feat: Pass owning resource to SecretValueFromReference for cross-namespace notice

The runtime's SecretValueFromReference now takes the owning resource as an
explicit acktypes.ConditionManager argument so it can set the cross-namespace
deprecation ACK.Advisory condition on it (runtime mechanism 1b, replacing the
context-stash). Update the generated SetSDK code to pass the resource handle:

    rm.rr.SecretValueFromReference(ctx, r, r.ko.Spec.MasterUserPassword)

The resource variable is threaded through setSDKForContainer / SetSDKForStruct
/ setSDKForSlice / setSDKForMap / setSDKForUnion so secrets nested in
collections still pass the top-level resource (not a loop iterator); at entry
points it is derived from the leading token of the source variable path. The
generated *resource type implements acktypes.ConditionManager.

Companion to the runtime change; builds on #699.

Author: sapphirew

pkg/generate/ack/controller.go

@@ -124,7 +124,9 @@ var (
 			return code.SetSDK(r.Config(), r, ackmodel.OpTypeDelete, sourceVarName, targetVarName, indentLevel)
 		},
 		"GoCodeSetSDKForStruct": func(r *ackmodel.CRD, targetFieldName string, targetVarName string, targetShapeRef *awssdkmodel.ShapeRef, sourceFieldPath string, sourceVarName string, indentLevel int) (string, error) {
-			return code.SetSDKForStruct(r.Config(), r, targetFieldName, targetVarName, targetShapeRef, sourceFieldPath, sourceVarName, model.OpTypeList, indentLevel)
+			// Empty resourceVarName: SetSDKForStruct derives it from the
+			// leading token of sourceVarName when invoked as an entry point.
+			return code.SetSDKForStruct(r.Config(), r, "", targetFieldName, targetVarName, targetShapeRef, sourceFieldPath, sourceVarName, model.OpTypeList, indentLevel)
 		},
 		"GoCodeSetResourceForStruct": func(r *ackmodel.CRD, targetFieldName string, targetVarName string, targetShapeRef *awssdkmodel.ShapeRef, sourceVarName string, sourceShapeRef *awssdkmodel.ShapeRef, indentLevel int) (string, error) {
 			var setCfg *ackgenconfig.SetFieldConfig = nil

pkg/generate/code/set_sdk.go

@@ -119,6 +119,16 @@ func SetSDK(
 	out := "\n"
 	indent := strings.Repeat("\t", indentLevel)
 
