fix(argo-server)!: Implement missing instanceID code. Fixes #2780

[alexec]

Checklist:

• Either (a) I've created an enhancement proposal and discussed it with the community, (b) this is a bug fix, or (c) this is a chore.
• The title of the PR is (a) conventional, (b) states what changed, and (c) suffixes the related issues number. E.g. "fix(controller): Updates such and such. Fixes #1234".
• I've signed the CLA.
• I have written unit and/or e2e tests for my change. PRs without these are unlikely to be merged.
• My builds are green. Try syncing with master if they are not.
• My organization is added to USERS.md.

This contains a breaking change.

• When: You are using (a) instance ID and (b) workflow templates.
• Impact: You will not longer be available access workflow templates via the Argo Server API.
• Why: You should never have been able to access this data and the vast majority of users, if any, will be impacted.

[sarabala1979]

The InstanceID concept is mainly for workflow and CronWorkflow execution purposes. It will not apply on definitions of WorkflowTemplate and ClusterWorkflowTemplate. It is a simple flexibility to control the workflow execution particular controller. @jessesuen can comment on this.

[alexec]

@jessesuen @sarabala1979 @dtaniwaki there are a lot of misses in the code base for instance ID. This tells me that is fundamentally hard to get right - like RBAC.

I essentially had to intercept every single call. Really hard to test.

It made me wonder if it is possible to do this in the generated code? @alexmt

[sarabala1979]

This PR will change the current understanding/assumption of Argo usage with InstanceID.

1. User should have separate ApiServer/UI/Controller for each InstanceID
2. User needs to configure ENV or pass the -Argo-server URL for each InstanceID otherwise they need to use classic client
   This change needs to be documented and demoed in a community meetings.

[alexec]

This PR will change the current understanding/assumption of Argo usage with InstanceID.

1. User should have separate ApiServer/UI/Controller for each InstanceID
2. User needs to configure ENV or pass the -Argo-server URL for each InstanceID otherwise they need to use classic client
   This change needs to be documented and demoed in a community meetings.

I think I'm fine with that. My take (and I believe @jessesuen 's too) is that instance ID is a data segregation feature and this is how it should behave. We should warn people in release notes too.

[sarabala1979]

InstanceID checking is missing in the Workflow Archive module.

[alexec]

InstanceID checking is missing in the Workflow Archive module.

This is enforced by workflow_archive.go - which is not the same as others.

[alexec]

Failed builds indicate dynamic check is working - but I've missed something :(

[alexec]

@sarabala1979 this is ready for review again.
@jessesuen there were bugs in the proto files - the name field is ignored - can you approve please?

changes made

[alexec]

@sarabala1979 are you still reviewing please?

[sonarqubecloud]

Kudos, SonarCloud Quality Gate passed!

0 Bugs
0 Vulnerabilities (and 0 Security Hotspots to review)
0 Code Smells

84.6% Coverage
0.0% Duplication