Function validate_replication_destination_secret_namespace 

pub fn validate_replication_destination_secret_namespace(
    destination: &Backend,
    cr_namespace: &str,
) -> ValidationResult

A RepositoryReplication’s destination credential Secret is reachable from the mover Job. The replicate Job runs in the CR’s own namespace and loads the destination backend’s keys via envFrom, which is namespace-local — a Secret in another namespace can never be read. RepositoryReplication deliberately has no credentialProjection, so an out-of-namespace destination auth.secretRef is a dead reference the Job would hang on (CreateContainerConfigError). Reject it at admission with an actionable message instead. An absent namespace means “same namespace as the CR” and is always legal; a workload- identity or filesystem destination carries no auth Secret and is unaffected. cr_namespace is the replication CR’s own namespace.