes v3.4.0 release assets: quick-start-* manifests include invalid references to httpbin that results in a failed deployment #9659 (fix: quick-start-* manifests pointing to invalid httpbin image tag. Fixes #9659 #9759)
• de4ea2d fix: value is required when parameter is of type enum (fix: value is required when parameter is of type enum #9753)
• d9d1968 fix: node links on UI use podName instead of workflow name (fix: node links on UI use podName instead of workflow name #9740)
• 365b6df fix: Label on Artifact GC Task no longer exceeds max characters (fix: Label on Artifact GC Task no longer exceeds max characters #9686)
• 0851c36 fix: Workflow-controller panic when stop a wf using plugin. Fixes workflow-controller panic when Stop\Terminate a workflow using a plugin  #9587 (fix: Workflow-controller panic when stop a wf using plugin. Fixes #9587 #9690)
• 2f5e753 fix: ordering of functionality for setting and evaluating label expressions (fix: ordering of functionality for setting and evaluating label expressions #9661)
• f0016e0 fix: Remove LIST_LIMIT in workflow informer (fix: Remove LIST_LIMIT in workflow informer #9700)
• e08524d fix: Avoid controller crashes when running large number of workflows (fix: Avoid controller crashes when running large number of workflows #9691)
• 84c19ea fix: render template vars in DAGTask before releasing lock.. Fixes Can't use template interpolation in mutex name in DAG #9395 (fix: render template vars in DAGTask before releasing lock.. Fixes #9395 #9405)
• b214161 fix: add authorization from cookie to metadata (fix: add authorization from cookie to metadata #9663)
• b219d85 fix: retry ExecutorPlugin invocation on transient network errors Fixes: Transient network errors are not handled properly for plugin API calls #9664 (fix: retry ExecutorPlugin invocation on transient network errors Fixes: #9664 #9665)
• b96d446 fix: Improve semaphore concurrency performance (fix: improve semaphore concurrency performance #9666)
• 38b55e3 fix: sh not available in scratch container but used in argoexec. Fixes resource template output parameter valueFrom.jqFilter results in error in v3.4.0 #9654 (fix: sh not available in scratch container but used in argoexec. Fixes #9654 #9679)
• e6eb02f fix: broken archived workflows ui. Fixes Archived Workflows Tree view UI is broken #9614, 3.4rc2 - Archived Workflows are left-aligned #9433 (fix: broken archived workflows ui. Fixes #9614, #9433 #9634)
• e556fe3 fix: Fixed artifact retrieval when templateRef in use. Fixes Can't access artifacts via UI when artifacts come from template referenced by templateref #9631, "internal server error" on the UI when viewing the logs ("no template found" error) #9644. (fix: Fixed artifact retrieval when templateRef in use. Fixes #9631, #9644. #9648)
• 72d3599 fix: avoid panic when not passing AuthSupplier (fix: avoid panic when not passing AuthSupplier #9586)
• 30bd96b fix: Error message if cronworkflow failed to update (fix: Error message if cronworkflow failed to update #9583)
• ec7c210 fix: use urlencode instead of htmlencode to sanitize url (fix: use urlencode instead of htmlencode to sanitize url #9538)
• 3a3f159 fix: enable workflow-aggregate-roles to treat workflowtaskresults. Fixes ClusterRole admin , edit , view have no permission about workflowtaskresults #9545 (fix: enable workflow-aggregate-roles to treat workflowtaskresults. Fixes #9545 #9546)
• 9d66b69 fix: for pod that's been GC'ed we need to get the log from the artifact (fix: for pod that's been GC'ed we need to get the log from the artifact #9540)
• ef6bd57 fix: Capture exit code of signaled containers. Fixes Argo-Exec V3.3.9 is recognising a failure exit code as exitCode 0 #9415 (fix: Capture exit code of signaled containers. Fixes #9415 #9523)
• f27475f fix: default to 'main' container in Sensor logs. Fixes UI hangs when attempting to view Sensor logs if pod has more than one container #9459 (fix(ui): default to main container in Sensor logs. Fixes #9459 #9438)
