{"record":{"id":"526545a12d0f6ea1","repo":"argoproj/argo-workflows","slug":"fields-v-are-not-permitted-when-using-workflowtem","errorCode":null,"errorMessage":"fields %v are not permitted when using workflowTemplateRef with templateReferencing restriction","messagePattern":"fields (.+?) are not permitted when using workflowTemplateRef with templateReferencing restriction","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"workflow/util/merge.go","lineNumber":125,"sourceCode":"\tvar violations []string\n\tfor i := 0; i < t.NumField(); i++ {\n\t\tfieldName := t.Field(i).Name\n\t\tif allowedUserOverrideFields[fieldName] {\n\t\t\tcontinue\n\t\t}\n\t\tif !reflect.DeepEqual(v.Field(i).Interface(), zero.Field(i).Interface()) {\n\t\t\tviolations = append(violations, fieldName)\n\t\t}\n\t}\n\t// ArtifactGC is allow-listed so that its benign fields (Strategy,\n\t// ForceFinalizerRemoval) may be set, but its nested ServiceAccountName,\n\t// PodSpecPatch and PodMetadata reach the artifact-GC Pod and would otherwise\n\t// re-open the privilege escalation that the top-level ServiceAccountName /\n\t// PodSpecPatch / PodMetadata blocks are meant to close, so reject them here.\n\tviolations = append(violations, artifactGCOverrideViolations(userSpec.ArtifactGC)...)\n\tif len(violations) > 0 {\n\t\tsort.Strings(violations)\n\t\treturn fmt.Errorf(\"fields %v are not permitted when using workflowTemplateRef with templateReferencing restriction\", violations)\n\t}\n\treturn nil\n}\n\n// SanitizeUserWorkflowSpec returns a copy of userSpec with only allow-listed\n// fields preserved. This provides defense-in-depth after validation.\nfunc SanitizeUserWorkflowSpec(userSpec *wfv1.WorkflowSpec) *wfv1.WorkflowSpec {\n\tif userSpec == nil {\n\t\treturn nil\n\t}\n\tsanitized := &wfv1.WorkflowSpec{}\n\tsrc := reflect.ValueOf(userSpec).Elem()\n\tdst := reflect.ValueOf(sanitized).Elem()\n\tt := src.Type()\n\n\tfor i := 0; i < t.NumField(); i++ {\n\t\tif allowedUserOverrideFields[t.Field(i).Name] {\n\t\t\tdst.Field(i).Set(src.Field(i))","sourceCodeStart":107,"sourceCodeEnd":143,"githubUrl":"https://github.com/argoproj/argo-workflows/blob/35bff19146f5a6ada77468c431f2624bd577e373/workflow/util/merge.go#L107-L143","documentation":"When a workflow uses workflowTemplateRef with the templateReferencing restriction, ValidateUserOverrides rejects any user-supplied spec fields that are not on the operator-configured allowlist. The error lists all violating field names. Notably ArtifactGC overrides are always flagged because PodSpecPatch/PodMetadata inside ArtifactGC could reach the artifact-GC Pod and re-open privilege escalation.","triggerScenarios":"Submitting a workflow with workflowTemplateRef (restriction mode) whose spec sets fields outside the allowlist — e.g. spec.podSpecPatch, spec.podMetadata, spec.serviceAccountName, or spec.artifactGC with podSpecPatch/podMetadata — and ValidateUserOverrides is invoked (submit path / tests).","commonSituations":"Users adding per-workflow tweaks (securityContext, SA, pod metadata) while the operator has locked down template referencing; ArtifactGC settings in a restricted submit; allowlist env var not covering fields the team expects.","solutions":["Remove the disallowed fields from the submitted workflow spec and put those settings in the referenced WorkflowTemplate instead","Ask the operator to add the needed fields to the templateReferencing allowlist env var if the overrides are legitimately required","Remove spec.artifactGC podSpecPatch/podMetadata overrides — these are always rejected in restriction mode"],"exampleFix":"// before\nspec:\n  workflowTemplateRef:\n    name: mytpl\n  serviceAccountName: privileged-sa\n// after\nspec:\n  workflowTemplateRef:\n    name: mytpl  # SA set inside the template\n","handlingStrategy":"validation","validationCode":"restricted := usesTemplateRefWithRestriction(wf)\nif restricted {\n    for _, f := range disallowedOverrideFields(wf.Spec) {\n        return fmt.Errorf(\"field %q not permitted with templateReferencing restriction\", f)\n    }\n}","typeGuard":null,"tryCatchPattern":"err := util.ValidateUserOverrides(spec, tmplSpec)\nif err != nil && strings.Contains(err.Error(), \"not permitted when using workflowTemplateRef\") {\n    // move those settings into the referenced WorkflowTemplate\n}","preventionTips":["Design restricted-mode templates to contain all pod-level settings (SA, securityContext)","Never set spec.artifactGC.podSpecPatch/podMetadata in restricted-mode submissions","Document the allowlist to workflow authors so overrides are designed, not guessed"],"tags":["validation","security","workflow-template","restriction"],"backgroundTag":"field-not-allowed-override","analyzedSha":"35bff19146f5a6ada77468c431f2624bd577e373","analyzedAt":"2026-09-03T19:34:35.908Z","contentChangedAt":"2026-09-03T19:34:35.908Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}