Repository: argoproj/argo (go)

Issue:
invalid: metadata.labels for createBy when SSO subject does not start with alphanumeric charecters
## Summary 

Submitting a workflow from the UI when SSO is enabled fails and throws a kubernetes validation error

## Diagnostics

What Kubernetes provider are you using? 
EKS v1.18
What version of Argo Workflows are you running? 
reproduced in 2.12.2 and 2.12.4

The error we receive is

```
Unsuccessful HTTP response: Workflow.argoproj.io "legacyjobs-ghbc4" is invalid: metadata.labels: Invalid value: "_Cjks_k4UFqRHnV8IEbPNXVrhpAeJZa6It-6cxYHGD8": a valid label must be an empty string or consist of alphanumeric characters, '-', '_' or '.', and must start and end with an alphanumeric character (e.g. 'MyValue', or 'my_value', or '12345', regex used for validation is '(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?'):  Reload
```

where `_Cjks_k4UFqRHnV8IEbPNXVrhpAeJZa6It-6cxYHGD8` is the subject name in user info

looking at [argo/workflow/creator/creator.go](https://github.com/argoproj/argo/blob/master/workflow/creator/creator.go)

It appears that some of this was addressed in a recent PR, but a change to the `dnsFriendly` function something like this would probably address the problem we are seeing

```
func dnsFriendly(s string) string {
	value := regexp.MustCompile("[^-_.a-z0-9A-Z]").ReplaceAllString(s, "-")
        value = regexp.MustCompile("^[^a-z0-9A-Z]*").ReplaceAllString(value, "")
	if len(value) > 63 {
		value = value[len(value)-63:]
	}
	value = strings.TrimLeft(value, "-")
	return value
}
```

Since that should satisfy the regex used for validation in the above error message

---
<!-- Issue Author: Don't delete this message to encourage other users to support your issue! -->
**Message from the maintainers**:

Impacted by this bug? Give it a 👍. We prioritise the issues with the most 👍.


Pull request:
fix(controller): make creator label DNS compliant. Fixes #4880
Fixes https://github.com/argoproj/argo/issues/4880

Checklist:

* [x ] My organization is added to [USERS.md](https://github.com/argoproj/argo/blob/master/USERS.md).

<!--

Please leave your PR in draft if you don't need a review yet. 

To fix failing `CI / Codegen`, run `make codegen`. 

-->


Patch:
diff --git a/USERS.md b/USERS.md
index d6bd345e4..fe1822189 100644
--- a/USERS.md
+++ b/USERS.md
@@ -70,6 +70,7 @@ Currently, the following organizations are **officially** using Argo Workflows:
 1. [Microblink](https://microblink.com/)
 1. [Mirantis](https://mirantis.com/)
 1. [Mixpanel](https://mixpanel.com)
+1. [Motus](https://www.motus.com)
 1. [New Relic](https://newrelic.com/)
 1. [Nikkei](https://www.nikkei.co.jp/nikkeiinfo/en/)
 1. [Norwegian Refugee Council](https://www.nrc.no/)
diff --git a/workflow/creator/creator.go b/workflow/creator/creator.go
index e5d78cc0c..e6d18a9c1 100644
--- a/workflow/creator/creator.go
+++ b/workflow/creator/creator.go
@@ -24,9 +24,10 @@ func Label(ctx context.Context, obj metav1.Object) {
 
 func dnsFriendly(s string) string {
 	value := regexp.MustCompile("[^-_.a-z0-9A-Z]").ReplaceAllString(s, "-")
+	value = regexp.MustCompile("^[^a-z0-9A-Z]*").ReplaceAllString(value, "")
+	value = regexp.MustCompile("[^a-z0-9A-Z]*$").ReplaceAllString(value, "")
 	if len(value) > 63 {
 		value = value[len(value)-63:]
 	}
-	value = strings.TrimLeft(value, "-")
 	return value
 }


Test patch:
diff --git a/workflow/creator/creator_test.go b/workflow/creator/creator_test.go
index 1559a0b77..bea15b29f 100644
--- a/workflow/creator/creator_test.go
+++ b/workflow/creator/creator_test.go
@@ -36,4 +36,11 @@ func TestLabel(t *testing.T) {
 			assert.Equal(t, "y", wf.Labels[common.LabelKeyCreator])
 		}
 	})
+	t.Run("InvalidDNSNames", func(t *testing.T) {
+		wf := &wfv1.Workflow{}
+		Label(context.WithValue(context.TODO(), auth.ClaimsKey, &types.Claims{Claims: jwt.Claims{Subject: "!@#$%^&*()--__" + strings.Repeat("y", 35) + "__--!@#$%^&*()"}}), wf)
+		if assert.NotEmpty(t, wf.Labels) {
+			assert.Equal(t, strings.Repeat("y", 35), wf.Labels[common.LabelKeyCreator])
+		}
+	})
 }