• 2a80a2c fix: revert accidental commit in UI logs viewer (fix: revert accidental commit in UI logs viewer #9515)
• 26ab0ae fix: link to "get artifacts from logs" was assuming Node ID was equal to Pod Name (fix: link to "get artifacts from logs" was assuming Node ID was equal to Pod Name #9464)
• ff41099 fix: Descendants of suspended nodes need to be removed when retrying workflow (fix: Descendants of suspended nodes need to be removed when retrying workflow #9440)
• a09172a fix: Incorrect alignment for archived workflow. Fixes 3.4rc2 - Archived Workflows are left-aligned #9433 (fix: Incorrect alignment for archived workflow. Fixes #9433 #9439)
• 04d1943 fix: Properly reset suspended and skipped nodes when retrying (fix: Properly reset suspended and skipped nodes when retrying #9422)
• 3ddbb5e fix: Only validate manifests for certain resource actions. Fixes Resource template with action delete now requires manifest or manifestFrom #9418 (fix: Only validate manifests for certain resource actions. Fixes #9418 #9419)
• a91e004 fix: Workflow level http template hook status update. Fixes LifeCycle hooks phase not updated at workflow level #8529 (fix: Workflow level http template hook status update. Fixes #8529 #8586)
• 343c298 fix: Argo waiter: invalid memory address or nil pointer dereference (fix: Argo waiter: invalid memory address or nil pointer dereference  #9408)
• 6f19e50 fix: Invalid memory address or nil pointer dereference (fix: Invalid memory address or nil pointer dereference #9409)
• 6e8d162 fix: Artifact panel crashes when viewing artifacts. Fixes v3.4: clicking on input arifact in UI crashes UI #9391 (fix: Artifact panel crashes when viewing artifacts. Fixes #9391 #9392)
• aa23a9e fix: Exit handle and Lifecycle hook to access {steps/tasks status} (fix: Exit handle and Lifecycle hook to access {steps/tasks status} #9229)
• 74cdf5d fix: improper selfLinks for cluster-scoped resources. Fixes Workflows fail when cluster-scoped resources have successCondition #9320 (fix: improper selfLinks for cluster-scoped resources. Fixes #9320 #9375)
• f53d483 fix: Panic on nill pointer when running a workflow with restricted parallelism (fix: Panic on nill pointer when running a workflow with restricted parallelism #9385)
• c756291 fix: removed error check which prevented deleting successful artGC wfs. (fix: removed error check which prevented deleting successful artGC wfs.  #9383)
• 65670a4 fix: Fix blank workflow details page after workflow submission (fix: Fix blank workflow details page after workflow submission #9377)
• 12466b7 fix: Retry for http timeout error. Fixes Support retry when putting file to OSS and encounter 'dial tcp: i/o timeout' error #9271 (fix: Retry for http timeout error. Fixes #9271 #9335)
• fd08b03 fix: ArtifactGC e2e test was looking for the wrong artifact names (fix: ArtifactGC e2e test was looking for the wrong artifact names #9353)
• b430180 fix: Deleted pods are not tracked correctly when retrying workflow (fix: Deleted pods are not tracked correctly when retrying workflow #9340)
• 61f252f fix: TestWorkflowStepRetry's comment accurately reflects what it does. (fix: TestWorkflowStepRetry's comment accurately reflects what it does. #9234)
• 0d77f55 fix: Look in correct bucket when downloading artifacts (Template.ArchiveLocation configured) (fix: Look in correct bucket when downloading artifacts (Template.ArchiveLocation configured) #9301)
• 083f3a2 fix: pass correct error obj for azure blob failures (fix: pass correct error obj for azure blob failures #9276)
• 0c24ca1 fix: TestParallel 503 with external url (fix: TestParallel 503 with external url #9265)
• be6ba4f fix: add ServiceUnavailable to s3 transient errors list Fixes Artifact load on 503 Service Unavailable error is not retried for S3 artifact repository #9248 (fix: add ServiceUnavailable to s3 transient errors list Fixes #9248 #9249)
• 15fdf49 fix: line return in devcontainer host file (fix: line return in devcontainer host file  #9204)
