update lakekeeper/0.11.0

- chart 0.8.1 → 0.11.0 (appVersion 0.10.4 → 0.12.2)
- deps: postgres 1.5.8 → 1.5.13, openfga 0.2.44 → 0.2.62
- ingress: Kong → APISIX (use-regex + path /.*, cluster-issuer)
- openfga.playground 비활성화 (preshared 인증 패닉 방지)
- breaking=false, custom-values 키 전부 호환

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

manifests/helm/lakekeeper/0.11.0/charts/openfga/tests/deployment_zero_values_test.yaml

@@ -0,0 +1,59 @@
+suite: deployment - zero value handling
+templates:
+  - templates/deployment.yaml
+tests:
+  - it: should render OPENFGA_LIST_OBJECTS_MAX_RESULTS when set to 0
+    set:
+      listObjectsMaxResults: 0
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: OPENFGA_LIST_OBJECTS_MAX_RESULTS
+            value: "0"
+
+  - it: should render OPENFGA_LIST_OBJECTS_MAX_RESULTS when set to a positive value
+    set:
+      listObjectsMaxResults: 100
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: OPENFGA_LIST_OBJECTS_MAX_RESULTS
+            value: "100"
+
+  - it: should not render OPENFGA_LIST_OBJECTS_MAX_RESULTS when not set
+    asserts:
+      - notContains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: OPENFGA_LIST_OBJECTS_MAX_RESULTS
+          any: true
+
+  - it: should render OPENFGA_LIST_USERS_MAX_RESULTS when set to 0
+    set:
+      listUsersMaxResults: 0
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: OPENFGA_LIST_USERS_MAX_RESULTS
+            value: "0"
+
+  - it: should render OPENFGA_LIST_USERS_MAX_RESULTS when set to a positive value
+    set:
+      listUsersMaxResults: 100
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: OPENFGA_LIST_USERS_MAX_RESULTS
+            value: "100"
+
+  - it: should not render OPENFGA_LIST_USERS_MAX_RESULTS when not set
+    asserts:
+      - notContains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: OPENFGA_LIST_USERS_MAX_RESULTS
+          any: true

manifests/helm/lakekeeper/0.11.0/charts/openfga/tests/secondary_datastore_deployment_test.yaml