+	// The owning resource variable, used so secret fields can pass it to the
+	// runtime's SecretValueFromReference (which sets the cross-namespace
+	// deprecation ACK.Advisory condition on it). It is the leading token of
+	// the source variable path (e.g. "r" from "r.ko"); the generated
+	// *resource type implements acktypes.ConditionManager.
+	resourceVarName := sourceVarName
+	if dot := strings.IndexByte(resourceVarName, '.'); dot != -1 {
+		resourceVarName = resourceVarName[:dot]
+	}
+
 	// Check if there's an input wrapper field path configured. If so, we need
 	// to create a wrapper struct and populate its fields from the CRD spec,
 	// then assign the wrapper to the input shape's wrapper field.
@@ -402,6 +412,7 @@ func SetSDK(
 				)
 				containerOut, err := setSDKForContainer(
 					cfg, r,
+					resourceVarName,
 					memberName,
 					memberVarName,
 					sourceFieldPath,
@@ -430,6 +441,7 @@ func SetSDK(
 			if r.IsSecretField(memberName) {
 				out += setSDKForSecret(
 					cfg, r,
+					resourceVarName,
 					memberName,
 					targetVarName,
 					sourceAdaptedVarName,
@@ -1005,6 +1017,10 @@ func setSDKReadMany(
 func setSDKForContainer(
 	cfg *ackgenconfig.Config,
 	r *model.CRD,
+	// The name of the variable holding the owning resource (a *resource,
+	// which implements acktypes.ConditionManager). Threaded down so secret
+	// fields nested in collections can pass it to SecretValueFromReference.
+	resourceVarName string,
 	// The name of the SDK Input shape member we're outputting for
 	targetFieldName string,
 	// The variable name that we want to set a value to
@@ -1023,6 +1039,7 @@ func setSDKForContainer(
 	case "structure":
 		return SetSDKForStruct(
 			cfg, r,
+			resourceVarName,
 			targetFieldName,
 			targetVarName,
 			targetShapeRef,
@@ -1034,6 +1051,7 @@ func setSDKForContainer(
 	case "list":
 		return setSDKForSlice(
 			cfg, r,
+			resourceVarName,
 			targetFieldName,
 			targetVarName,
 			targetShapeRef,
@@ -1045,6 +1063,7 @@ func setSDKForContainer(
 	case "map":
 		return setSDKForMap(
 			cfg, r,
+			resourceVarName,
 			targetFieldName,
 			targetVarName,
 			targetShapeRef,
@@ -1056,6 +1075,7 @@ func setSDKForContainer(
 	case "union":
 		return setSDKForUnion(
 			cfg, r,
+			resourceVarName,
 			targetFieldName,
 			targetVarName,
 			targetShapeRef,
@@ -1074,6 +1094,7 @@ func setSDKForContainer(
 			)
 			out += setSDKForSecret(
 				cfg, r,
+				resourceVarName,
 				"",
 				targetVarName,
 				sourceVarName,
@@ -1101,14 +1122,17 @@ func setSDKForContainer(
 // the value of a Secret when the type of the source variable is a
 // SecretKeyReference.
 //
-// Cross-namespace validation (and the Phase 1 deprecation warning) is
-// performed inside the runtime's SecretValueFromReference, so it is not
-// emitted here. This ensures every caller is covered, including custom
-// update functions and hooks that call SecretValueFromReference directly.
+// Cross-namespace validation (and the Phase 1 deprecation notice) is performed
+// inside the runtime's SecretValueFromReference, so it is not emitted here.
+// This ensures every caller is covered, including custom update functions and
+// hooks that call SecretValueFromReference directly. The owning resource is
+// passed as the second argument so the runtime can set the cross-namespace
+// deprecation ACK.Advisory condition on it; it is derived from the source
+// variable (e.g. "r" from "r.ko.Spec.MasterUserPassword").
 //
 // The Go code output from this function looks like this:
 //
-//     tmpSecret, err := rm.rr.SecretValueFromReference(ctx, ko.Spec.MasterUserPassword)
+//     tmpSecret, err := rm.rr.SecretValueFromReference(ctx, r, r.ko.Spec.MasterUserPassword)
 //     if err != nil {
 //         return nil, ackrequeue.Needed(err)
 //     }
@@ -1122,6 +1146,11 @@ func setSDKForContainer(
 func setSDKForSecret(
 	cfg *ackgenconfig.Config,
 	r *model.CRD,
+	// The name of the variable holding the owning resource (a
+	// *resource, which implements acktypes.ConditionManager). It is passed to
+	// SecretValueFromReference so the runtime can set the cross-namespace
+	// deprecation ACK.Advisory condition on it. Typically "r" or "desired".
+	resourceVarName string,
 	// The name of the SDK Shape field we're setting
 	targetFieldName string,
 	// The variable name that we want to set a value on
@@ -1138,12 +1167,14 @@ func setSDKForSecret(
 	// Cross-namespace validation for the secret reference is performed inside
 	// the runtime's SecretValueFromReference, so that every call site is
 	// covered (including custom update functions and hooks). No per-call
-	// validation is generated here.
+	// validation is generated here. The owning resource is passed so the
+	// runtime can set the cross-namespace deprecation ACK.Advisory condition
+	// on it.
 
-	//     tmpSecret, err := rm.rr.SecretValueFromReference(ctx, ko.Spec.MasterUserPassword)
+	//     tmpSecret, err := rm.rr.SecretValueFromReference(ctx, r, r.ko.Spec.MasterUserPassword)
 	out += fmt.Sprintf(
-		"%s\t%s, err := rm.rr.SecretValueFromReference(ctx, %s)\n",
-		indent, secVar, sourceVarName,
+		"%s\t%s, err := rm.rr.SecretValueFromReference(ctx, %s, %s)\n",
+		indent, secVar, resourceVarName, sourceVarName,
 	)
 	//     if err != nil {
 	//         return nil, ackrequeue.Needed(err)
@@ -1175,6 +1206,12 @@ func setSDKForSecret(
 func SetSDKForStruct(
 	cfg *ackgenconfig.Config,
 	r *model.CRD,
+	// The name of the variable holding the owning resource (a *resource,
+	// which implements acktypes.ConditionManager). Threaded down so secret
+	// fields nested in this struct can pass it to SecretValueFromReference.
+	// When this is the entry point (e.g. the GoCodeSetSDKForStruct template
+	// helper), it is derived from the leading token of sourceVarName.
+	resourceVarName string,
 	// The name of the CR field we're outputting for
 	targetFieldName string,
 	// The variable name that we want to set a value to
@@ -1191,6 +1228,16 @@ func SetSDKForStruct(
 	out := ""
 	indent := strings.Repeat("\t", indentLevel)
 	targetShape := targetShapeRef.Shape
+	// When SetSDKForStruct is invoked as a top-level entry point (rather than
+	// recursively via setSDKForContainer), resourceVarName is not supplied by
+	// the caller. Fall back to the leading token of the source variable path
+	// (e.g. "r" from "r.ko.Spec.Foo"), which names the owning *resource.
+	if resourceVarName == "" {
+		resourceVarName = sourceVarName
+		if dot := strings.IndexByte(resourceVarName, '.'); dot != -1 {
+			resourceVarName = resourceVarName[:dot]
+		}
+	}
 