• d5d4628 fix: Set namespace to user namespace obtained from /userinfo service (fix: Set namespace to user namespace obtained from /userinfo service #9191)
• 573fe98 fix: remove unused argument which is triggering in lint (needed for PRs to pass CI) (fix: remove unused argument which is triggering in lint (needed for PRs to pass CI) #9186)
• 0f1d1d9 fix: support RemainingItemCount in archivedWrokflow (fix: support RemainingItemCount in archivedWrokflow #9118)
• aea581e fix: Incorrect link to workflows list with the same author (fix: Incorrect link to workflows list with the same author #9173)
• 877f36f fix: Workflow details accessing undefined templateRef. Fixes UI: e.templateRef is undefined when using inline template #9167 (fix: Workflow details accessing undefined templateRef. Fixes #9167 #9168)
• 42729ff fix: Workflow retry should also reset the selected nodes (fix: Workflow retry should also reset the selected nodes #9156)
• 56d0c66 fix: Do not error when getting log artifacts from GCS. Fixes GCS artifact repository archiveLogs error #8746 (fix: Do not error when getting log artifacts from GCS. Fixes #8746 #9155)
• 2b92b1a fix: Fixed swagger error. Fixes Have errors for swagger.json when opening with https://editor.swagger.io #8922 (fix: Fixed swagger error. Fixes #8922 #9078)
• 61211f9 fix: Add workflow failures before hooks run. Fixes {{ workflow.failures }} doesn't get a value in lifecycle hook #8882 (fix: Add workflow failures before hooks run. Fixes #8882 #9009)
• f5f1a34 fix: sync lock should be released only if we're retrying (fix: sync lock should be released only if we're retrying #9063)
• 89f3433 fix: workflow.status is now set properly in metrics. Fixes {{workflow.status}} is not working in metrics #8895 (fix: workflow.status is now set properly in metrics. Fixes #8895 #8939)
• 6228748 fix: Treat 'connection reset by peer' as a transient network error. Fixes "connection reset by peer" transient error not handled in workflow-of-workflows #9013 (Treat 'connection reset by peer' as a transient network error. Fixes #9013 #9017)
• 416fce7 fix: Fork sub-process. Fixes fix: Revert controller readiness changes. Fixes #8441 #8454 (fix: Fork sub-process. Fixes #8680 #8906)
• 750c4e1 fix: Only signal running containers, ignore failures. (fix: Only signal running containers, ignore failures. #8909)
• ede1a39 fix: workflowMetadata needs to be loaded into globalParams in both ArgoServer and Controller (fix: workflowMetadata needs to be loaded into globalParams in both ArgoServer and Controller #8907)
• 7dacb5b fix: Fixed Swagger error. Fixes Errors in swagger.json when opening with https://editor.swagger.io #8830 (fix: Fixed Swagger error. Fixes #8830 #8886)
• bc01003 fix: Change to distroless. Fixes Get "https://index.docker.io/v2/": x509: certificate signed by unknown authority #8805 (fix: Change to distroless. Fixes #8805 #8806)
• 39fbdb2 fix: fix a command in the quick-start page (fix: fix a command in the quick-start page #8782)
• 178bbbc fix: Temporarily fix CI build. Fixes CI build on master appears to be broken #8757. (fix: Temporarily fix CI build. Fixes #8757. #8758)
• aa366db fix: remove list and watch on secrets. Fixes Server with SSO enabled should not require List on all Secrets #8534 (fix!: remove list and watch on secrets. Fixes #8534 #8555)
• 342abcd fix: mkdocs uses 4space indent for nested list (fix: mkdocs uses 4space indent for nested list #8740)
• b3bf327 fix: Fix the resursive example to call the coinflip template (docs: fix coinflip recursive example #8696)
• 72d3f32 fix: update go-color path/version (fix: update go-color path/version #8707)
• 92b3ef2 fix: upgrade moment from 2.29.2 to 2.29.3 ([Snyk] Upgrade moment from 2.29.2 to 2.29.3 #8679)
• 859ebe9 fix: Terminate, rather than delete, deadlined pods. Fixes containers in containersets not appropriately reporting status if terminated #8545 (fix: Terminate, rather than delete, deadlined pods. Fixes #8545 #8620)
