docs: document enableCrossNamespace Helm value and cross-link references

Add an enableCrossNamespace entry to the Helm chart values reference and
cross-link it from the Field References concept and the Field Export guide,
covering the resource reference, secret reference, and field export behaviors
gated by the --enable-cross-namespace flag.

Author: rhaowang

website/docs/concepts.md

@@ -363,6 +363,10 @@ spec:
 
 The controller resolves these references at reconciliation time. See the [API Reference](/services) for available reference fields on each CRD.
 
+:::warning
+Resource and Secret references can point to a different namespace by setting a `namespace` field on the reference. This cross-namespace behavior is gated by the `enableCrossNamespace` Helm value (`--enable-cross-namespace` flag), whose default will change from `true` to `false` in a future release. See [Breaking Changes](/breaking-changes) and the [Helm value reference](/guides/helm-values#cross-namespace-references) for details.
+:::
+
 For complex resource orchestration and dependencies, we recommend using [kro (Kube Resource Orchestrator)](https://kro.run).
 
 ## Release Phases

website/docs/guides/field-export.md

@@ -108,7 +108,9 @@ spec:
 
 ## Security Considerations
 
-`FieldExport` only exports fields from resources in the **same namespace** as the `FieldExport` resource. This prevents users from exporting fields from resources they don't have access to in other namespaces.
+By default, `FieldExport` can target a ConfigMap or Secret in a different namespace than the source resource. This cross-namespace behavior is gated by the `enableCrossNamespace` Helm value (`--enable-cross-namespace` flag), whose default will change from `true` to `false` in a future release. When disabled, `FieldExport` only operates within the **same namespace** as the source resource, which prevents users from exporting fields to namespaces they don't have access to.
+
+See [Breaking Changes](/breaking-changes) and the [Helm value reference](/guides/helm-values#cross-namespace-references) for details.
 
 ## Next Steps
 

website/docs/guides/helm-values.md

@@ -284,6 +284,17 @@ serviceAccount:
 
 For cross-account resource management, use the **IAMRoleSelector** feature gate (recommended) or CARM feature gates. See [Granular IAM Roles](/guides/cross-account) for setup instructions.
 
+## Cross-Namespace References
+
+### `enableCrossNamespace`
+- **Type**: Boolean
+- **Default**: `true`
+- **Description**: Enable cross-namespace behavior including resource references (`*Ref` fields), secret references (`SecretKeyReference`), and `FieldExport` targets. When `false`, the controller rejects any operation that crosses namespace boundaries. Maps to the `--enable-cross-namespace` controller flag.
+
+:::warning
+The default for `enableCrossNamespace` will change from `true` to `false` in a future release. If you rely on cross-namespace references, explicitly set `enableCrossNamespace: true` before upgrading. See [Breaking Changes](/breaking-changes) for details.
+:::
+
 ## Feature Gates
 
 Feature gates allow you to enable experimental or optional controller features.