fix: Address PR review comments from knottnt

- Update ResolveReferencesForField function comment to reflect new
  generated output with ValidateCrossNamespaceReference call, three
  return values, and cross-namespace warning/condition logic
- Remove stale --enable-cross-namespace-references flag from
  deployment.yaml.tpl (superseded by --enable-cross-namespace)
- Remove stale enableCrossNamespaceReferences value from
  values.yaml.tpl (superseded by enableCrossNamespace)

Author: sapphirew

pkg/generate/code/resource_reference.go

@@ -122,6 +122,11 @@ func ReferenceFieldsValidation(
 // are related to the given concrete field, determining whether its in a valid
 // condition and updating the concrete field with the referenced value.
 //
+// The generated code calls ackrt.ValidateCrossNamespaceReference to check
+// whether the reference targets a different namespace. If the cross-namespace
+// flag is disabled, the helper returns an error. If enabled and cross-namespace,
+// a warning is logged and a condition is set on the resource.
+//
 // Sample output (resolving a singular reference):
 //
 //	if ko.Spec.APIRef != nil && ko.Spec.APIRef.From != nil {
@@ -130,6 +135,19 @@ func ReferenceFieldsValidation(
 //		if arr.Name == nil || *arr.Name == "" {
 //			return hasReferences, fmt.Errorf("provided resource reference is nil or empty: APIRef")
 //		}
+//		namespace, isCrossNs, err := ackrt.ValidateCrossNamespaceReference(
+//			rm.cfg.EnableCrossNamespace,
+//			ko.ObjectMeta.GetNamespace(),
+//			arr.Namespace,
+//			*arr.Name,
+//		)
+//		if err != nil {
+//			return hasReferences, err
+//		}
+//		if isCrossNs {
+//			ackrtlog.FromContext(ctx).Info("cross-namespace resource reference detected; ...")
+//			setCrossNamespaceCondition(ko, crossNsMsg)
+//		}
 //		obj := &svcapitypes.API{}
 //		if err := getReferencedResourceState_API(ctx, apiReader, obj, *arr.Name, namespace); err != nil {
 //			return hasReferences, err
@@ -146,6 +164,16 @@ func ReferenceFieldsValidation(
 //			if arr.Name == nil || *arr.Name == "" {
 //				return hasReferences, fmt.Errorf("provided resource reference is nil or empty: SecurityGroupRefs")
 //			}
+//			namespace, isCrossNs, err := ackrt.ValidateCrossNamespaceReference(
+//				rm.cfg.EnableCrossNamespace,
+//				ko.ObjectMeta.GetNamespace(),
+//				arr.Namespace,
+//				*arr.Name,
+//			)
+//			if err != nil {
+//				return hasReferences, err
+//			}
+//			if isCrossNs { ... }
 //			obj := &ec2apitypes.SecurityGroup{}
 //			if err := getReferencedResourceState_SecurityGroup(ctx, apiReader, obj, *arr.Name, namespace); err != nil {
 //				return hasReferences, err
@@ -156,31 +184,6 @@ func ReferenceFieldsValidation(
 //			ko.Spec.SecurityGroupIDs = append(ko.Spec.SecurityGroupIDs, (*string)(obj.Status.ID))
 //		}
 //	}
-//
-// Sample output (resolving nested lists of structs containing references):
-//
-//	if ko.Spec.Notification != nil {
-//		for f0idx, f0iter := range ko.Spec.Notification.LambdaFunctionConfigurations {
-//			if f0iter.Filter != nil {
-//				if f0iter.Filter.Key != nil {
-//					for f1idx, f1iter := range f0iter.Filter.Key.FilterRules {
-//						if f1iter.ValueRef != nil && f1iter.ValueRef.From != nil {
-//							hasReferences = true
-//							arr := f1iter.ValueRef.From
-//							if arr.Name == nil || *arr.Name == "" {
-//								return hasReferences, fmt.Errorf("provided resource reference is nil or empty: Notification.LambdaFunctionConfigurations.Filter.Key.FilterRules.ValueRef")
-//							}
-//							obj := &svcapitypes.Bucket{}
-//							if err := getReferencedResourceState_Bucket(ctx, apiReader, obj, *arr.Name, namespace); err != nil {
-//								return hasReferences, err
-//							}
-//							ko.Spec.Notification.LambdaFunctionConfigurations[f0idx].Filter.Key.FilterRules[f1idx].Value = (*string)(obj.Spec.Name)
-//						}
-//					}
-//				}
-//			}
-//		}
-//	}
 func ResolveReferencesForField(field *model.Field, sourceVarName string, indentLevel int) (string, error) {
 	isListOfRefs := field.ShapeRef.Shape.Type == "list"
 

templates/helm/templates/deployment.yaml.tpl

@@ -105,7 +105,6 @@ spec:
 {{ "{{- end }}" }}
         - {{ "--enable-carm={{ .Values.enableCARM }}" }}
         - {{ "--enable-cross-namespace={{ .Values.enableCrossNamespace }}" }}
-        - {{ "--enable-cross-namespace-references={{ .Values.enableCrossNamespaceReferences }}" }}
         image: {{ "{{ .Values.image.repository }}:{{ .Values.image.tag }}" }}
         imagePullPolicy: {{ "{{ .Values.image.pullPolicy }}" }}
         name: controller

templates/helm/values.yaml.tpl

@@ -185,12 +185,6 @@ enableCARM: true
 # that crosses namespace boundaries.
 enableCrossNamespace: true
 
-# Enables cross-namespace resolution of AWSResourceReference entries.
-# When false (default), the controller rejects any reference whose
-# Namespace field differs from the namespace of the resource containing
-# the reference.
-enableCrossNamespaceReferences: false
-
 # Configuration for feature gates.  These are optional controller features that
 # can be individually enabled ("true") or disabled ("false") by adding key/value
 # pairs below.