fix: Move secret cross-namespace validation into runtime

Drop the per-call secret validation block from generated sdk.go. The
generated code only wrapped SecretValueFromReference call sites in
sdk.go, missing custom update functions (e.g. RDS db_cluster) and hooks
that call SecretValueFromReference directly.

Validation now lives entirely in the runtime's SecretValueFromReference
(aws-controllers-k8s/runtime), so every caller is covered without
generated boilerplate.

- set_sdk.go: generated secret code reverts to a plain
  SecretValueFromReference call; no ResolveCrossNamespaceReferenceString
- sdk.go.tpl: drop the now-unused ackrt import and its suppression entry
- set_sdk_test.go: remove the validation block from 7 expected outputs

Addresses review feedback from knottnt on #699.

Author: sapphirew

pkg/generate/code/set_sdk.go

@@ -1099,25 +1099,15 @@ func setSDKForContainer(
 
 // setSDKForSecret returns a string of Go code that sets a target variable to
 // the value of a Secret when the type of the source variable is a
-// SecretKeyReference. It first calls ResolveCrossNamespaceReferenceString to
-// validate cross-namespace access (and emit a deprecation warning + condition
-// when the reference is cross-namespace), then fetches the secret value.
+// SecretKeyReference.
+//
+// Cross-namespace validation (and the Phase 1 deprecation warning) is
+// performed inside the runtime's SecretValueFromReference, so it is not
+// emitted here. This ensures every caller is covered, including custom
+// update functions and hooks that call SecretValueFromReference directly.
 //
 // The Go code output from this function looks like this:
 //
-//     secretNamespace, err := ackrt.ResolveCrossNamespaceReferenceString(
-//         ctx,
-//         rm.cfg.EnableCrossNamespace,
-//         &r.ko.Status.Conditions,
-//         ackrt.CrossNamespaceRefKindSecret,
-//         r.ko.ObjectMeta.GetNamespace(),
-//         ko.Spec.MasterUserPassword.Namespace,
-//         ko.Spec.MasterUserPassword.Name,
-//     )
-//     if err != nil {
-//         return nil, err
-//     }
-//     ko.Spec.MasterUserPassword.Namespace = secretNamespace
 //     tmpSecret, err := rm.rr.SecretValueFromReference(ctx, ko.Spec.MasterUserPassword)
 //     if err != nil {
 //         return nil, ackrequeue.Needed(err)
@@ -1145,33 +1135,10 @@ func setSDKForSecret(
 	indent := strings.Repeat("\t", indentLevel)
 	secVar := "tmpSecret"
 
-	// Resolve cross-namespace access before fetching the secret
-	//     secretNamespace, err := ackrt.ResolveCrossNamespaceReferenceString(
-	//         ctx,
-	//         rm.cfg.EnableCrossNamespace,
-	//         &r.ko.Status.Conditions,
-	//         ackrt.CrossNamespaceRefKindSecret,
-	//         r.ko.ObjectMeta.GetNamespace(),
-	//         sourceVarName.Namespace,
-	//         sourceVarName.Name,
-	//     )
-	out += fmt.Sprintf(
-		"%s\tsecretNamespace, err := ackrt.ResolveCrossNamespaceReferenceString(\n",
-		indent,
-	)
-	out += fmt.Sprintf("%s\t\tctx,\n", indent)
-	out += fmt.Sprintf("%s\t\trm.cfg.EnableCrossNamespace,\n", indent)
-	out += fmt.Sprintf("%s\t\t&r.ko.Status.Conditions,\n", indent)
-	out += fmt.Sprintf("%s\t\tackrt.CrossNamespaceRefKindSecret,\n", indent)
-	out += fmt.Sprintf("%s\t\tr.ko.ObjectMeta.GetNamespace(),\n", indent)
-	out += fmt.Sprintf("%s\t\t%s.Namespace,\n", indent, sourceVarName)
-	out += fmt.Sprintf("%s\t\t%s.Name,\n", indent, sourceVarName)
-	out += fmt.Sprintf("%s\t)\n", indent)
-	out += fmt.Sprintf("%s\tif err != nil {\n", indent)
-	out += fmt.Sprintf("%s\t\treturn nil, err\n", indent)
-	out += fmt.Sprintf("%s\t}\n", indent)
-	// Override the secret reference namespace with the resolved namespace
-	out += fmt.Sprintf("%s\t%s.Namespace = secretNamespace\n", indent, sourceVarName)
+	// Cross-namespace validation for the secret reference is performed inside
+	// the runtime's SecretValueFromReference, so that every call site is
+	// covered (including custom update functions and hooks). No per-call
+	// validation is generated here.
 
