Repository: argoproj/argo (go)

Issue:
Increase `checkForbiddenErrorAndResubmitAllowed` requeue time
# Summary

In #3407 we introduced a requeue:

```
func (woc *wfOperationCtx) checkForbiddenErrorAndResubmitAllowed(err error, nodeName string, tmpl *wfv1.Template) (*wfv1.NodeStatus, error) {
	if (apierr.IsForbidden(err) || apierr.IsTooManyRequests(err)) && isResubmitAllowed(tmpl) {
		// Our error was most likely caused by a lack of resources. If pod resubmission is allowed, keep the node pending
		woc.requeue(0)
		return woc.markNodePending(nodeName, err), nil
	}
	return nil, err
}
```

This is 0s and therefore will hot loop. Maybe should be 10s?


---
<!-- Issue Author: Don't delete this message to encourage other users to support your issue! -->
**Message from the maintainers**:

Impacted by this bug? Give it a 👍. We prioritise the issues with the most 👍.

Pull request:
fix: Increase the requeue duration on checkForbiddenErrorAndResubmitAllowed
Checklist:

* [ ] Either (a) I've created an [enhancement proposal](https://github.com/argoproj/argo/issues/new/choose) and discussed it with the community, (b) this is a bug fix, or (c) this is a chore.
* [ ] The title of the PR is (a) [conventional](https://www.conventionalcommits.org/en/v1.0.0/), (b) states what changed, and (c) suffixes the related issues number. E.g. `"fix(controller): Updates such and such. Fixes #1234"`.  
* [ ] I've signed the CLA.
* [ ] I have written unit and/or e2e tests for my change. PRs without these are unlikely to be merged.
* [ ] My builds are green. Try syncing with master if they are not. 
* [ ] My organization is added to [USERS.md](https://github.com/argoproj/argo/blob/master/USERS.md).
Fixes #3793 

Patch:
diff --git a/workflow/controller/operator.go b/workflow/controller/operator.go
index 519eed3af..99334db30 100644
--- a/workflow/controller/operator.go
+++ b/workflow/controller/operator.go
@@ -2154,7 +2154,7 @@ func (woc *wfOperationCtx) executeScript(nodeName string, templateScope string,
 func (woc *wfOperationCtx) checkForbiddenErrorAndResubmitAllowed(err error, nodeName string, tmpl *wfv1.Template) (*wfv1.NodeStatus, error) {
 	if (apierr.IsForbidden(err) || apierr.IsTooManyRequests(err)) && isResubmitAllowed(tmpl) {
 		// Our error was most likely caused by a lack of resources. If pod resubmission is allowed, keep the node pending
-		woc.requeue(0)
+		woc.requeue(10 * time.Second)
 		return woc.markNodePending(nodeName, err), nil
 	}
 	return nil, err
diff --git a/workflow/creator/creator.go b/workflow/creator/creator.go
index 4bc165ddb..30d46c538 100644
--- a/workflow/creator/creator.go
+++ b/workflow/creator/creator.go
@@ -14,6 +14,10 @@ import (
 func Label(ctx context.Context, obj metav1.Object) {
 	claims := auth.GetClaimSet(ctx)
 	if claims != nil {
-		labels.Label(obj, common.LabelKeyCreator, regexp.MustCompile("[^-_.a-z0-9A-Z]").ReplaceAllString(claims.Sub, "-"))
+		value := regexp.MustCompile("[^-_.a-z0-9A-Z]").ReplaceAllString(claims.Sub, "-")
+		if len(value) > 63 {
+			value = value[len(value)-63:]
+		}
+		labels.Label(obj, common.LabelKeyCreator, value)
 	}
 }


Test patch:
diff --git a/workflow/creator/creator_test.go b/workflow/creator/creator_test.go
index 30d03785f..464b9e6b1 100644
--- a/workflow/creator/creator_test.go
+++ b/workflow/creator/creator_test.go
@@ -2,6 +2,7 @@ package creator
 
 import (
 	"context"
+	"strings"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -25,4 +26,11 @@ func TestLabel(t *testing.T) {
 			assert.Contains(t, wf.Labels, common.LabelKeyCreator)
 		}
 	})
+	t.Run("TooLong", func(t *testing.T) {
+		wf := &wfv1.Workflow{}
+		Label(context.WithValue(context.TODO(), auth.ClaimSetKey, &jws.ClaimSet{Sub: strings.Repeat("x", 63) + "y"}), wf)
+		if assert.NotEmpty(t, wf.Labels) {
+			assert.Equal(t, strings.Repeat("x", 62)+"y", wf.Labels[common.LabelKeyCreator])
+		}
+	})
 }