fix: resolve env-value-from references within their namespace

[darkweaver87]

Fixes #1248.

env-value-from collected Secrets and ConfigMaps into maps keyed by name alone, so two same-named objects in different namespaces overwrote each other, and references to the shadowed one were reported as unknown.

Objects are now kept per name and namespace, and a reference resolves against the objects visible from the namespace of the workload making it. An empty namespace on either side still matches, so manifests templated before install — which carry no namespace yet — keep linting exactly as they do today.

Two of the new tests fail without the change: TestSecretOfAnotherNamespaceDoesNotShadow (the false positive from the issue) and TestSecretOfAnotherNamespaceIsUnknown (the reverse hole, where a reference to a key that only exists in another namespace used to pass). TestSecretWithoutNamespaceStillResolves guards the lenient case above.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: bdfe0ec6-5b68-43fc-bb85-cd61f8f64485

📥 Commits

Reviewing files that changed from the base of the PR and between 31ffb2e and 5678814.

📒 Files selected for processing (2)

• pkg/templates/envvarvaluefrom/template.go
• pkg/templates/envvarvaluefrom/template_test.go

Included review availability: Your plan provides up to 8 included reviews per hour; 6 remain after this review.

---

📝 Walkthrough

Summary by CodeRabbit

• Bug Fixes
  • Improved Secret and ConfigMap reference resolution to respect the consuming resource’s namespace.
  • Prevented same-name resources in unrelated namespaces from incorrectly overriding valid references.
  • Preserved support for namespace-less resources when resolving environment variable values.

Walkthrough

The env-value-from template now preserves resource namespaces and resolves Secret and ConfigMap references against the consuming object’s namespace. Tests cover same-name resources, namespace-only mismatches, and namespace-less Secrets.

Changes

Namespace-aware env reference resolution

Layer / File(s)	Summary
Namespace-aware lookup and validation pkg/templates/envvarvaluefrom/template.go	Resource collections retain namespaces and support multiple resources with the same name. Reference validation checks namespace-compatible candidates and accepts a key when any candidate contains it.
Namespace resolution coverage pkg/templates/envvarvaluefrom/template_test.go	Tests cover same-name Secrets across namespaces, Secrets available only in another namespace, and namespace-less Secrets.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Merge Risk: ⚪ Minimal · up to 56788

The PR scopes Secret and ConfigMap reference resolution by namespace while preserving empty-namespace matching; no actionable merge-blocking risk remains after normal checks and review.

Suggested reviewers: rhybrill

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 4 functions across 2 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely describes the namespace-aware resolution fix for env-value-from references.
Description check	✅ Passed	The description directly explains the namespace collision bug, the implementation change, and the added test coverage.
Linked Issues check	✅ Passed	The changes address issue [#1248] by retaining namespaces, resolving references against the workload namespace, preventing cross-namespace overwrites, and preserving namespace-less matching.
Out of Scope Changes check	✅ Passed	The changes are limited to env-value-from lookup logic and focused tests for namespace-aware Secret resolution. No unrelated changes are identified.

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

❌ Patch coverage is 96.66667% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 31.39%. Comparing base (dbd7529) to head (5678814).
⚠️ Report is 347 commits behind head on main.

Files with missing lines	Patch %	Lines
pkg/templates/envvarvaluefrom/template.go	96.66%	1 Missing ⚠️

Additional details and impacted files

@@             Coverage Diff             @@
##             main    #1249       +/-   ##
===========================================
- Coverage   62.36%   31.39%   -30.97%     
===========================================
  Files         197      239       +42     
  Lines        4854     6564     +1710     
===========================================
- Hits         3027     2061      -966     
- Misses       1439     4327     +2888     
+ Partials      388      176      -212     

Flag	Coverage Δ
unit	31.39% <96.66%> (-30.97%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.