JCasC since chart 5.8.72 no longer honors controller.JCasC.defaultConfig: false (reopen)

[cfraenkel]

Describe the bug

This is basically a re-open of #1435 .
With the revert that was done as part of #1470 the issue occurs again / is still valid.
When rendering with defaultConfig: false two additional config maps jenkins-jenkins-config-securityrealm and jenkins-jenkins-config-authorizationstrategy are now generated. These conflict with external, argocd managed configmaps that already contain authorizationStrategy and securityRealm settings. As a result Jenkins fails to start.

Version of Helm and Kubernetes

- Helm: v3.14.3

Chart version

5.8.85

What happened?

• Install helm chart version <= 5.8.71 with controller.JCasC.defaultConfig=false
• Maintain jenkins casc config in separate configmaps.
• Upgrade to 5.8.72 or 5.8.85
• Jenkins fails to start up with

	java.lang.IllegalArgumentException: Single entry map expected to configure a hudson.security.SecurityRealm
		at PluginClassLoader for configuration-as-code//io.jenkins.plugins.casc.impl.configurators.HeteroDescribableConfigurator.configureMapping(HeteroDescribableConfigurator.java:303)
		at PluginClassLoader for configuration-as-code//io.jenkins.plugins.casc.impl.configurators.HeteroDescribableConfigurator.preConfigure(HeteroDescribableConfigurator.java:285)
		at PluginClassLoader for configuration-as-code//io.jenkins.plugins.casc.impl.configurators.HeteroDescribableConfigurator.configure(HeteroDescribableConfigurator.java:85)
		at PluginClassLoader for configuration-as-code//io.jenkins.plugins.casc.impl.configurators.HeteroDescribableConfigurator.check(HeteroDescribableConfigurator.java:94)
		at PluginClassLoader for configuration-as-code//io.jenkins.plugins.casc.impl.configurators.HeteroDescribableConfigurator.check(HeteroDescribableConfigurator.java:57)
		at PluginClassLoader for configuration-as-code//io.jenkins.plugins.casc.BaseConfigurator.configure(BaseConfigurator.java:360)
		at PluginClassLoader for configuration-as-code//io.jenkins.plugins.casc.BaseConfigurator.check(BaseConfigurator.java:293)
		at PluginClassLoader for configuration-as-code//io.jenkins.plugins.casc.ConfigurationAsCode.lambda$checkWith$9(ConfigurationAsCode.java:868)
		at PluginClassLoader for configuration-as-code//io.jenkins.plugins.casc.ConfigurationAsCode.invokeWith(ConfigurationAsCode.java:811)
		at PluginClassLoader for configuration-as-code//io.jenkins.plugins.casc.ConfigurationAsCode.checkWith(ConfigurationAsCode.java:868)
		at PluginClassLoader for configuration-as-code//io.jenkins.plugins.casc.ConfigurationAsCode.configureWith(ConfigurationAsCode.java:854)
		at PluginClassLoader for configuration-as-code//io.jenkins.plugins.casc.ConfigurationAsCode.configureWith(ConfigurationAsCode.java:733)
		at PluginClassLoader for configuration-as-code//io.jenkins.plugins.casc.ConfigurationAsCode.configure(ConfigurationAsCode.java:356)
		at PluginClassLoader for configuration-as-code//io.jenkins.plugins.casc.TokenReloadAction.doIndex(TokenReloadAction.java:60)
		at java.base/java.lang.invoke.MethodHandle.invokeWithArguments(Unknown Source)
		at org.kohsuke.stapler.Function$MethodFunction.invoke(Function.java:484)

and

	2025-09-03 15:40:07.419+0000 [id=36]	SEVERE	hudson.util.BootFailure#publish: Failed to initialize Jenkins
	java.lang.IllegalArgumentException: Single entry map expected to configure a hudson.security.AuthorizationStrategy
		at PluginClassLoader for configuration-as-code//io.jenkins.plugins.casc.impl.configurators.HeteroDescribableConfigurator.configureMapping(HeteroDescribableConfigurator.java:303)
		at PluginClassLoader for configuration-as-code//io.jenkins.plugins.casc.impl.configurators.HeteroDescribableConfigurator.preConfigure(HeteroDescribableConfigurator.java:285)
		at PluginClassLoader for configuration-as-code//io.jenkins.plugins.casc.impl.configurators.HeteroDescribableConfigurator.configure(HeteroDescribableConfigurator.java:85)
		at PluginClassLoader for configuration-as-code//io.jenkins.plugins.casc.impl.configurators.HeteroDescribableConfigurator.check(HeteroDescribableConfigurator.java:94)
		at PluginClassLoader for configuration-as-code//io.jenkins.plugins.casc.impl.configurators.HeteroDescribableConfigurator.check(HeteroDescribableConfigurator.java:57)
		at PluginClassLoader for configuration-as-code//io.jenkins.plugins.casc.BaseConfigurator.configure(BaseConfigurator.java:360)
		at PluginClassLoader for configuration-as-code//io.jenkins.plugins.casc.BaseConfigurator.check(BaseConfigurator.java:293)
		at PluginClassLoader for configuration-as-code//io.jenkins.plugins.casc.ConfigurationAsCode.lambda$checkWith$9(ConfigurationAsCode.java:868)
		at PluginClassLoader for configuration-as-code//io.jenkins.plugins.casc.ConfigurationAsCode.invokeWith(ConfigurationAsCode.java:811)
		at PluginClassLoader for configuration-as-code//io.jenkins.plugins.casc.ConfigurationAsCode.checkWith(ConfigurationAsCode.java:868)
		at PluginClassLoader for configuration-as-code//io.jenkins.plugins.casc.ConfigurationAsCode.configureWith(ConfigurationAsCode.java:854)
		at PluginClassLoader for configuration-as-code//io.jenkins.plugins.casc.ConfigurationAsCode.configureWith(ConfigurationAsCode.java:733)
		at PluginClassLoader for configuration-as-code//io.jenkins.plugins.casc.ConfigurationAsCode.configure(ConfigurationAsCode.java:356)
		at PluginClassLoader for configuration-as-code//io.jenkins.plugins.casc.ConfigurationAsCode.init(ConfigurationAsCode.java:345)

What you expected to happen?

Jenkins should not render configmaps containing casc config when controller.JCasC.defaultConfig=false

How to reproduce it

helm template jenkins jenkins/jenkins --version 5.8.85 --set controller.JCasC.defaultConfig=false

Anything else we need to know?

No response