Apply driftDetection ignore paths to the object sent for the server-side dry-run, not only to the resulting diff #1613

We configure driftDetection.ignore on a HelmRelease for fields of an SGShardedCluster that an in-cluster controller legitimately patches after install (/spec/coordinator/pods/persistentVolume/size, /spec/shards/pods/persistentVolume/size, /spec/shards/overrides). Despite that, the reconcile fails because the target's validating webhook rejects the dry-run: the chart's declared size is smaller than the live size.

Cause

In fluxcd/pkg/ssa/jsondiff (Unstructured()), the helm-controller drift check sends a server-side dry-run Patch of the raw rendered manifest. The ignore paths are only applied afterwards, when generating the diff from a dry-run that already succeeded. So admission webhooks always see the un-ignored value, and a rejection returns a dry-run error before the ignore rules are evaluated.

Expected

Paths covered by driftDetection.ignore keep their live values in the object submitted for the dry-run, so ignored fields can't cause admission failures. kustomize-controller already does this via ApplyOptions.DriftIgnoreRules (fluxcd/pkg#1157), but helm-controller doesn't set it.

Actual

The dry-run uses the chart's value, and the webhook rejects it.

Workaround

Setting helm.toolkit.fluxcd.io/driftDetection: disabled on the resource skips the dry-run, but it disables drift detection for the whole resource, not just the ignored fields.

Environment

• helm-controller v1.4.5
• Target: StackGres SGShardedCluster with a validating webhook

Happy to supply logs and the HelmRelease spec.