Revert: emit unchanged SecretValueFromReference call; re-pin runtime

The runtime change reverted the SecretValueFromReference signature back to
(ctx, ref) and restored the context-stash mechanism, so a breaking signature
change is no longer forced on hand-written controller callers (e.g.
rds-controller db_cluster/custom_update.go).

Accordingly, revert the generated-code change: setSDKForSecret again emits
rm.rr.SecretValueFromReference(ctx, <source>) with no resource-var threading,
and the setSDKForContainer/Struct/Slice/Map/Union helpers drop the
resourceVarName parameter. Re-pin the runtime replace directive to the amended
fork commit (9bb3e73).

Author: sapphirew

go.mod

@@ -104,4 +104,4 @@ require (
 	sigs.k8s.io/structured-merge-diff/v6 v6.3.0 // indirect
 )
 
-replace github.com/aws-controllers-k8s/runtime => github.com/sapphirew/ack-runtime v0.0.0-20260607093755-4ee0bc56d816
+replace github.com/aws-controllers-k8s/runtime => github.com/sapphirew/ack-runtime v0.0.0-20260608212517-9bb3e738fe97

go.sum

@@ -512,8 +512,8 @@ github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQD
 github.com/ryanuber/columnize v0.0.0-20160712163229-9b3edd62028f/go.mod h1:sm1tb6uqfes/u+d4ooFouqFdy9/2g9QGwK3SQygK0Ts=
 github.com/samber/lo v1.37.0 h1:XjVcB8g6tgUp8rsPsJ2CvhClfImrpL04YpQHXeHPhRw=
 github.com/samber/lo v1.37.0/go.mod h1:9vaz2O4o8oOnK23pd2TrXufcbdbJIa3b6cstBWKpopA=
-github.com/sapphirew/ack-runtime v0.0.0-20260607093755-4ee0bc56d816 h1:ZBmQHpcjrv+wmqublik4Mjf8jxG9W+gndnV5JpUU5v0=
-github.com/sapphirew/ack-runtime v0.0.0-20260607093755-4ee0bc56d816/go.mod h1:ljWD1IdtVx/qC7C4lVobF4vLNhno/xX5A78BOke1Ksk=
+github.com/sapphirew/ack-runtime v0.0.0-20260608212517-9bb3e738fe97 h1:l58zGokUaqMvnateGrtzKcGIrOSd7fnap+g+Cxeijd4=
+github.com/sapphirew/ack-runtime v0.0.0-20260608212517-9bb3e738fe97/go.mod h1:ljWD1IdtVx/qC7C4lVobF4vLNhno/xX5A78BOke1Ksk=
 github.com/sean-/seed v0.0.0-20170313163322-e2103e2c3529/go.mod h1:DxrIzT+xaE7yg65j358z/aeFdxmN0P9QXhEzd20vsDc=
 github.com/sergi/go-diff v1.0.0/go.mod h1:0CfEIISq7TuYL3j771MWULgwwjU+GofnZX9QAmXWZgo=
 github.com/shurcooL/sanitized_anchor_name v1.0.0/go.mod h1:1NzhyTcUVG4SuEtjjoZeVRXNmyL/1OwPU0+IJeTBvfc=

pkg/generate/ack/controller.go

@@ -124,9 +124,7 @@ var (
 			return code.SetSDK(r.Config(), r, ackmodel.OpTypeDelete, sourceVarName, targetVarName, indentLevel)
 		},
 		"GoCodeSetSDKForStruct": func(r *ackmodel.CRD, targetFieldName string, targetVarName string, targetShapeRef *awssdkmodel.ShapeRef, sourceFieldPath string, sourceVarName string, indentLevel int) (string, error) {
-			// Empty resourceVarName: SetSDKForStruct derives it from the
-			// leading token of sourceVarName when invoked as an entry point.
-			return code.SetSDKForStruct(r.Config(), r, "", targetFieldName, targetVarName, targetShapeRef, sourceFieldPath, sourceVarName, model.OpTypeList, indentLevel)
+			return code.SetSDKForStruct(r.Config(), r, targetFieldName, targetVarName, targetShapeRef, sourceFieldPath, sourceVarName, model.OpTypeList, indentLevel)
 		},
 		"GoCodeSetResourceForStruct": func(r *ackmodel.CRD, targetFieldName string, targetVarName string, targetShapeRef *awssdkmodel.ShapeRef, sourceVarName string, sourceShapeRef *awssdkmodel.ShapeRef, indentLevel int) (string, error) {
 			var setCfg *ackgenconfig.SetFieldConfig = nil

pkg/generate/code/set_sdk.go

@@ -119,16 +119,6 @@ func SetSDK(
 	out := "\n"
 	indent := strings.Repeat("\t", indentLevel)
 
