fix: prevent nil pointer dereference in GetTemplateFromRef with podMetadata. Fixes #14968 (cherry-pick #14970 for 3.7) (#15029)

Signed-off-by: Bjoern Weidlich <[email protected]>
Signed-off-by: Alan Clucas <[email protected]>
Co-authored-by: Bjoern Weidlich <[email protected]>

Author: Joibel

workflow/templateresolution/context.go

@@ -155,12 +155,13 @@ func (ctx *Context) GetTemplateFromRef(tmplRef *wfv1.TemplateRef) (*wfv1.Templat
 
 	template = wftmpl.GetTemplateByName(tmplRef.Template)
 
-	podMetadata := wftmpl.GetPodMetadata()
-	ctx.addPodMetadata(podMetadata, template)
-
 	if template == nil {
 		return nil, errors.Errorf(errors.CodeNotFound, "template %s not found in workflow template %s", tmplRef.Template, tmplRef.Name)
 	}
+
+	podMetadata := wftmpl.GetPodMetadata()
+	ctx.addPodMetadata(podMetadata, template)
+
 	return template.DeepCopy(), nil
 }
 

workflow/templateresolution/context_test.go

@@ -346,3 +346,53 @@ func TestOnWorkflowTemplate(t *testing.T) {
 	tmpl := newCtx.tmplBase.GetTemplateByName("whalesay")
 	assert.NotNil(t, tmpl)
 }
+
+// TestGetTemplateFromRefWithPodMetadataAndMissingTemplate tests the bug where
+// GetTemplateFromRef causes a nil pointer dereference when:
+// 1. A WorkflowTemplate has podMetadata defined
+// 2. A templateRef references a template name that doesn't exist in that WorkflowTemplate
+func TestGetTemplateFromRefWithPodMetadataAndMissingTemplate(t *testing.T) {
+	wfClientset := fakewfclientset.NewSimpleClientset()
+
+	// Create a WorkflowTemplate with podMetadata but without the template "nonexistent"
+	workflowTemplateWithPodMetadata := `
+apiVersion: argoproj.io/v1alpha1
+kind: WorkflowTemplate
+metadata:
+  name: template-with-podmetadata
+spec:
+  podMetadata:
+    labels:
+      example-label: example-value
+    annotations:
+      example-annotation: example-value
+  templates:
+  - name: existing-template
+    container:
+      image: alpine:latest
+      command: [echo, hello]
+`
+
+	err := createWorkflowTemplate(wfClientset, workflowTemplateWithPodMetadata)
+	require.NoError(t, err)
+
+	// Create a base workflow template to use as context
+	baseWftmpl := unmarshalWftmpl(baseWorkflowTemplateYaml)
+	tplCtx := NewContextFromClientSet(
+		wfClientset.ArgoprojV1alpha1().WorkflowTemplates(metav1.NamespaceDefault),
+		wfClientset.ArgoprojV1alpha1().ClusterWorkflowTemplates(),
+		baseWftmpl,
+		nil,
+	)
+
+	// Try to get a template that doesn't exist from a WorkflowTemplate that HAS podMetadata
+	tmplRef := wfv1.TemplateRef{
+		Name:     "template-with-podmetadata",
+		Template: "nonexistent-template",
+	}
+
+	_, err = tplCtx.GetTemplateFromRef(&tmplRef)
+
+	require.Error(t, err)
+	require.Contains(t, err.Error(), "template nonexistent-template not found in workflow template template-with-podmetadata")
+}