## Summary Helm v3.19.5+ changed how null values in subchart `values.yaml` files are handled during value coalescing, causing subchart null defaults for `ingress.configureCertmanager` to shadow `global.ingress.configureCertmanager: true` instead of deferring to it. This silently drops `cert-manager.io/issuer` annotations from affected ingress resources. ## Steps to reproduce 1. Deploy the GitLab Helm chart with Helm 3.19.5+ (or 3.20.0+) 2. Use default values (i.e. `global.ingress.configureCertmanager: true`) 3. Render templates and inspect ingress annotations for webservice, registry, or minio 4. Observe that `cert-manager.io/issuer` and `acme.cert-manager.io/http01-edit-in-place` annotations are missing ## Configuration used ```yaml # Default values — no overrides needed to trigger the bug. # global.ingress.configureCertmanager defaults to true in values.yaml. ``` ## Current behavior On Helm 3.19.5+, the subchart null `ingress.configureCertmanager:` values are preserved during coalescing and treated as intentional overrides. The `pluck` fallback chain in `gitlab.certmanager_annotations` (`templates/_helpers.tpl`) picks up the null as the first match, evaluates it as falsy, and cert-manager annotations are silently omitted from webservice, registry, and minio ingress resources. ### Root Cause Helm 3.19.5 (https://github.com/helm/helm/pull/31119, backported from https://github.com/helm/helm/pull/30777) added a pre-pass in `coalesceTablesFullKey()` that propagates null values from subchart defaults into the parent/global merge. This was intended to fix https://github.com/helm/helm/issues/31118 (allowing users to explicitly null-out values via `--set`), but it does not distinguish between user-intentional nulls and chart-default nulls. ### Affected Files The following subchart `values.yaml` files default `ingress.configureCertmanager` to null (bare key with no value), expecting to inherit from `global.ingress.configureCertmanager`: - `charts/gitlab/charts/webservice/values.yaml` (two instances: `ingress` and `extraIngress` sections) - `charts/registry/values.yaml` - `charts/minio/values.yaml` The webservice and registry instances were identified while working with GitLab Dedicated. Other instances of this same pattern may be present elsewhere in the chart tree. ## Expected behavior Subchart null defaults for `configureCertmanager` should defer to the global value (`global.ingress.configureCertmanager: true`), and cert-manager annotations should be present on ingress resources when the global value is `true`. ### Suggested Fix Remove the bare `configureCertmanager:` keys from the affected subchart `values.yaml` files entirely. The `pluck` fallback chain in `gitlab.certmanager_annotations` already handles a missing local key by falling through to the global value, which is the intended behavior. No template changes are required. ## Versions - Chart: master (`git rev-parse HEAD`) - Helm: 3.19.5+ / 3.20.0+ - Platform: Any - Kubernetes: Any ## Relevant logs No errors are logged. The annotations are silently dropped during template rendering.