Problem

The Makefile targets manifests and generate currently use paths="./...", and hack/update-codegen.sh passes the repo root (${SCRIPT_ROOT}) to gen_register. This tells controller-gen and kube_codegen to recursively scan the entire repository tree.

This works today because spark-operator is a single Go module, but it becomes a problem as soon as any nested Go module is introduced under the repo root — a pattern that's increasingly common in the Kubernetes operator ecosystem for platform integration, plugin scaffolding, or multi-component builds.

When that happens:

• controller-gen does not respect go.mod boundaries — it walks into the nested module, picks up its types, and produces stray CRD/RBAC manifests under config/
• gen_register scans API types from the nested module and generates register boilerplate that doesn't belong to the parent operator
• make verify-codegen breaks because the generated output no longer matches the checked-in files

Why this matters

• Organizations building platform layers commonly nest integration modules alongside the upstream operator to avoid maintaining a separate repository

Explicit path scoping is a low-cost defensive practice — it documents what the codegen is supposed to cover and prevents silent breakage if the repo structure evolves.

Proposed change

Makefile — Replace paths="./..." with an explicit variable:

WORKLOAD_OPERATOR_CODEGEN_PATHS := ./api/...;./cmd/...;./internal/...;./pkg/...

manifests: controller-gen
	$(CONTROLLER_GEN) ... paths="$(WORKLOAD_OPERATOR_CODEGEN_PATHS)" ...

generate: controller-gen manifests
	$(CONTROLLER_GEN) object:headerFile="hack/boilerplate.go.txt" paths="$(WORKLOAD_OPERATOR_CODEGEN_PATHS)"

hack/update-codegen.sh — Scope gen_register to the API directory:

kube::codegen::gen_register \
  --boilerplate "${SCRIPT_ROOT}/hack/boilerplate.go.txt" \
  "${SCRIPT_ROOT}/api"

No functional change for the current single-module layout. All existing CRDs, RBAC, and generated code remain identical.

cc: @nabuskey @vara-bonthu