helm diff --three-way-merge does not detect manual changes on Custom Resources (CRDs)

We are seeing inconsistent behavior with helm diff upgrade --three-way-merge when detecting manual changes made directly in the Kubernetes cluster, specifically for Custom Resources (CRDs).

For built-in Kubernetes resources (e.g. Deployment), helm diff --three-way-merge correctly detects live changes made via kubectl edit/patch.
However, for CRDs (example below uses KEDA ScaledObject), manual changes in the cluster are not detected, even when the field is explicitly defined in the Helm chart.

What works ✅
For built-in resources (e.g. Deployment):

1.Deploy via Helm
2.Manually edit:
kubectl edit deployment my-app
change resources.limits.memory value

Run:
helm diff upgrade <release> <chart> --three-way-merge --dry-run

➡️ The manual change is detected and shown in the diff.

What does NOT work ❌
For CRDs (example: KEDA ScaledObject):

Deploy via Helm with spec.maxReplicaCount defined in the chart
Manually edit the ScaledObject:

kubectl patch scaledobject my-so \
  -n <ns> \
  --type=merge \
  -p '{"spec":{"maxReplicaCount":30}}'

Run:
helm diff upgrade <release> <chart> --three-way-merge --dry-run

➡️ No diff is shown, even though the live value differs from the chart.

Questions:

Is this a known limitation of helm-diff with CRDs?
Is --three-way-merge expected not to detect live drift for CRDs?
Are there plans or recommendations for supporting live drift detection on CRDs?

Also experiencing this with crossplane CRDs. Diffs don't catch drifts, kubectl does though.

helm template  ... > outofspec.yaml
kubectl diff -f outofspec.yaml
...
   identity:
     secretRef:
       key: creds
-      name: azure-provider-creds-badedit
+      name: azure-provider-creds
...

# VS

helm diff upgrade ... --three-way-merge ...
# no changes

fix: detect manual changes on CRDs and CRs with three-way-merge

test: add tests for three-way merge with unstructured objects

@orco49

@orco49 could you try to use this fix/cr-three-way-merge?

I'm experiencing the same issue with Istio's CRDs (specifically, AuthorizationPolicy). Steps to reproduce:

Deploy a chart with Helm (in our case, Helmfile)
Make a manual change using kubectl edit to an AuthorizationPolicy resource
helmfile apply --interactive does not show a diff
helmfile template | kubectl diff -f - does

I tried the branch you posted and got an error that I'll post over in that PR.

@orco49

@orco49 did you test the proposed fix in #923?

test: add e2e regression test for CR/CRD drift detection (#917)

fix(test): pre-install the CRD before helm install in #917 e2e test

fix(test): adopt the pre-installed CRD into the release in #917 e2e test

fix(test): drift a names field instead of served in #917 CRD scenario

fix: detect manual changes on CRDs and CRs with three-way-merge (#923)

Navigation Menu

Repository navigation

helm diff --three-way-merge does not detect manual changes on Custom Resources (CRDs) #917

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

helm diff --three-way-merge does not detect manual changes on Custom Resources (CRDs) #917

Description

Activity

closedEyesSearch commented on Jan 23, 2026

yxxhero commented on Feb 1, 2026

terabyte128 commented on Feb 10, 2026

frittentheke commented on Aug 3, 2026

Metadata

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Issue actions