-	// The owning resource variable, used so secret fields can pass it to the
-	// runtime's SecretValueFromReference (which sets the cross-namespace
-	// deprecation ACK.Advisory condition on it). It is the leading token of
-	// the source variable path (e.g. "r" from "r.ko"); the generated
-	// *resource type implements acktypes.ConditionManager.
-	resourceVarName := sourceVarName
-	if dot := strings.IndexByte(resourceVarName, '.'); dot != -1 {
-		resourceVarName = resourceVarName[:dot]
-	}
-
 	// Check if there's an input wrapper field path configured. If so, we need
 	// to create a wrapper struct and populate its fields from the CRD spec,
 	// then assign the wrapper to the input shape's wrapper field.
@@ -412,7 +402,6 @@ func SetSDK(
 				)
 				containerOut, err := setSDKForContainer(
 					cfg, r,
-					resourceVarName,
 					memberName,
 					memberVarName,
 					sourceFieldPath,
@@ -441,7 +430,6 @@ func SetSDK(
 			if r.IsSecretField(memberName) {
 				out += setSDKForSecret(
 					cfg, r,
-					resourceVarName,
 					memberName,
 					targetVarName,
 					sourceAdaptedVarName,
@@ -1017,10 +1005,6 @@ func setSDKReadMany(
 func setSDKForContainer(
 	cfg *ackgenconfig.Config,
 	r *model.CRD,
-	// The name of the variable holding the owning resource (a *resource,
-	// which implements acktypes.ConditionManager). Threaded down so secret
-	// fields nested in collections can pass it to SecretValueFromReference.
-	resourceVarName string,
 	// The name of the SDK Input shape member we're outputting for
 	targetFieldName string,
 	// The variable name that we want to set a value to
@@ -1039,7 +1023,6 @@ func setSDKForContainer(
 	case "structure":
 		return SetSDKForStruct(
 			cfg, r,
-			resourceVarName,
 			targetFieldName,
 			targetVarName,
 			targetShapeRef,
@@ -1051,7 +1034,6 @@ func setSDKForContainer(
 	case "list":
 		return setSDKForSlice(
 			cfg, r,
-			resourceVarName,
 			targetFieldName,
 			targetVarName,
 			targetShapeRef,
@@ -1063,7 +1045,6 @@ func setSDKForContainer(
 	case "map":
 		return setSDKForMap(
 			cfg, r,
-			resourceVarName,
 			targetFieldName,
 			targetVarName,
 			targetShapeRef,
@@ -1075,7 +1056,6 @@ func setSDKForContainer(
 	case "union":
 		return setSDKForUnion(
 			cfg, r,
-			resourceVarName,
 			targetFieldName,
 			targetVarName,
 			targetShapeRef,
@@ -1094,7 +1074,6 @@ func setSDKForContainer(
 			)
 			out += setSDKForSecret(
 				cfg, r,
-				resourceVarName,
 				"",
 				targetVarName,
 				sourceVarName,
@@ -1122,17 +1101,14 @@ func setSDKForContainer(
 // the value of a Secret when the type of the source variable is a
 // SecretKeyReference.
 //
-// Cross-namespace validation (and the Phase 1 deprecation notice) is performed
-// inside the runtime's SecretValueFromReference, so it is not emitted here.
-// This ensures every caller is covered, including custom update functions and
-// hooks that call SecretValueFromReference directly. The owning resource is
-// passed as the second argument so the runtime can set the cross-namespace
-// deprecation ACK.Advisory condition on it; it is derived from the source
-// variable (e.g. "r" from "r.ko.Spec.MasterUserPassword").
+// Cross-namespace validation (and the Phase 1 deprecation warning) is
+// performed inside the runtime's SecretValueFromReference, so it is not
+// emitted here. This ensures every caller is covered, including custom
+// update functions and hooks that call SecretValueFromReference directly.
 //
 // The Go code output from this function looks like this:
 //
-//     tmpSecret, err := rm.rr.SecretValueFromReference(ctx, r, r.ko.Spec.MasterUserPassword)
+//     tmpSecret, err := rm.rr.SecretValueFromReference(ctx, ko.Spec.MasterUserPassword)
 //     if err != nil {
 //         return nil, ackrequeue.Needed(err)
 //     }
@@ -1146,11 +1122,6 @@ func setSDKForContainer(
 func setSDKForSecret(
 	cfg *ackgenconfig.Config,
 	r *model.CRD,
-	// The name of the variable holding the owning resource (a
-	// *resource, which implements acktypes.ConditionManager). It is passed to
-	// SecretValueFromReference so the runtime can set the cross-namespace
-	// deprecation ACK.Advisory condition on it. Typically "r" or "desired".
-	resourceVarName string,
 	// The name of the SDK Shape field we're setting
 	targetFieldName string,
 	// The variable name that we want to set a value on
@@ -1167,14 +1138,12 @@ func setSDKForSecret(
 	// Cross-namespace validation for the secret reference is performed inside
 	// the runtime's SecretValueFromReference, so that every call site is
 	// covered (including custom update functions and hooks). No per-call
-	// validation is generated here. The owning resource is passed so the
-	// runtime can set the cross-namespace deprecation ACK.Advisory condition
-	// on it.
+	// validation is generated here.
 
