UI: Env variable to hide yaml submission

[tooptoop4]

Would be great to hide this button
https://github.com/argoproj/argo-workflows/blob/v3.4.8/ui/src/app/workflows/components/workflow-creator.tsx#L79-L84

Then can allow SSO users to just submit workflows from existing templates but not submit arbitrary new code!

[agilgur5]

You can use the Workflow Restrictions feature to only allow users to submit via existing templates.

Removing the UI button would not necessarily suffice, as the API can still be accessed (e.g. someone could make a request from within their browser console). API permissions are based off k8s RBAC, which is not specific enough to only allow certain kinds of Workflows (other than a resourceNames allowlist).

If not using Workflow Restrictions, another way to workaround that would be to use policies / admission controllers to create more granular logic.
See also #6490 for more granular RBAC via Casbin, similar to Argo CD

[tooptoop4]

would workflow restrictions prevent an adhoc run of a cronworkflow that doesn't use a template?

[agilgur5]

I believe it should apply to CronWorkflows as well, yes.

I've never tried submitting a CronWorkflow with no template though, so I'm not 100% confident of that. Good question!

But if Workflow Restrictions didn't apply to CronWorkflows, I would consider that to be a bug. Can tag me if you find such a bug and I'd look into fixing it 🙂

[agilgur5]

Ah right, I forgot, a CronWorkflow just creates Workflows (see also the code here), so yes, it will go through the same validation as a Workflow.