fix refs

api/v1alpha1/action_types.go

@@ -79,6 +79,12 @@ func (d *Action) IsReady() bool {
 }
 
 func (d *Action) ConnectionRef(ctx context.Context, refresolver *RefResolver) (*ConnectionRef, error) {
+	// Check if organization reference is cross-cluster
+	if d.Spec.OrganizationRef.ID != "" {
+		return &d.Spec.OrganizationRef.ConnectionRef, nil
+	}
+
+	// Fall back to K8s organization resolution
 	org, err := refresolver.OrganizationRef(ctx, &d.Spec.OrganizationRef, d.Namespace)
 	if err != nil {
 		return nil, err

api/v1alpha1/apiapp_types.go

@@ -18,7 +18,6 @@ package v1alpha1
 
 import (
 	"context"
-	"fmt"
 
 	"k8s.io/apimachinery/pkg/api/meta"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -77,7 +76,7 @@ func (d *APIApp) IsReady() bool {
 }
 
 func (d *APIApp) ConnectionRef(ctx context.Context, refresolver *RefResolver) (*ConnectionRef, error) {
-	// Check if using direct Zitadel ID reference
+	// Check if using direct Zitadel ID reference for project
 	if d.Spec.ProjectRef.ID != "" {
 		return &d.Spec.ProjectRef.ConnectionRef, nil
 	}
@@ -87,32 +86,19 @@ func (d *APIApp) ConnectionRef(ctx context.Context, refresolver *RefResolver) (*
 	if err != nil {
 		return nil, err
 	}
+
+	// Check if organization reference is cross-cluster
+	if project.Spec.OrganizationRef.ID != "" {
+		return &project.Spec.OrganizationRef.ConnectionRef, nil
+	}
+
+	// Fall back to K8s organization resolution
 	org, err := refresolver.OrganizationRef(ctx, &project.Spec.OrganizationRef, d.Namespace)
 	if err != nil {
 		return nil, err
 	}
 	return &org.Spec.ConnectionRef, nil
 }
-func (d *APIApp) Organization(ctx context.Context, refresolver *RefResolver) (*ResolvedReference, error) {
-	// Check if using direct Zitadel ID reference for project
-	if d.Spec.ProjectRef.ID != "" {
-		// For cross-cluster references, we need to get the organization ID from the project reference
-		// Since we don't have the full project object, we'll need to resolve the organization differently
-		// For now, return an error as this requires more complex handling
-		return nil, fmt.Errorf("cross-cluster organization resolution not yet implemented")
-	}
-
-	// Fall back to K8s reference resolution
-	project, err := refresolver.ProjectRef(ctx, &d.Spec.ProjectRef, d.Namespace)
-	if err != nil {
-		return nil, err
-	}
-	orgRef, err := refresolver.ResolveOrganization(ctx, &project.Spec.OrganizationRef, d.Namespace)
-	if err != nil {
-		return nil, err
-	}
-	return orgRef, nil
-}
 
 func (d *APIApp) Project(ctx context.Context, refresolver *RefResolver) (*ResolvedReference, error) {
 	return refresolver.ResolveProject(ctx, &d.Spec.ProjectRef, d.Namespace)

api/v1alpha1/flow_types.go

@@ -76,6 +76,12 @@ func (d *Flow) IsReady() bool {
 }
 
 func (d *Flow) ConnectionRef(ctx context.Context, refresolver *RefResolver) (*ConnectionRef, error) {
+	// Check if organization reference is cross-cluster
+	if d.Spec.OrganizationRef.ID != "" {
+		return &d.Spec.OrganizationRef.ConnectionRef, nil
+	}
+
+	// Fall back to K8s organization resolution
 	org, err := refresolver.OrganizationRef(ctx, &d.Spec.OrganizationRef, d.Namespace)
 	if err != nil {
 		return nil, err