• 3fdf30d fix: Enhance artifact visualization. Fixes The horizontal/vertical option on the graph panel does not persist #8619 (fix: Enhance artifact visualization. Fixes #8619 #8655)
• 16fef4e fix: enable ARGO_REMOVE_PVC_PROTECTION_FINALIZER by default. Fixes Enable ARGO_REMOVE_PVC_PROTECTION_FINALIZER by default. #8592 (fix: enable ARGO_REMOVE_PVC_PROTECTION_FINALIZER by default. Fixes #8592 #8661)
• ed351ff fix: ArtifactGC moved from Template to Artifact. Fixes ArtifactGC should be on Artifact not Template #8556. (fix: ArtifactGC moved from Template to Artifact. Fixes #8556. #8581)
• 9740315 fix: Polish artifact visualisation. Fixes Visualizations in the Argo UI #7743 (fix: Polish artifact visualisation. Fixes #7743 #8552)
• 98dd898 fix: Correct CSP. Fixes Artifact CSP and X-Frame-Options are wrong values #8560 (fix: Correct CSP. Fixes #8560 #8579)
• 5b8638f fix: modified SearchArtifact to return ArtifactSearchResults. Fixes Artifact GC: SearchArtifact to return ArtifactSearchResults #8543 (fix(Artifact GC): modified SearchArtifact to return ArtifactSearchResults. Fixes #8543 #8557)
• ecd91b1 fix: added json tag to ArtifactGCStrategies (fix: added json tag to ArtifactGCStrategies #8523)
• f223bb8 fix: ArtifactGCOnWorkflowDeletion typo quick fix (fix: ArtifactGCOnWorkflowDeletion typo quick fix #8519)
• 8c0a957 fix: Fix bug in entrypoint lookup (fix: Fix bug in entrypoint lookup #8453)
• d47081f fix: upgrade react-moment from 1.0.0 to 1.1.1 ([Snyk] Upgrade react-moment from 1.0.0 to 1.1.1 #8389)
• 010e359 fix: upgrade react-datepicker from 2.14.1 to 2.16.0 ([Snyk] Upgrade react-datepicker from 2.14.1 to 2.16.0 #8388)
• 0c9d88b fix: upgrade prop-types from 15.7.2 to 15.8.1 ([Snyk] Upgrade prop-types from 15.7.2 to 15.8.1 #8387)
• 2d91646 fix: upgrade js-yaml from 3.13.1 to 3.14.1 ([Snyk] Upgrade js-yaml from 3.13.1 to 3.14.1 #8374)
• 54eaed0 fix: upgrade cron-parser from 2.16.3 to 2.18.0 ([Snyk] Upgrade cron-parser from 2.16.3 to 2.18.0 #8373)
• e9de085 fix: Erratum in docs. Fixes Erratum in docs #8342 (fix: Erratum in docs. Fixes #8342 #8359)
• a3d1d07 fix: upgrade react-chartjs-2 from 2.10.0 to 2.11.2 ([Snyk] Upgrade react-chartjs-2 from 2.10.0 to 2.11.2 #8357)
• b199cb9 fix: upgrade history from 4.7.2 to 4.10.1 ([Snyk] Upgrade history from 4.7.2 to 4.10.1 #8356)
• e405215 fix: upgrade multiple dependencies with Snyk ([Snyk] Upgrade: react, react-dom #8355)
• 8c893bd fix: upgrade com.google.code.gson:gson from 2.8.9 to 2.9.0 ([Snyk] Upgrade com.google.code.gson:gson from 2.8.9 to 2.9.0 #8354)
• ae38815 fix: examples/README.md: overriten => overridden (fix: typo in examples/README.md: overriten => overridden #8351)
• ab21eed fix: upgrade io.swagger:swagger-annotations from 1.6.2 to 1.6.5 ([Snyk] Upgrade io.swagger:swagger-annotations from 1.6.2 to 1.6.5 #8335)
• f708528 fix: upgrade react-monaco-editor from 0.36.0 to 0.47.0 ([Snyk] Upgrade react-monaco-editor from 0.36.0 to 0.47.0 #8339)
• 3c35bd2 fix: upgrade cronstrue from 1.109.0 to 1.125.0 ([Snyk] Upgrade cronstrue from 1.109.0 to 1.125.0 #8338)
• 7ee17dd fix: upgrade com.squareup.okhttp3:logging-interceptor from 4.9.1 to 4.9.3 ([Snyk] Upgrade com.squareup.okhttp3:logging-interceptor from 4.9.1 to 4.9.3 #8336)
• aa9ff17 fix: Remove path traversal CWE-23 (fix: Remove path traversal CWE-23 #8331)

[JPZ13]

@sarabala1979 - can we add #9959 ?

cc @mostaphaRoudsari @AntoineDao

[alexec]

Cherry-picking too many issues to this release will risk introducing new bugs. You’ll then become mired in in a cycle of fixes and bugs.

I’d suggest only cherry-picking a small number of issues where your confident the blast radius is limited.

[crenshaw-dev]

Very small change that I think deserves to be cherry-picked back: #9966

[terrytangyuan]

This might be worth cherry picking to address security vulnerabilities: 4eb6cb7

[terrytangyuan]

Regression fix worth considering cherry-picking #10047

[terrytangyuan]

Regression fix worth considering cherry-picking #10047

Looks like many users are impacted by this. Please cherry pick this one. 2eb871b

[terrytangyuan]

We can close this now.