-	//     tmpSecret, err := rm.rr.SecretValueFromReference(ctx, r, r.ko.Spec.MasterUserPassword)
+	//     tmpSecret, err := rm.rr.SecretValueFromReference(ctx, ko.Spec.MasterUserPassword)
 	out += fmt.Sprintf(
-		"%s\t%s, err := rm.rr.SecretValueFromReference(ctx, %s, %s)\n",
-		indent, secVar, resourceVarName, sourceVarName,
+		"%s\t%s, err := rm.rr.SecretValueFromReference(ctx, %s)\n",
+		indent, secVar, sourceVarName,
 	)
 	//     if err != nil {
 	//         return nil, ackrequeue.Needed(err)
@@ -1206,12 +1175,6 @@ func setSDKForSecret(
 func SetSDKForStruct(
 	cfg *ackgenconfig.Config,
 	r *model.CRD,
-	// The name of the variable holding the owning resource (a *resource,
-	// which implements acktypes.ConditionManager). Threaded down so secret
-	// fields nested in this struct can pass it to SecretValueFromReference.
-	// When this is the entry point (e.g. the GoCodeSetSDKForStruct template
-	// helper), it is derived from the leading token of sourceVarName.
-	resourceVarName string,
 	// The name of the CR field we're outputting for
 	targetFieldName string,
 	// The variable name that we want to set a value to
@@ -1228,16 +1191,6 @@ func SetSDKForStruct(
 	out := ""
 	indent := strings.Repeat("\t", indentLevel)
 	targetShape := targetShapeRef.Shape
-	// When SetSDKForStruct is invoked as a top-level entry point (rather than
-	// recursively via setSDKForContainer), resourceVarName is not supplied by
-	// the caller. Fall back to the leading token of the source variable path
-	// (e.g. "r" from "r.ko.Spec.Foo"), which names the owning *resource.
-	if resourceVarName == "" {
-		resourceVarName = sourceVarName
-		if dot := strings.IndexByte(resourceVarName, '.'); dot != -1 {
-			resourceVarName = resourceVarName[:dot]
-		}
-	}
 
