feat(plugin-fees): add multi-tenant support and fix AVP secret rendering

[prymax10]

Summary

• Adds multi-tenant support to the plugin-fees chart following the same pattern used by matcher and plugin-br-bank-transfer
• Fixes silent argocd-vault-plugin (AVP) substitution failure by migrating the fees Secret from data: + b64enc to stringData:
• Adds operational hardening: useExistingSecret guard, required validation, and checksum/config|secret pod annotations

Changes

File	Change
Chart.yaml	Bumped version 5.0.0 → 5.1.0
templates/fees/configmap.yaml	Added 11 MULTI_TENANT_* env vars (conditional on MULTI_TENANT_ENABLED=true); MULTI_TENANT_URL and MULTI_TENANT_REDIS_HOST use required
templates/fees/secrets.yaml	Migrated to stringData:; wrapped in {{- if not .Values.fees.useExistingSecret }}; added MULTI_TENANT_SERVICE_API_KEY (required when enabled) and MULTI_TENANT_REDIS_PASSWORD (optional)
templates/fees/deployment.yaml	Added checksum/config and checksum/secret pod annotations
values.yaml	Added defaults for the new fields with helm-docs annotations
CHANGELOG.md	Documented the feature, fix, and breaking-behavior notes

Why the data → stringData migration

Verified empirically that the existing data: + b64enc pattern was breaking AVP substitution in production:

$ kubectl get secret plugin-fees -n midaz-plugins-dev -o jsonpath='{.data.MONGO_PASSWORD}' | base64 -d
lerian   # the chart default — AVP placeholder was being base64-encoded as literal string

Helm runs b64enc on the literal <path:secret/data/...#KEY> placeholder string before AVP gets a chance to substitute it, so the actual Vault value never reaches the rendered manifest. The plugin-br-bank-transfer chart already uses stringData: correctly for the same reason.

Breaking notes for consumers

After upgrading, the next ArgoCD sync will rotate MONGO_PASSWORD, CLIENT_SECRET, LICENSE_KEY, and ORGANIZATION_IDS from chart defaults to actual Vault values. Operators must verify that downstream services (MongoDB user, OAuth client) are provisioned with the credentials stored in Vault before upgrading.

If any consumer was storing pre-base64-encoded values in Vault, switch them to plaintext.

Validation

• helm lint charts/plugin-fees — passes
• helm template (default, multi-tenant off) — renders cleanly, no MULTI_TENANT_* keys in ConfigMap
• helm template --set fees.configmap.MULTI_TENANT_ENABLED=true — fails fast with clear error: fees.secrets.MULTI_TENANT_SERVICE_API_KEY is required when MULTI_TENANT_ENABLED=true
• helm template with all required fields — renders all MULTI_TENANT_* configmap keys, both Secret keys, and checksum/config+checksum/secret annotations
• helm template --set fees.useExistingSecret=true --set fees.existingSecretName=external-secret — in-tree Secret skipped, deployment references external-secret

Test plan

• Approve and merge to develop
• CI publishes plugin-fees-helm:5.1.0 to Docker Hub OCI registry
• Update midaz-firmino-gitops to pin chart version 5.1.0 and verify the multi-tenant rollout in Clotilde dev
• Verify Vault paths resolve correctly (no more silent fallback to chart defaults)

[coderabbitai]

Caution

Review failed

Pull request was closed or merged during review

Walkthrough

This pull request updates the plugin-fees Helm chart from v5.0.0 to v5.1.0, introducing multi-tenant support via tenant-manager. Changes include new ConfigMap and Secret fields for multi-tenant configuration, migration of Secret storage format from Base64-encoded data to plaintext stringData, pod annotation checksums to trigger rollouts on resource changes, and corresponding values.yaml entries.

Changes

Cohort / File(s)	Summary
Version & Documentation CHANGELOG.md, Chart.yaml	Updated chart version to 5.1.0 and documented multi-tenant support, Secret format migration from data: + b64enc to stringData:, and pod annotation checksum additions.
Configuration Templates templates/fees/configmap.yaml, templates/fees/secrets.yaml, templates/fees/deployment.yaml	Added multi-tenant environment variables to ConfigMap with conditional rendering. Modified Secret to use stringData instead of data with Base64 encoding, made Secret generation conditional on useExistingSecret flag, and added pod annotations for ConfigMap/Secret checksum-based rollout triggers.
Configuration Values values.yaml	Added multi-tenant feature flags and parameters under fees.configmap (enablement, tenant-manager URL, Redis connection details, circuit breaker settings) and fees.secrets (API key, Redis password).

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}