 	for memberIndex, memberName := range targetShape.MemberNames() {
 		memberShapeRef := targetShape.MemberRefs[memberName]
@@ -1248,6 +1295,7 @@ func SetSDKForStruct(
 				)
 				containerOut, err := setSDKForContainer(
 					cfg, r,
+					resourceVarName,
 					memberName,
 					memberVarName,
 					memberFieldPath,
@@ -1276,6 +1324,7 @@ func SetSDKForStruct(
 			if r.IsSecretField(memberFieldPath) {
 				out += setSDKForSecret(
 					cfg, r,
+					resourceVarName,
 					memberName,
 					targetVarName,
 					sourceAdaptedVarName,
@@ -1310,6 +1359,10 @@ func SetSDKForStruct(
 func setSDKForSlice(
 	cfg *ackgenconfig.Config,
 	r *model.CRD,
+	// The name of the variable holding the owning resource (a *resource,
+	// which implements acktypes.ConditionManager). Threaded down so secret
+	// fields nested in this slice can pass it to SecretValueFromReference.
+	resourceVarName string,
 	// The name of the CR field we're outputting for
 	targetFieldName string,
 	// The variable name that we want to set a value to
@@ -1382,6 +1435,7 @@ func setSDKForSlice(
 	} else {
 		containerOut, err := setSDKForContainer(
 			cfg, r,
+			resourceVarName,
 			containerFieldName,
 			elemVarName,
 			sourceFieldPath,
@@ -1414,6 +1468,10 @@ func setSDKForSlice(
 func setSDKForMap(
 	cfg *ackgenconfig.Config,
 	r *model.CRD,
+	// The name of the variable holding the owning resource (a *resource,
+	// which implements acktypes.ConditionManager). Threaded down so secret
+	// fields nested in this map can pass it to SecretValueFromReference.
+	resourceVarName string,
 	// The name of the CR field we're outputting for
 	targetFieldName string,
 	// The variable name that we want to set a value to
@@ -1481,6 +1539,7 @@ func setSDKForMap(
 	} else {
 		containerOut, err := setSDKForContainer(
 			cfg, r,
+			resourceVarName,
 			containerFieldName,
 			valVarName,
 			sourceFieldPath,
@@ -1844,6 +1903,10 @@ func resolveAWSMapValueType(valueType string) string {
 func setSDKForUnion(
 	cfg *ackgenconfig.Config,
 	r *model.CRD,
+	// The name of the variable holding the owning resource (a *resource,
+	// which implements acktypes.ConditionManager). Threaded down so secret
+	// fields nested in this union can pass it to SecretValueFromReference.
+	resourceVarName string,
 	// The name of the CR field we're outputting for
 	targetFieldName string,
 	// The variable name that we want to set a value to
@@ -1929,6 +1992,7 @@ func setSDKForUnion(
 				)
 				containerOut, err := setSDKForContainer(
 					cfg, r,
+					resourceVarName,
 					memberName,
 					indexedVarName,
 					memberFieldPath,