@@ -0,0 +1,143 @@
+suite: secondary datastore deployment
+templates:
+  - templates/deployment.yaml
+tests:
+  - it: should not render secondary env vars when secondary is not configured
+    set:
+      datastore:
+        engine: postgres
+        uri: "postgres://user:pass@primary:5432/openfga"
+    asserts:
+      - notContains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: OPENFGA_DATASTORE_SECONDARY_ENGINE
+          any: true
+
+  - it: should render secondary engine env var
+    set:
+      datastore:
+        engine: postgres
+        uri: "postgres://user:pass@primary:5432/openfga"
+        secondary:
+          engine: postgres
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: OPENFGA_DATASTORE_SECONDARY_ENGINE
+            value: "postgres"
+
+  - it: should render secondary URI from inline value via auto-generated secret
+    set:
+      datastore:
+        engine: postgres
+        uri: "postgres://user:pass@primary:5432/openfga"
+        secondary:
+          engine: postgres
+          uri: "postgres://user:pass@replica:5432/openfga"
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: OPENFGA_DATASTORE_SECONDARY_URI
+            valueFrom:
+              secretKeyRef:
+                name: "RELEASE-NAME-openfga-secondary-datastore-secret"
+                key: "uri"
+
+  - it: should render secondary URI from uriSecret
+    set:
+      datastore:
+        engine: postgres
+        uri: "postgres://user:pass@primary:5432/openfga"
+        secondary:
+          engine: postgres
+          uriSecret: my-uri-secret
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: OPENFGA_DATASTORE_SECONDARY_URI
+            valueFrom:
+              secretKeyRef:
+                name: "my-uri-secret"
+                key: uri
+
+  - it: should render secondary URI from existingSecret with custom key
+    set:
+      datastore:
+        engine: postgres
+        uri: "postgres://user:pass@primary:5432/openfga"
+        secondary:
+          engine: postgres
+          existingSecret: my-existing-secret
+          secretKeys:
+            uriKey: db-uri
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: OPENFGA_DATASTORE_SECONDARY_URI
+            valueFrom:
+              secretKeyRef:
+                name: "my-existing-secret"
+                key: "db-uri"
+
+  - it: should render secondary username and password from existingSecret
+    set:
+      datastore:
+        engine: postgres
+        uri: "postgres://user:pass@primary:5432/openfga"
+        secondary:
+          engine: postgres
+          existingSecret: my-existing-secret
+          secretKeys:
+            uriKey: db-uri
+            usernameKey: db-user
+            passwordKey: db-pass
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: OPENFGA_DATASTORE_SECONDARY_USERNAME
+            valueFrom:
+              secretKeyRef:
+                name: "my-existing-secret"
+                key: "db-user"
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: OPENFGA_DATASTORE_SECONDARY_PASSWORD
+            valueFrom:
+              secretKeyRef:
+                name: "my-existing-secret"
+                key: "db-pass"
+
+  - it: should render secondary username and password from inline values via auto-generated secret
+    set:
+      datastore:
+        engine: postgres
+        uri: "postgres://user:pass@primary:5432/openfga"
+        secondary:
+          engine: postgres
+          uri: "postgres://replica:5432/openfga"
+          username: replica-user
+          password: replica-pass
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: OPENFGA_DATASTORE_SECONDARY_USERNAME
+            valueFrom:
+              secretKeyRef:
+                name: "RELEASE-NAME-openfga-secondary-datastore-secret"
+                key: "username"
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: OPENFGA_DATASTORE_SECONDARY_PASSWORD
+            valueFrom:
+              secretKeyRef:
+                name: "RELEASE-NAME-openfga-secondary-datastore-secret"
+                key: "password"

manifests/helm/lakekeeper/0.11.0/charts/openfga/tests/secondary_datastore_secrets_test.yaml

@@ -0,0 +1,66 @@
+suite: secondary datastore secrets
+templates:
+  - templates/secrets.yaml
+tests:
+  - it: should not render secondary secret when secondary is not configured
+    set:
+      datastore:
+        engine: postgres
+        uri: "postgres://user:pass@primary:5432/openfga"
+    asserts:
+      - hasDocuments:
+          count: 1
+
+  - it: should render secondary secret with uri
+    set:
+      datastore:
+        engine: postgres
+        uri: "postgres://user:pass@primary:5432/openfga"
+        secondary:
+          uri: "postgres://user:pass@replica:5432/openfga"
+    asserts:
+      - hasDocuments:
+          count: 2
+      - equal:
+          path: metadata.name
+          value: "RELEASE-NAME-openfga-secondary-datastore-secret"
+        documentIndex: 1
+      - isNotNullOrEmpty:
+          path: data.uri
+        documentIndex: 1
+
+  - it: should render secondary secret with all credentials
+    set:
+      datastore:
+        engine: postgres
+        uri: "postgres://user:pass@primary:5432/openfga"
+        secondary:
+          uri: "postgres://replica:5432/openfga"
+          username: replica-user
+          password: replica-pass
+    asserts:
+      - hasDocuments:
+          count: 2
+      - isNotNullOrEmpty:
+          path: data.uri
+        documentIndex: 1
+      - isNotNullOrEmpty:
+          path: data.username
+        documentIndex: 1
+      - isNotNullOrEmpty:
+          path: data.password
+        documentIndex: 1
+
+  - it: should not render secondary secret when using existingSecret
+    set:
+      datastore:
+        engine: postgres
+        uri: "postgres://user:pass@primary:5432/openfga"
+        secondary:
+          engine: postgres
+          existingSecret: my-existing-secret
+          secretKeys:
+            uriKey: db-uri
+    asserts:
+      - hasDocuments:
+          count: 1