api/v1alpha1/machineuser_types.go

@@ -127,6 +127,12 @@ func (d *MachineUser) IsReady() bool {
 }
 
 func (d *MachineUser) ConnectionRef(ctx context.Context, refresolver *RefResolver) (*ConnectionRef, error) {
+	// Check if organization reference is cross-cluster
+	if d.Spec.OrganizationRef.ID != "" {
+		return &d.Spec.OrganizationRef.ConnectionRef, nil
+	}
+
+	// Fall back to K8s organization resolution
 	org, err := refresolver.OrganizationRef(ctx, &d.Spec.OrganizationRef, d.Namespace)
 	if err != nil {
 		return nil, err

api/v1alpha1/oidcapp_types.go

@@ -18,7 +18,6 @@ package v1alpha1
 
 import (
 	"context"
-	"fmt"
 	"k8s.io/apimachinery/pkg/api/meta"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 )
@@ -100,7 +99,7 @@ func (d *OIDCApp) IsReady() bool {
 }
 
 func (d *OIDCApp) ConnectionRef(ctx context.Context, refresolver *RefResolver) (*ConnectionRef, error) {
-	// Check if using direct Zitadel ID reference
+	// Check if using direct Zitadel ID reference for project
 	if d.Spec.ProjectRef.ID != "" {
 		return &d.Spec.ProjectRef.ConnectionRef, nil
 	}
@@ -111,33 +110,18 @@ func (d *OIDCApp) ConnectionRef(ctx context.Context, refresolver *RefResolver) (
 		return nil, err
 	}
 
+	// Check if organization reference is cross-cluster
+	if project.Spec.OrganizationRef.ID != "" {
+		return &project.Spec.OrganizationRef.ConnectionRef, nil
+	}
+
+	// Fall back to K8s organization resolution
 	org, err := refresolver.OrganizationRef(ctx, &project.Spec.OrganizationRef, d.Namespace)
 	if err != nil {
 		return nil, err
 	}
-
 	return &org.Spec.ConnectionRef, nil
 }
-func (d *OIDCApp) Organization(ctx context.Context, refresolver *RefResolver) (*ResolvedReference, error) {
-	// Check if using direct Zitadel ID reference for project
-	if d.Spec.ProjectRef.ID != "" {
-		// For cross-cluster references, we need to get the organization ID from the project reference
-		// Since we don't have the full project object, we'll need to resolve the organization differently
-		// For now, return an error as this requires more complex handling
-		return nil, fmt.Errorf("cross-cluster organization resolution not yet implemented")
-	}
-
-	// Fall back to K8s reference resolution
-	project, err := refresolver.ProjectRef(ctx, &d.Spec.ProjectRef, d.Namespace)
-	if err != nil {
-		return nil, err
-	}
-	orgRef, err := refresolver.ResolveOrganization(ctx, &project.Spec.OrganizationRef, d.Namespace)
-	if err != nil {
-		return nil, err
-	}
-	return orgRef, nil
-}
 
 func (d *OIDCApp) Project(ctx context.Context, refresolver *RefResolver) (*ResolvedReference, error) {
 	return refresolver.ResolveProject(ctx, &d.Spec.ProjectRef, d.Namespace)

api/v1alpha1/project_types.go

@@ -96,12 +96,12 @@ func (d *Project) IsReady() bool {
 }
 
 func (d *Project) ConnectionRef(ctx context.Context, refresolver *RefResolver) (*ConnectionRef, error) {
-	// Check if using direct Zitadel ID reference
+	// Check if organization reference is cross-cluster
 	if d.Spec.OrganizationRef.ID != "" {
 		return &d.Spec.OrganizationRef.ConnectionRef, nil
 	}
 
-	// Fall back to K8s reference resolution
+	// Fall back to K8s organization resolution
 	org, err := refresolver.OrganizationRef(ctx, &d.Spec.OrganizationRef, d.Namespace)
 	if err != nil {
 		return nil, err