 	//     tmpSecret, err := rm.rr.SecretValueFromReference(ctx, ko.Spec.MasterUserPassword)
 	out += fmt.Sprintf(

pkg/generate/code/set_sdk_test.go

@@ -105,19 +105,6 @@ func TestSetSDK_MemoryDB_User_Create(t *testing.T) {
 			for _, f1f0iter := range r.ko.Spec.AuthenticationMode.Passwords {
 				var f1f0elem string
 				if f1f0iter != nil {
-					secretNamespace, err := ackrt.ResolveCrossNamespaceReferenceString(
-						ctx,
-						rm.cfg.EnableCrossNamespace,
-						&r.ko.Status.Conditions,
-						ackrt.CrossNamespaceRefKindSecret,
-						r.ko.ObjectMeta.GetNamespace(),
-						f1f0iter.Namespace,
-						f1f0iter.Name,
-					)
-					if err != nil {
-						return nil, err
-					}
-					f1f0iter.Namespace = secretNamespace
 					tmpSecret, err := rm.rr.SecretValueFromReference(ctx, f1f0iter)
 					if err != nil {
 						return nil, ackrequeue.Needed(err)
@@ -221,19 +208,6 @@ func TestSetSDK_OpenSearch_Domain_Create(t *testing.T) {
 				f3f4.MasterUserName = r.ko.Spec.AdvancedSecurityOptions.MasterUserOptions.MasterUserName
 			}
 			if r.ko.Spec.AdvancedSecurityOptions.MasterUserOptions.MasterUserPassword != nil {
-				secretNamespace, err := ackrt.ResolveCrossNamespaceReferenceString(
-					ctx,
-					rm.cfg.EnableCrossNamespace,
-					&r.ko.Status.Conditions,
-					ackrt.CrossNamespaceRefKindSecret,
-					r.ko.ObjectMeta.GetNamespace(),
-					r.ko.Spec.AdvancedSecurityOptions.MasterUserOptions.MasterUserPassword.Namespace,
-					r.ko.Spec.AdvancedSecurityOptions.MasterUserOptions.MasterUserPassword.Name,
-				)
-				if err != nil {
-					return nil, err
-				}
-				r.ko.Spec.AdvancedSecurityOptions.MasterUserOptions.MasterUserPassword.Namespace = secretNamespace
 				tmpSecret, err := rm.rr.SecretValueFromReference(ctx, r.ko.Spec.AdvancedSecurityOptions.MasterUserOptions.MasterUserPassword)
 				if err != nil {
 					return nil, ackrequeue.Needed(err)
@@ -1515,19 +1489,6 @@ func TestSetSDK_RDS_DBInstance_Create(t *testing.T) {
 		res.ManageMasterUserPassword = r.ko.Spec.ManageMasterUserPassword
 	}
 	if r.ko.Spec.MasterUserPassword != nil {
-		secretNamespace, err := ackrt.ResolveCrossNamespaceReferenceString(
-			ctx,
-			rm.cfg.EnableCrossNamespace,
-			&r.ko.Status.Conditions,
-			ackrt.CrossNamespaceRefKindSecret,
-			r.ko.ObjectMeta.GetNamespace(),
-			r.ko.Spec.MasterUserPassword.Namespace,
-			r.ko.Spec.MasterUserPassword.Name,
-		)
-		if err != nil {
-			return nil, err
-		}
-		r.ko.Spec.MasterUserPassword.Namespace = secretNamespace
 		tmpSecret, err := rm.rr.SecretValueFromReference(ctx, r.ko.Spec.MasterUserPassword)
 		if err != nil {
 			return nil, ackrequeue.Needed(err)
@@ -1818,19 +1779,6 @@ func TestSetSDK_RDS_DBInstance_Update(t *testing.T) {
 	}
 	if delta.DifferentAt("Spec.MasterUserPassword") {
 		if r.ko.Spec.MasterUserPassword != nil {
-			secretNamespace, err := ackrt.ResolveCrossNamespaceReferenceString(
-				ctx,
-				rm.cfg.EnableCrossNamespace,
-				&r.ko.Status.Conditions,
-				ackrt.CrossNamespaceRefKindSecret,
-				r.ko.ObjectMeta.GetNamespace(),
-				r.ko.Spec.MasterUserPassword.Namespace,
-				r.ko.Spec.MasterUserPassword.Name,
-			)
-			if err != nil {
-				return nil, err
