[BUG] argo-rollouts-agent renders empty spec.declarative.deployment, fails CRD validation

[elamaran11]

📋 Prerequisites

• I have searched the existing issues to avoid creating a duplicate
• By submitting this issue, you agree to follow the Code of Conduct
• I am using the latest version of the software
• I can consistently reproduce this issue

🎯 Affected Service(s)

Controller Service (Helm chart rendering)

🚦 Impact/Severity

Blocker — the argo-rollouts-conversion-agent Agent CR cannot be applied at all in kagent v0.7.9, which means any GitOps tool (Argo CD, Flux) reconciling the chart's output stays permanently out-of-sync.

🐛 Bug Description

The argo-rollouts-agent subchart's Agent template (charts/argo-rollouts-agent/templates/agent.yaml) is missing the resources: block in its spec.declarative.deployment: section that every other agent subchart includes. When the default values are used (imagePullSecrets: []), the entire deployment: key renders empty, which the API server normalizes to null. The Agent CRD's CEL validation then rejects the object:

Agent.kagent.dev "argo-rollouts-conversion-agent" is invalid:
  spec.declarative.deployment: Invalid value: "null":
  spec.declarative.deployment in body must be of type object

🔄 Steps To Reproduce

helm template kagent oci://ghcr.io/kagent-dev/kagent/helm/kagent --version 0.7.9 \
  --namespace kagent | yq 'select(.kind=="Agent" and .metadata.name=="argo-rollouts-conversion-agent")
                            | .spec.declarative.deployment'
# null

Apply that manifest to a cluster with the v1alpha2 CRD and you'll get the validation error above.

For comparison, every other agent subchart renders a populated deployment: block:

$ helm template kagent oci://ghcr.io/kagent-dev/kagent/helm/kagent --version 0.7.9 \
    | yq 'select(.kind=="Agent") | .metadata.name + " => " + (.spec.declarative.deployment | tostring)'
argo-rollouts-conversion-agent => null                # <-- broken
cilium-debug-agent => {"resources":{"limits":{"cpu":"1000m",...}}}
cilium-manager-agent => {"resources":{"limits":...}}
... (every other agent has resources populated)

🔬 Root Cause

charts/argo-rollouts-agent/templates/agent.yaml ends with:

    deployment:
      {{- with coalesce (empty .Values.imagePullSecrets | ternary nil .Values.imagePullSecrets) .Values.global.imagePullSecrets }}
      imagePullSecrets:
        {{- toYaml . | nindent 8 }}
      {{- end }}

Compare with e.g. charts/cilium-debug-agent/templates/agent.yaml, which has the same imagePullSecrets block plus:

      resources:
        {{- toYaml .Values.resources | nindent 8 }}

The argo-rollouts-agent chart's values.yaml already defines a matching resources: block — it's just never wired into the template. Adding the two missing lines makes the rendered deployment: non-empty under default values and the CRD validation passes.

💡 Suggested Fix

Append the standard resources: block to charts/argo-rollouts-agent/templates/agent.yaml:

     deployment:
       {{- with coalesce (empty .Values.imagePullSecrets | ternary nil .Values.imagePullSecrets) .Values.global.imagePullSecrets }}
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}
+      resources:
+        {{- toYaml .Values.resources | nindent 8 }}

This brings the chart in line with the nine other agent subcharts and ensures the rendered Agent passes the CRD's (self.type == 'Declarative' && has(self.declarative)) validation under default values.

🌍 Environment

• kagent chart version: 0.7.9 (oci://ghcr.io/kagent-dev/kagent/helm/kagent:0.7.9)
• Agent CRD: kagent.dev/v1alpha2
• Kubernetes: EKS 1.32 (Auto Mode)
• Helm: 3.16
• Discovered while reconciling kagent via Argo CD; the broken Agent kept the entire kagent Application OutOfSync.

🛠️ Workaround

Disable the subchart via top-level toggle (the chart's Chart.yaml declares condition: argo-rollouts-agent.enabled):

argo-rollouts-agent:
  enabled: false

📎 Related

• Bug: argo-rollouts-agent and other agents render despite enabled: false #1224 / [BUG] Helm Template Kustomize Rending Fails - Agents - 0.7.9 #1225 — separate report that the agents.<name>.enabled: false path doesn't actually disable subcharts (the working toggle is the top-level <name>.enabled: false form, per Chart.yaml's condition: field).