type: Reference complains about empty namespace

[JohanSandblom3]

What happened?

When trying to get extra resource using Reference a ReconcileError happens.

How can we reproduce it?

composition step:

  - step: run-function-extra-resources
    functionRef:
      name: function-extra-resources
    input:
      apiVersion: extra-resources.fn.crossplane.io/v1beta1
      kind: Input
      spec:
        extraResources:
        - apiVersion: v1
          into: my-secret-into
          kind: Secret
          ref:
            name: my-secret
          type: Reference

Status of XR:

status:
  conditions:
  - lastTransitionTime: "2024-08-30T12:05:20Z"
    message: 'cannot compose resources: fetching resources for my-secret-into: cannot
      get extra resource by name: an empty namespace may not be set when a resource
      name is provided'
    reason: ReconcileError
    status: "False"
    type: Synced

The very secret secret

kubectl create secret generic my-secret --from-literal=secret=value

What environment did it happen in?

Function version: v0.0.3
Crossplane version: 1.16.0-up.1

All running locally in a kind cluster.

• Cloud provider or hardware configuration
• Kubernetes version v1.25.3
• Kubernetes distribution kind
• OS Ubuntu 22.04.3 LTS on WSL2
• Kernel Linux CND1323TQQ 5.15.153.1-microsoft-standard-WSL2 fix(deps): update module k8s.io/apimachinery to v0.32.0 #1 SMP Fri Mar 29 23:14:13 UTC 2024 x86_64 x86_64 x86_64 GNU/Linux

[JohanSandblom3]

Shot in the dark here. Could it be that this is a bug in Crossplane?
https://github.com/crossplane/crossplane/blob/master/internal/controller/apiextensions/composite/extra_resources.go#L122

Ref:
https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/client-go/rest/request.go#L1032-L1034

They way I understand this is that namespace should be nil and never empty string when calling the API. Crossplane's usage of types.NamespacedName{Name: rs.GetMatchName()}(ref) will result in namespace being "" when it in fact have to be nil

[bobh66]

Secrets are namespaced so I would think it would be required? The function should probably accept a namespace if it is provided. I guess the better question is whether function-extra-resources supports namespaced resources?

[phisco]

Hi, yes, it's required, only cluster-scoped resources are allowed, the error message could be definitely more explicit.

[JohanSandblom3]

Hi, yes, it's required, only cluster-scoped resources are allowed, the error message could be definitely more explicit.

Ok, closing this issue