 	for memberIndex, memberName := range targetShape.MemberNames() {
 		memberShapeRef := targetShape.MemberRefs[memberName]
@@ -1295,7 +1248,6 @@ func SetSDKForStruct(
 				)
 				containerOut, err := setSDKForContainer(
 					cfg, r,
-					resourceVarName,
 					memberName,
 					memberVarName,
 					memberFieldPath,
@@ -1324,7 +1276,6 @@ func SetSDKForStruct(
 			if r.IsSecretField(memberFieldPath) {
 				out += setSDKForSecret(
 					cfg, r,
-					resourceVarName,
 					memberName,
 					targetVarName,
 					sourceAdaptedVarName,
@@ -1359,10 +1310,6 @@ func SetSDKForStruct(
 func setSDKForSlice(
 	cfg *ackgenconfig.Config,
 	r *model.CRD,
-	// The name of the variable holding the owning resource (a *resource,
-	// which implements acktypes.ConditionManager). Threaded down so secret
-	// fields nested in this slice can pass it to SecretValueFromReference.
-	resourceVarName string,
 	// The name of the CR field we're outputting for
 	targetFieldName string,
 	// The variable name that we want to set a value to
@@ -1435,7 +1382,6 @@ func setSDKForSlice(
 	} else {
 		containerOut, err := setSDKForContainer(
 			cfg, r,
-			resourceVarName,
 			containerFieldName,
 			elemVarName,
 			sourceFieldPath,
@@ -1468,10 +1414,6 @@ func setSDKForSlice(
 func setSDKForMap(
 	cfg *ackgenconfig.Config,
 	r *model.CRD,
-	// The name of the variable holding the owning resource (a *resource,
-	// which implements acktypes.ConditionManager). Threaded down so secret
-	// fields nested in this map can pass it to SecretValueFromReference.
-	resourceVarName string,
 	// The name of the CR field we're outputting for
 	targetFieldName string,
 	// The variable name that we want to set a value to
@@ -1539,7 +1481,6 @@ func setSDKForMap(
 	} else {
 		containerOut, err := setSDKForContainer(
 			cfg, r,
-			resourceVarName,
 			containerFieldName,
 			valVarName,
 			sourceFieldPath,
@@ -1903,10 +1844,6 @@ func resolveAWSMapValueType(valueType string) string {
 func setSDKForUnion(
 	cfg *ackgenconfig.Config,
 	r *model.CRD,
-	// The name of the variable holding the owning resource (a *resource,
-	// which implements acktypes.ConditionManager). Threaded down so secret
-	// fields nested in this union can pass it to SecretValueFromReference.
-	resourceVarName string,
 	// The name of the CR field we're outputting for
 	targetFieldName string,
 	// The variable name that we want to set a value to
@@ -1992,7 +1929,6 @@ func setSDKForUnion(
 				)
 				containerOut, err := setSDKForContainer(
 					cfg, r,
-					resourceVarName,
 					memberName,
 					indexedVarName,
 					memberFieldPath,