pkg/generate/code/set_sdk_test.go

@@ -105,7 +105,7 @@ func TestSetSDK_MemoryDB_User_Create(t *testing.T) {
 			for _, f1f0iter := range r.ko.Spec.AuthenticationMode.Passwords {
 				var f1f0elem string
 				if f1f0iter != nil {
-					tmpSecret, err := rm.rr.SecretValueFromReference(ctx, f1f0iter)
+					tmpSecret, err := rm.rr.SecretValueFromReference(ctx, r, f1f0iter)
 					if err != nil {
 						return nil, ackrequeue.Needed(err)
 					}
@@ -208,7 +208,7 @@ func TestSetSDK_OpenSearch_Domain_Create(t *testing.T) {
 				f3f4.MasterUserName = r.ko.Spec.AdvancedSecurityOptions.MasterUserOptions.MasterUserName
 			}
 			if r.ko.Spec.AdvancedSecurityOptions.MasterUserOptions.MasterUserPassword != nil {
-				tmpSecret, err := rm.rr.SecretValueFromReference(ctx, r.ko.Spec.AdvancedSecurityOptions.MasterUserOptions.MasterUserPassword)
+				tmpSecret, err := rm.rr.SecretValueFromReference(ctx, r, r.ko.Spec.AdvancedSecurityOptions.MasterUserOptions.MasterUserPassword)
 				if err != nil {
 					return nil, ackrequeue.Needed(err)
 				}
@@ -841,7 +841,7 @@ func TestSetSDK_ECR_Repository_Create(t *testing.T) {
 // 		res.SetAtRestEncryptionEnabled(*r.ko.Spec.AtRestEncryptionEnabled)
 // 	}
 // 	if r.ko.Spec.AuthToken != nil {
-// 		tmpSecret, err := rm.rr.SecretValueFromReference(ctx, r.ko.Spec.AuthToken)
+// 		tmpSecret, err := rm.rr.SecretValueFromReference(ctx, r, r.ko.Spec.AuthToken)
 // 		if err != nil {
 // 			return nil, ackrequeue.Needed(err)
 // 		}
@@ -1096,7 +1096,7 @@ func TestSetSDK_ECR_Repository_Create(t *testing.T) {
 // 	expected := `
 // 	res.SetApplyImmediately(true)
 // 	if r.ko.Spec.AuthToken != nil {
-// 		tmpSecret, err := rm.rr.SecretValueFromReference(ctx, r.ko.Spec.AuthToken)
+// 		tmpSecret, err := rm.rr.SecretValueFromReference(ctx, r, r.ko.Spec.AuthToken)
 // 		if err != nil {
 // 			return nil, ackrequeue.Needed(err)
 // 		}
@@ -1218,7 +1218,7 @@ func TestSetSDK_ECR_Repository_Create(t *testing.T) {
 // 		for _, f3iter := range r.ko.Spec.Passwords {
 // 			var f3elem string
 // 			if f3iter != nil {
-// 				tmpSecret, err := rm.rr.SecretValueFromReference(ctx, f3iter)
+// 				tmpSecret, err := rm.rr.SecretValueFromReference(ctx, r, f3iter)
 // 				if err != nil {
 // 					return nil, ackrequeue.Needed(err)
 // 				}
@@ -1489,7 +1489,7 @@ func TestSetSDK_RDS_DBInstance_Create(t *testing.T) {
 		res.ManageMasterUserPassword = r.ko.Spec.ManageMasterUserPassword
 	}
 	if r.ko.Spec.MasterUserPassword != nil {
-		tmpSecret, err := rm.rr.SecretValueFromReference(ctx, r.ko.Spec.MasterUserPassword)
+		tmpSecret, err := rm.rr.SecretValueFromReference(ctx, r, r.ko.Spec.MasterUserPassword)
 		if err != nil {
 			return nil, ackrequeue.Needed(err)
 		}
@@ -1779,7 +1779,7 @@ func TestSetSDK_RDS_DBInstance_Update(t *testing.T) {
 	}
 	if delta.DifferentAt("Spec.MasterUserPassword") {
 		if r.ko.Spec.MasterUserPassword != nil {
-			tmpSecret, err := rm.rr.SecretValueFromReference(ctx, r.ko.Spec.MasterUserPassword)
+			tmpSecret, err := rm.rr.SecretValueFromReference(ctx, r, r.ko.Spec.MasterUserPassword)
 			if err != nil {
 				return nil, ackrequeue.Needed(err)
 			}
@@ -2318,7 +2318,7 @@ func TestSetSDK_MQ_Broker_Create(t *testing.T) {
 				f18elem.Groups = aws.ToStringSlice(f18iter.Groups)
 			}
 			if f18iter.Password != nil {
-				tmpSecret, err := rm.rr.SecretValueFromReference(ctx, f18iter.Password)
+				tmpSecret, err := rm.rr.SecretValueFromReference(ctx, r, f18iter.Password)
 				if err != nil {
 					return nil, ackrequeue.Needed(err)
 				}
@@ -4669,7 +4669,7 @@ func TestSetSDK_Lambda_Function_EnvironmentVariable_MapOfSecrets_Create(t *testi
 			for f4f0key, f4f0valiter := range r.ko.Spec.Environment.Variables {
 				var f4f0val string
 				if f4f0valiter != nil {
-					tmpSecret, err := rm.rr.SecretValueFromReference(ctx, f4f0valiter)
+					tmpSecret, err := rm.rr.SecretValueFromReference(ctx, r, f4f0valiter)
 					if err != nil {
 						return nil, ackrequeue.Needed(err)
 					}
@@ -4806,7 +4806,7 @@ func TestSetSDK_Lambda_Function_EnvironmentVariable_MapOfSecrets_Update(t *testi
 			for f2f0key, f2f0valiter := range r.ko.Spec.Environment.Variables {
 				var f2f0val string
 				if f2f0valiter != nil {
-					tmpSecret, err := rm.rr.SecretValueFromReference(ctx, f2f0valiter)
+					tmpSecret, err := rm.rr.SecretValueFromReference(ctx, r, f2f0valiter)
 					if err != nil {
 						return nil, ackrequeue.Needed(err)
 					}