-			}
-			r.ko.Spec.MasterUserPassword.Namespace = secretNamespace
 			tmpSecret, err := rm.rr.SecretValueFromReference(ctx, r.ko.Spec.MasterUserPassword)
 			if err != nil {
 				return nil, ackrequeue.Needed(err)
@@ -2370,19 +2318,6 @@ func TestSetSDK_MQ_Broker_Create(t *testing.T) {
 				f18elem.Groups = aws.ToStringSlice(f18iter.Groups)
 			}
 			if f18iter.Password != nil {
-				secretNamespace, err := ackrt.ResolveCrossNamespaceReferenceString(
-					ctx,
-					rm.cfg.EnableCrossNamespace,
-					&r.ko.Status.Conditions,
-					ackrt.CrossNamespaceRefKindSecret,
-					r.ko.ObjectMeta.GetNamespace(),
-					f18iter.Password.Namespace,
-					f18iter.Password.Name,
-				)
-				if err != nil {
-					return nil, err
-				}
-				f18iter.Password.Namespace = secretNamespace
 				tmpSecret, err := rm.rr.SecretValueFromReference(ctx, f18iter.Password)
 				if err != nil {
 					return nil, ackrequeue.Needed(err)
@@ -4734,19 +4669,6 @@ func TestSetSDK_Lambda_Function_EnvironmentVariable_MapOfSecrets_Create(t *testi
 			for f4f0key, f4f0valiter := range r.ko.Spec.Environment.Variables {
 				var f4f0val string
 				if f4f0valiter != nil {
-					secretNamespace, err := ackrt.ResolveCrossNamespaceReferenceString(
-						ctx,
-						rm.cfg.EnableCrossNamespace,
-						&r.ko.Status.Conditions,
-						ackrt.CrossNamespaceRefKindSecret,
-						r.ko.ObjectMeta.GetNamespace(),
-						f4f0valiter.Namespace,
-						f4f0valiter.Name,
-					)
-					if err != nil {
-						return nil, err
-					}
-					f4f0valiter.Namespace = secretNamespace
 					tmpSecret, err := rm.rr.SecretValueFromReference(ctx, f4f0valiter)
 					if err != nil {
 						return nil, ackrequeue.Needed(err)
@@ -4884,19 +4806,6 @@ func TestSetSDK_Lambda_Function_EnvironmentVariable_MapOfSecrets_Update(t *testi
 			for f2f0key, f2f0valiter := range r.ko.Spec.Environment.Variables {
 				var f2f0val string
 				if f2f0valiter != nil {
-					secretNamespace, err := ackrt.ResolveCrossNamespaceReferenceString(
-						ctx,
-						rm.cfg.EnableCrossNamespace,
-						&r.ko.Status.Conditions,
-						ackrt.CrossNamespaceRefKindSecret,
-						r.ko.ObjectMeta.GetNamespace(),
-						f2f0valiter.Namespace,
-						f2f0valiter.Name,
-					)
-					if err != nil {
-						return nil, err
-					}
-					f2f0valiter.Namespace = secretNamespace
 					tmpSecret, err := rm.rr.SecretValueFromReference(ctx, f2f0valiter)
 					if err != nil {
 						return nil, ackrequeue.Needed(err)

templates/pkg/resource/sdk.go.tpl

@@ -15,7 +15,6 @@ import (
 	ackcompare "github.com/aws-controllers-k8s/runtime/pkg/compare"
 	ackerr "github.com/aws-controllers-k8s/runtime/pkg/errors"
 	ackrequeue "github.com/aws-controllers-k8s/runtime/pkg/requeue"
-	ackrt "github.com/aws-controllers-k8s/runtime/pkg/runtime"
 	ackrtlog "github.com/aws-controllers-k8s/runtime/pkg/runtime/log"
 	"github.com/aws/aws-sdk-go-v2/aws"
 	svcsdk "github.com/aws/aws-sdk-go-v2/service/{{ .ServicePackageName }}"
@@ -40,7 +39,6 @@ var (
 	_ = fmt.Sprintf("")
 	_ = &ackrequeue.NoRequeue{}
 	_ = &aws.Config{}
-	_ = ackrt.ValidateCrossNamespaceReferenceString
 )
 
 // sdkFind returns SDK-specific information about a supplied resource