test(kubernetes): add positive cluster render test and pin document kind

Adds an assertion that cluster.yaml renders successfully when
_namespace.etcd is set and produces a KamajiControlPlane whose
dataStoreName equals the tenant's etcd DataStore name. Without this
positive case a future edit that inverts or removes the existing etcd
guard would pass the suite as long as the negative case still fails.

Also adds documentSelector: kind=Deployment to the kccm and csi
controller assertions so the jsonpath filter operates on a single
document, matching the cluster-autoscaler case and removing
reliance on helm-unittest filter-vs-single-value coercion.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>

packages/apps/kubernetes/tests/admin_kubeconfig_wait_test.yaml

@@ -39,6 +39,9 @@ tests:
 
   - it: kccm mounts admin-kubeconfig as optional
     template: templates/kccm/manager.yaml
+    documentSelector:
+      path: kind
+      value: Deployment
     asserts:
       - equal:
           path: spec.template.spec.volumes[?(@.name=="kubeconfig")].secret.secretName
@@ -49,13 +52,25 @@ tests:
 
   - it: kccm waits for admin-kubeconfig via initContainer
     template: templates/kccm/manager.yaml
+    documentSelector:
+      path: kind
+      value: Deployment
     asserts:
       - equal:
           path: spec.template.spec.initContainers[0].name
           value: wait-for-kubeconfig
+      - contains:
+          path: spec.template.spec.initContainers[0].volumeMounts
+          content:
+            name: kubeconfig
+            mountPath: /etc/kubernetes/kubeconfig
+            readOnly: true
 
   - it: csi controller mounts admin-kubeconfig as optional
     template: templates/csi/deploy.yaml
+    documentSelector:
+      path: kind
+      value: Deployment
     asserts:
       - equal:
           path: spec.template.spec.volumes[?(@.name=="kubeconfig")].secret.secretName
@@ -66,10 +81,29 @@ tests:
 
   - it: csi controller waits for admin-kubeconfig via initContainer
     template: templates/csi/deploy.yaml
+    documentSelector:
+      path: kind
+      value: Deployment
     asserts:
       - equal:
           path: spec.template.spec.initContainers[0].name
           value: wait-for-kubeconfig
+      - contains:
+          path: spec.template.spec.initContainers[0].volumeMounts
+          content:
+            name: kubeconfig
+            mountPath: /etc/kubernetes/kubeconfig
+            readOnly: true
+
+  - it: cluster.yaml renders and wires dataStoreName when tenant has etcd
+    template: templates/cluster.yaml
+    documentSelector:
+      path: kind
+      value: KamajiControlPlane
+    asserts:
+      - equal:
+          path: spec.dataStoreName
+          value: tenant-root
 
   - it: cluster.yaml fails render when tenant has no etcd DataStore
     template: templates/cluster.yaml