pkg/generate/code/set_sdk_test.go

@@ -105,7 +105,7 @@ func TestSetSDK_MemoryDB_User_Create(t *testing.T) {
 			for _, f1f0iter := range r.ko.Spec.AuthenticationMode.Passwords {
 				var f1f0elem string
 				if f1f0iter != nil {
-					tmpSecret, err := rm.rr.SecretValueFromReference(ctx, r, f1f0iter)
+					tmpSecret, err := rm.rr.SecretValueFromReference(ctx, f1f0iter)
 					if err != nil {
 						return nil, ackrequeue.Needed(err)
 					}
@@ -208,7 +208,7 @@ func TestSetSDK_OpenSearch_Domain_Create(t *testing.T) {
 				f3f4.MasterUserName = r.ko.Spec.AdvancedSecurityOptions.MasterUserOptions.MasterUserName
 			}
 			if r.ko.Spec.AdvancedSecurityOptions.MasterUserOptions.MasterUserPassword != nil {
-				tmpSecret, err := rm.rr.SecretValueFromReference(ctx, r, r.ko.Spec.AdvancedSecurityOptions.MasterUserOptions.MasterUserPassword)
+				tmpSecret, err := rm.rr.SecretValueFromReference(ctx, r.ko.Spec.AdvancedSecurityOptions.MasterUserOptions.MasterUserPassword)
 				if err != nil {
 					return nil, ackrequeue.Needed(err)
 				}
@@ -841,7 +841,7 @@ func TestSetSDK_ECR_Repository_Create(t *testing.T) {
 // 		res.SetAtRestEncryptionEnabled(*r.ko.Spec.AtRestEncryptionEnabled)
 // 	}
 // 	if r.ko.Spec.AuthToken != nil {
-// 		tmpSecret, err := rm.rr.SecretValueFromReference(ctx, r, r.ko.Spec.AuthToken)
+// 		tmpSecret, err := rm.rr.SecretValueFromReference(ctx, r.ko.Spec.AuthToken)
 // 		if err != nil {
 // 			return nil, ackrequeue.Needed(err)
 // 		}
@@ -1096,7 +1096,7 @@ func TestSetSDK_ECR_Repository_Create(t *testing.T) {
 // 	expected := `
 // 	res.SetApplyImmediately(true)
 // 	if r.ko.Spec.AuthToken != nil {
-// 		tmpSecret, err := rm.rr.SecretValueFromReference(ctx, r, r.ko.Spec.AuthToken)
+// 		tmpSecret, err := rm.rr.SecretValueFromReference(ctx, r.ko.Spec.AuthToken)
 // 		if err != nil {
 // 			return nil, ackrequeue.Needed(err)
 // 		}
@@ -1218,7 +1218,7 @@ func TestSetSDK_ECR_Repository_Create(t *testing.T) {
 // 		for _, f3iter := range r.ko.Spec.Passwords {
 // 			var f3elem string
 // 			if f3iter != nil {
-// 				tmpSecret, err := rm.rr.SecretValueFromReference(ctx, r, f3iter)
+// 				tmpSecret, err := rm.rr.SecretValueFromReference(ctx, f3iter)
 // 				if err != nil {
 // 					return nil, ackrequeue.Needed(err)
 // 				}
@@ -1489,7 +1489,7 @@ func TestSetSDK_RDS_DBInstance_Create(t *testing.T) {
 		res.ManageMasterUserPassword = r.ko.Spec.ManageMasterUserPassword
 	}
 	if r.ko.Spec.MasterUserPassword != nil {
-		tmpSecret, err := rm.rr.SecretValueFromReference(ctx, r, r.ko.Spec.MasterUserPassword)
+		tmpSecret, err := rm.rr.SecretValueFromReference(ctx, r.ko.Spec.MasterUserPassword)
 		if err != nil {
 			return nil, ackrequeue.Needed(err)
 		}
@@ -1779,7 +1779,7 @@ func TestSetSDK_RDS_DBInstance_Update(t *testing.T) {
 	}
 	if delta.DifferentAt("Spec.MasterUserPassword") {
 		if r.ko.Spec.MasterUserPassword != nil {
-			tmpSecret, err := rm.rr.SecretValueFromReference(ctx, r, r.ko.Spec.MasterUserPassword)
+			tmpSecret, err := rm.rr.SecretValueFromReference(ctx, r.ko.Spec.MasterUserPassword)
 			if err != nil {
 				return nil, ackrequeue.Needed(err)
 			}
@@ -2318,7 +2318,7 @@ func TestSetSDK_MQ_Broker_Create(t *testing.T) {
 				f18elem.Groups = aws.ToStringSlice(f18iter.Groups)
 			}
 			if f18iter.Password != nil {
-				tmpSecret, err := rm.rr.SecretValueFromReference(ctx, r, f18iter.Password)
+				tmpSecret, err := rm.rr.SecretValueFromReference(ctx, f18iter.Password)
 				if err != nil {
 					return nil, ackrequeue.Needed(err)
 				}
@@ -4669,7 +4669,7 @@ func TestSetSDK_Lambda_Function_EnvironmentVariable_MapOfSecrets_Create(t *testi
 			for f4f0key, f4f0valiter := range r.ko.Spec.Environment.Variables {
 				var f4f0val string
 				if f4f0valiter != nil {
-					tmpSecret, err := rm.rr.SecretValueFromReference(ctx, r, f4f0valiter)
+					tmpSecret, err := rm.rr.SecretValueFromReference(ctx, f4f0valiter)
 					if err != nil {
 						return nil, ackrequeue.Needed(err)
 					}
@@ -4806,7 +4806,7 @@ func TestSetSDK_Lambda_Function_EnvironmentVariable_MapOfSecrets_Update(t *testi
 			for f2f0key, f2f0valiter := range r.ko.Spec.Environment.Variables {
 				var f2f0val string
 				if f2f0valiter != nil {
-					tmpSecret, err := rm.rr.SecretValueFromReference(ctx, r, f2f0valiter)
+					tmpSecret, err := rm.rr.SecretValueFromReference(ctx, f2f0valiter)
 					if err != nil {
 						return nil, ackrequeue.Needed(err)
 					}