BUG: Updating a chart in pull mode completely removes deployed artifacts

[thecodeassassin]

Problem Description

We changed a few values and it caused all the deployed components to be completely removed instead of failing. This is absolutely not desired behavior.

apiVersion: config.projectsveltos.io/v1beta1
kind: Profile
metadata:
  name: deploy-cert-manager
  namespace: managed-<redacted>
spec:
  clusterSelector:
    matchLabels:
      customer: "<redacted>"
  syncMode: ContinuousWithDriftDetection

  templateResourceRefs:
  - resource:
      apiVersion: v1
      kind: ConfigMap
      name: cert-manager-config-{{ .Cluster.metadata.name }}
      namespace: managed-<redacted>
    identifier: config

  policyRefs:
  - name: cert-manager-clusterissuer
    namespace: managed-<redacted>
    kind: ConfigMap

  helmCharts:
  - repositoryURL: https://charts.jetstack.io
    repositoryName: cert-manager
    chartName: cert-manager/cert-manager
    chartVersion: '{{ (index .MgmtResources "config").data.certManagerVersion }}'
    releaseName: cert-manager
    releaseNamespace: cert-manager
    helmChartAction: Install
    valuesFrom:
    - kind: ConfigMap
      name: cert-manager-values-{{ .Cluster.metadata.name }}
      namespace: managed-<redacted>

The values with the wrong indentation:

apiVersion: v1
kind: ConfigMap
metadata:
  name: cert-manager-values-<redacted>-databases
  namespace: managed-<redacted>
data:
  values: |
    crds:
      enabled: true
      replicaCount: 2 <-- this should be top level

Cluster summary:

Name:         p--deploy-cert-manager-sveltos-<redacted>-databases
Namespace:    managed-<redacted>
Labels:       projectsveltos.io/cluster-name=<redacted>-databases
              projectsveltos.io/cluster-type=Sveltos
              projectsveltos.io/profile-name=deploy-cert-manager
Annotations:  argocd.argoproj.io/tracking-id: sveltos-profiles:config.projectsveltos.io/Profile:managed-<redacted>/deploy-cert-manager
              projectsveltos.io/retrigger: 2026-04-18T17:43:52.781983045Z
API Version:  config.projectsveltos.io/v1beta1
Kind:         ClusterSummary
Metadata:
  Creation Timestamp:  2026-04-06T20:19:21Z
  Finalizers:
    clustersummaryfinalizer.projectsveltos.io
  Generation:  17
  Owner References:
    API Version:     config.projectsveltos.io/v1beta1
    Kind:            Profile
    Name:            deploy-cert-manager
    UID:             fc4d1812-fd67-4ab3-8b35-198461b106ce
  Resource Version:  165894722
  UID:               ff7ac8cd-d89e-4eec-96b6-b617bfa38df7
Spec:
  Cluster Name:       <redacted>-databases
  Cluster Namespace:  managed-<redacted>
  Cluster Profile Spec:
    Cluster Selector:
      Match Labels:
        Customer:          <redacted>
    Continue On Conflict:  false
    Continue On Error:     false
    Helm Charts:
      Chart Name:         cert-manager/cert-manager
      Chart Version:      {{ (index .MgmtResources "config").data.certManagerVersion }}
      Helm Chart Action:  Install
      Release Name:       cert-manager
      Release Namespace:  cert-manager
      Repository Name:    cert-manager
      Repository URL:     https://charts.jetstack.io
      Values From:
        Kind:       ConfigMap
        Name:       cert-manager-values-{{ .Cluster.metadata.name }}
        Namespace:  managed-<redacted>
        Optional:   false
    Policy Refs:
      Deployment Type:       Remote
      Kind:                  ConfigMap
      Name:                  cert-manager-clusterissuer
      Namespace:             managed-<redacted>
      Optional:              false
      Tier:                  100
    Reloader:                false
    Stop Matching Behavior:  WithdrawPolicies
    Sync Mode:               ContinuousWithDriftDetection
    Template Resource Refs:
      Identifier:             config
      Ignore Status Changes:  false
      Optional:               false
      Resource:
        API Version:  v1
        Kind:         ConfigMap
        Name:         cert-manager-config-<redacted>-databases
        Namespace:    managed-<redacted>
    Tier:             100
  Cluster Type:       Sveltos
Status:
  Dependencies:  no dependencies
  Deployed Gv Ks:
    Deployed Group Version Kind:
      ServiceAccount.v1.
      CustomResourceDefinition.v1.apiextensions.k8s.io
      ClusterRole.v1.rbac.authorization.k8s.io
      ClusterRoleBinding.v1.rbac.authorization.k8s.io
      Role.v1.rbac.authorization.k8s.io
      RoleBinding.v1.rbac.authorization.k8s.io
      Service.v1.
      Deployment.v1.apps
      MutatingWebhookConfiguration.v1.admissionregistration.k8s.io
      ValidatingWebhookConfiguration.v1.admissionregistration.k8s.io
      Job.v1.batch
    Feature Id:  Helm
    Deployed Group Version Kind:
      ClusterIssuer.v1.cert-manager.io
      Certificate.v1.cert-manager.io
    Feature Id:  Resources
  Feature Summaries:
    Consecutive Failures:  2
    Failure Message:       values don't meet the specifications of the schema(s) in the following chart(s):
cert-manager:
- at '/crds': additional properties 'replicaCount' not allowed

    Feature Id:         Helm
    Hash:               mMP71JbTCWoaAdm8pDbs+rYhPZ1O9NVCjUlDAYB6w80=
    Last Applied Time:  2026-04-18T17:44:13Z
    Status:             Failed
    Feature Id:         Resources
    Hash:               hn7ZqfpTfDILDIMLAEfmC4hQXR0H6fKEzWV8UEXa2lk=
    Last Applied Time:  2026-04-18T17:44:03Z
    Status:             Provisioning
  Helm Release Summaries:
    Release Name:       cert-manager
    Release Namespace:  cert-manager
    Status:             Managing
    Values Hash:        uHgnUljrEBsWynaXJjcLt0c5djSe1eNQ7xiaoopttaE=
  Next Reconcile Time:  2026-04-18T17:44:33Z
Events:
  Type    Reason   Age   From            Message
  ----    ------   ----  ----            -------
  Normal  Sveltos  18s   event-recorder  Feature: Resources deployed to cluster Sveltos managed-<redacted>/<redacted>-databases

System Information

SVELTOS VERSION: 1.7.0
KUBERNETES VERSION: 1.34.6

Logs

addon controller
https://gist.github.com/thecodeassassin/4b299769c264ddd6b8772b21e366657e

applier manager on managed cluster
https://gist.github.com/thecodeassassin/1e9e22aa76b4dcdd0ae21585341de80d